CVE-2026-85046KEV · due Sep 18CWE-843

Google Chromium V8 Type Confusion Vulnerability

High · published September 4, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 65.1th percentile for exploit probability.

11
days to CISA
deadline
CVSS v3.1
8.8
EPSS
1%
Percentile
65.1
In the wild
Confirmed
What it is

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01162 · 65.1th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-09-04T00:17Z
KEV added
2026-09-04 · due 2026-09-18
Affected products (1)
ProductVersionsFixed in
google/chrome< 152.0.7977.82152.0.7977.82
References (7)
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html · [email protected]https://issues.chromium.org/issues/542403045 · [email protected]https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md · af854a3a-2127-422b-91ae-364da2661108https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67 · af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=49570669 · af854a3a-2127-422b-91ae-364da2661108https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/ · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 04 SEP 00:00Z
    Added to CISA KEV — remediate by Sep 18
    kev
  • 03 SEP 19:26Z
    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
    cvelistv5