EXPOSURES › CVE-2026-85046

CVE-2026-85046

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2026-09-04 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-85046 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 78/100 rceexploited-in-wildunpatched

A type confusion vulnerability in Google Chromium V8 allows remote attackers to execute arbitrary code inside the browser sandbox via a crafted HTML page.

This unpatched vulnerability in the V8 engine affects multiple Chromium-based browsers, enabling remote code execution within the sandbox. DIB organizations must ensure their browsers are patched immediately, as this flaw is actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched software.

Shame score — A type confusion vulnerability in a foundational browser engine that is actively exploited in the wild, indicating a failure to patch a known, high-severity flaw before it was weaponized.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Google · vendor Chromium V8 · product

DESCRIPTION

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

AFFECTED FEDRAMP PRODUCTS · 2

PRODUCT	PROVIDER	STATUS	MATCH
Google Services (Google Cloud Platform Products and underlying Infrastructure) Google	Google	Authorized	vendor-exact · 0.90
Google Workspace Google	Google	Authorized	vendor-exact · 0.90