Vulnerability report

Exploited in the wild Confirmed confidence In CISA KEV

CVE-2026-85046

Chrome

Google / Chrome · affected before 152.0.7977.82

Watch CVE-2026-85046 Browse KEV feed
Severity
CVSS 8.8 · High
Confidence
Confirmed
Exploit status
Exploited in the wild
EPSS
48.9%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-85046 is an unauthenticated vulnerability affecting Google Chrome. Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a...

Is it exploited?

Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.

Who is affected?

Google / Chrome affected before 152.0.7977.82.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Chrome

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Google Affected
Chrome
Before 152.0.7977.82
Published
03 Sep 2026
Exploitation Reported
04 Sep 2026
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
Required

Tags

cisa

CVE References

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

The Hacker News

Recorded 04 Sep 2026

A trusted third party reported exploitation.

Proof of concept available

GitHub

Recorded 04 Sep 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
The Hacker News First 2026-09-04 07:18 UTC
CyberInsider 2026-09-04 09:33 UTC
CISA 2026-09-04 17:01 UTC
CVE 2026-09-04 17:20 UTC
Qualys ThreatPROTECT 2026-09-07 05:35 UTC
Rapid7 2026-09-08 21:44 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
0
0
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

48.9%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Access of Resource Using Incompatible Type ('Type Confusion') CWE-843

Recent mention · Palo Alto Networks Security Advisories

PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH)

Read full advisory

All Mentions

Recent mention · Palo Alto Networks Security Advisories

PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH)

Palo Alto Networks Security Advisories · 14 Oct 2026

Recent mention · The Hacker News

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

The Hacker News · 23 Sep 2026

Ravie LakshmananSep 23, 2026Zero-Day / Vulnerability A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser's sandbox and achieve remote code execution. "UTA0565 masqueraded as various entities including media organizations and a...

Recent mention · TheRegister

Google Pixel phones pwned in zero-click attacks

TheRegister · 16 Sep 2026

CISA gives federal agencies just 3 days to patch

Recent mention · The Hacker News

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

The Hacker News · 15 Sep 2026

A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The

Recent mention · TheRegister

Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits

TheRegister · 09 Sep 2026

Mind the patch gap, please and thank you

Recent mention · TheRegister

Microsoft breaks Patch Tuesday record with 974-CVE deluge

TheRegister · 09 Sep 2026

Adobe also brought goodies to the patch party and they deserve immediate attention

Recent mention · Rapid7

Patch Tuesday - September 2026

Rapid7 · 08 Sep 2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the...

Recent mention · Qualys ThreatPROTECT

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)

Qualys ThreatPROTECT · 07 Sep 2026

Google released security updates to address 12 vulnerabilities impacting the Chrome browser. One of these vulnerabilities, tracked as CVE-2026-85046, is being exploited in the wild. CVE-2026-85046 is a type confusion vulnerability in the V8 JavaScript engine. CISA acknowledged the active exploitation of the vulnerability by adding it to its Known Exploited Vulnerabilities Catalog. CISA urges users … Continue reading "Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)"

Recent mention · NCSC Security Advisories

NCSC-2026-0341 [1.00] [M/H] Kwetsbaarheden verholpen in Google Chrome

NCSC Security Advisories · 04 Sep 2026

Google heeft meerdere kwetsbaarheden verholpen in Google Chrome, specifiek in versies voor 152.0.7977.82. De kwetsbaarheden bevinden zich in verschillende componenten van Google Chrome, waaronder DevTools, Network, V8 JavaScript engine en Transactions Platform op iOS. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal vervaardigde HTML-pagina's aan te bieden, wat kan leiden tot het uitvoeren van willekeurige code buiten de sandboxomgeving, het omzeilen van toegangsbeperkingen, het lezen van geheugen buiten de sandbox, en het compromitteren van de isolatie van webcontent. De...

Recent mention · CyberInsider

Google fixes actively exploited Chrome V8 zero-day vulnerability

CyberInsider · 04 Sep 2026

Google has released a Chrome security update addressing 12 vulnerabilities, including a high-severity V8 flaw that is being actively exploited in attacks. The fixes are included in Chrome 152.0.7977.82/.83 for Windows and macOS and version 152.0.7977.82 for Linux, with deployment taking place gradually. The actively exploited vulnerability is tracked as CVE-2026-85046 and is described as … The post Google fixes actively exploited Chrome V8 zero-day vulnerability appeared first on CyberInsider.

Recent mention · The Hacker News

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

The Hacker News · 04 Sep 2026

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote

Recent mention · Google Chrome Releases

Stable Channel Update for Desktop

Google Chrome Releases · 03 Sep 2026

The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 12 security fixes. Please see the Chrome Security Page for more...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

jamezx32/CVE-2026-85046

github · Created 2026-10-14 10:51:41 UTC · 0 stars · AI assessment 85%

V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)

atiilla/CVE-2026-85046

github · Created 2026-09-08 19:18:57 UTC · 0 stars · AI assessment 85%

CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82

SneakyNachos/CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

github · Created 2026-09-08 18:54:55 UTC · 1 stars · AI assessment 85%

ubitquity/CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine

github · Created 2026-09-04 11:28:47 UTC · 0 stars · AI assessment 85%

Conceptual C++ patch and structural analysis for CVE-2026-85046, a critical type confusion zero-day vulnerability in Google Chrome's V8 engine

HORKimhab/CVE-2026-85046

github · Created 2026-09-04 08:11:34 UTC · 0 stars · AI assessment 90%

CVE-2026-85046

Timeline

From disclosure to observed exploitation

  1. 21:44 UTC

    KEV confirmed by Rapid7

    Exploitation attested by an external source

  2. 05:35 UTC

    KEV confirmed by Qualys ThreatPROTECT

    Exploitation attested by an external source

  3. 17:20 UTC

    KEV confirmed by CVE

    Exploitation attested by an external source

  4. 17:01 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  5. 09:33 UTC

    KEV confirmed by CyberInsider

    Exploitation attested by an external source

  6. 08:11 UTC

    Public PoC available

    Public proof-of-concept code published

  7. 07:18 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party attested exploitation

  8. 19:26 UTC

    CVE published

    Vulnerability disclosed publicly

  9. 21:13 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-85046

Sample API response 
{
  "cve_id": "CVE-2026-85046",
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": 0.48881,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}