Is CVE-2026-85046 actively exploited?

Yes. Previdian tracks CVE-2026-85046 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian has not yet recorded sensor-observed exploitation attempts for CVE-2026-85046. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-85046 affects Google Chrome. Reported affected version: 152.0.7977.82 to < 152.0.7977.82.

Yes. CVE-2026-85046 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Previdian attested it 10 hours ahead of CISA.

CVE-2026-85046 Exploited in the Wild — Chrome

Q: What is CVE-2026-85046?

CVE-2026-85046 is an unauthenticated vulnerability affecting Google Chrome. Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2026-85046 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Previdian attested it 10 hours ahead of CISA.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-85046 is an unauthenticated vulnerability affecting Google Chrome. Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a...

Is it exploited?

Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.

Who is affected?

Google / Chrome affected before 152.0.7977.82.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Chrome

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor Product Affected Status

Google Chrome Before 152.0.7977.82 Affected

Published: 03 Sep 2026
Exploitation Reported: 04 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: Required

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-85046
chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01... chromereleases.googleblog.com · CVE Record https://chromereleases.googleblog.com/2026/09/stable-channel-update-f...
issues.chromium.org/issues/542403045 issues.chromium.org · CVE Record https://issues.chromium.org/issues/542403045

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

TheHackerNews

Recorded 04 Sep 2026

Independent exploitation attestation added to the Previdian record.

Proof of concept available

GitHub

Recorded 04 Sep 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
TheHackerNews First	2026-09-04 07:18 UTC
CyberInsider	2026-09-04 09:33 UTC
CISA	2026-09-04 17:01 UTC
CVE	2026-09-04 17:20 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0
Callback hosts: 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.5%

Weaknesses

Access of Resource Using Incompatible Type ('Type Confusion') CWE-843

Recent mention · CyberInsider

Google fixes actively exploited Chrome V8 zero-day vulnerability

Google has released a Chrome security update addressing 12 vulnerabilities, including a high-severity V8 flaw that is being actively exploited in attacks. The fixes are included in Chrome 152.0.7977.82/.83 for Windows and macOS and version 152.0.7977.82 for Linux, with...

Read full advisory

All Mentions

Recent mention · CyberInsider

Google fixes actively exploited Chrome V8 zero-day vulnerability

CyberInsider · 04 Sep 2026

Google has released a Chrome security update addressing 12 vulnerabilities, including a high-severity V8 flaw that is being actively exploited in attacks. The fixes are included in Chrome 152.0.7977.82/.83 for Windows and macOS and version 152.0.7977.82 for Linux, with deployment taking place gradually. The actively exploited vulnerability is tracked as CVE-2026-85046 and is described as … The post Google fixes actively exploited Chrome V8 zero-day vulnerability appeared first on CyberInsider.

Recent mention · TheHackerNews

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

TheHackerNews · 04 Sep 2026

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote

Recent mention · Google Chrome Releases

Stable Channel Update for Desktop

Google Chrome Releases · 03 Sep 2026

The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 12 security fixes. Please see the Chrome Security Page for more...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

ubitquity/CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine

github · Created 2026-09-04 11:28:47 UTC · 0 stars · AI assessment 85%

Conceptual C++ patch and structural analysis for CVE-2026-85046, a critical type confusion zero-day vulnerability in Google Chrome's V8 engine

HORKimhab/CVE-2026-85046

github · Created 2026-09-04 08:11:34 UTC · 0 stars · AI assessment 90%

CVE-2026-85046

Timeline

From disclosure to observed exploitation

04 Sep 2026
KEV confirmed by CVE

Exploitation attested by an external source
04 Sep 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
04 Sep 2026
KEV confirmed by CyberInsider

Exploitation attested by an external source
04 Sep 2026
Public PoC available

Public proof-of-concept code published
04 Sep 2026
Added to Previdian KEV Feed

High-confidence, third-party attested exploitation
03 Sep 2026
CVE published

Vulnerability disclosed publicly
02 Sep 2026
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-85046

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-85046",
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": 0.00462,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-85046

Chrome

Tags

CVE References

Exploited in the wild

Proof of concept available

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Weaknesses

Google fixes actively exploited Chrome V8 zero-day vulnerability

All Mentions

Potential Proof of Concepts

KEV confirmed by CVE

Added to CISA KEV

KEV confirmed by CyberInsider

Public PoC available

Added to Previdian KEV Feed

CVE published

CVE ID reserved

Automate this intelligence