SATURDAY, SEPTEMBER 5, 2026|No. 13862

Cybersecurity · Vulnerability

Critical Chromium Vulnerability Actively Exploited, Prompt Patching Advised

A high-severity remote code execution vulnerability in Chromium's V8 engine is being actively exploited, prompting urgent security advisories and updates.

News AutomationCompiled 01:07 UTC · 1 min read

A padlock icon overlays a computer screen displaying code, symbolizing digital security. — A padlock icon overlays a computer screen displaying code, symbolizing digital security. · Photo by FlyD on Unsplash

1 sources

Pipeline ingest

3 reads

Positive / Neutral / Negative

0 countries

Related coverage

CVE-2026-85046 Detail

Description

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

ADP: CISA-ADP

Base Score:8.8 HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

URL	Source(s)	Tag(s)
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html	Chrome	Release NotesVendor Advisory
https://issues.chromium.org/issues/542403045	Chrome	Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046	CISA-ADP	US Government Resource

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

| Vulnerability Name | Date Added | Due Date | Required Action 1. Remove site chrome: The provided text includes a lot of site-specific information like .gov badges, HTTPS icons, laboratory names, and navigation links. These are not part of the core article content and should be removed. The main article content starts with the CVE detail. The references and other sections are also part of the article's informational content. The introductory text about .gov and HTTPS is also site chrome. The

PAN's pipeline reviewed approximately 1 open sources for this article. No human editor reviewed this article before publication.

Three independent reads. One synthesis. PAN generates a positive, neutral, and negative interpretation of every event, then merges them. The article you are reading is the merged output. Below: the underlying reads, weighted by source coverage.

＋ POSITIVE30%

A significant security vulnerability, CVE-2026-85046, affecting all Chromium versions has been identified and addressed with a prompt update. This type confusion issue in the V8 engine, which could allow arbitrary code execution within the sandbox via a crafted HTML page, has been patched by Google. The swift action ensures that users can quickly secure their systems by updating to Chrome 152.0.7977.82 or later. This proactive response highlights the ongoing commitment to browser security and the robust mechanisms in place to identify and mitigate threats.

Source weight: ~2 documents

＝ NEUTRAL60%

A critical vulnerability, identified as CVE-2026-85046, has been reported in all versions of Chromium. The vulnerability is a type confusion flaw in the V8 JavaScript engine, which, if exploited, could permit a remote attacker to execute arbitrary code within the browser's sandbox. The issue is described as being actively exploited and has been assigned a CVSS 3.1 score of 8.8 (High) by CISA. Google has released an update, Chrome 152.0.7977.82, to address this vulnerability. Users are advised to update their browsers to the latest version to mitigate the risk.

Source weight: ~2 documents

− NEGATIVE10%

All users of Chromium-based browsers are at risk due to an actively exploited sandbox escape vulnerability, CVE-2026-85046. This critical flaw in the V8 engine allows attackers to execute arbitrary code simply by tricking users into visiting a malicious HTML page. The fact that this vulnerability is already being exploited in the wild, with a high CVSS score of 8.8, indicates a severe security lapse. While a patch has been released, the delay between exploitation and the fix means many users may have already been compromised. This incident underscores the persistent dangers lurking in widely used software.

Source weight: ~2 documents

→ Synthesis · Published Read

A critical vulnerability, identified as CVE-2026-85046, has been reported in all versions of Chromium. The vulnerability is a type confusion flaw in the V8 JavaScript engine, which, if exploited, could permit a remote attacker to execute arbitrary code within the browser's sandbox. The issue is described as being actively exploited and has been assigned a CVSS 3.1 score of 8.8 (High) by CISA. Google has released an update, Chrome 152.0.7977.82, to address this vulnerability. Users are advised to update their browsers to the latest version to mitigate the risk.

Ingest · open sources1

Pos / Neu / Neg agents3 × passes

Cross-read conflicts0 resolved

Synthesis · final pass1

Human reviewnone

Compute · wall time426 sec

HackernewsHTML

Related Reads

Show on timeline →