CVE-2026-85046: Chromium V8 Type Confusion Vulnerability Allows Sandboxed Code Execution via Crafted HTML

Background

V8 is the open-source JavaScript and WebAssembly engine at the core of every Chromium-based browser, including Google Chrome, Microsoft Edge, Opera, and other derivatives. It is responsible for parsing, compiling, and executing JavaScript from every website a user visits, making it one of the highest-value and most frequently targeted attack surfaces in the browser ecosystem. This same KEV dataset includes a second, separate Chromium V8 memory-safety entry (CVE-2026-87491), underscoring how frequently V8 bugs reach confirmed real-world exploitation.

CVE-2026-85046 is a type confusion vulnerability in V8 that allows a remote attacker to execute arbitrary code inside the Chromium renderer sandbox via a crafted HTML page — requiring nothing more from the victim than loading the malicious page. Like its out-of-bounds-write counterpart, this bug affects every browser built on the vulnerable Chromium release, not just Google Chrome specifically.

Technical Mechanism

CVE-2026-85046 is classified under CWE-843 (Type Confusion). Type confusion vulnerabilities occur when a program accesses a piece of memory using a type different from the one it was actually allocated or initialized as — the program’s logic “believes” an object is of one type (and therefore applies that type’s expected memory layout and method dispatch) when the underlying memory actually holds a different, incompatible type.

In a JavaScript engine like V8, type confusion bugs are frequently introduced through the optimizing JIT compiler (TurboFan), which generates specialized machine code based on assumptions about an object’s “hidden class” or shape derived from earlier observed executions. A representative exploitation flow:

1. An attacker crafts a malicious HTML page containing JavaScript specifically designed to coax V8’s JIT compiler into making an incorrect type assumption about a JavaScript object — commonly by manipulating an object’s shape through prototype manipulation, property deletion/reassignment, or array-type transitions in a sequence the optimizer does not correctly account for.
2. The victim’s browser loads the page and executes the script as part of normal rendering. No download, click, or explicit consent beyond page navigation is required.
3. The JIT-compiled code accesses the confused object using the incorrect type’s memory layout — for example, treating a pointer-sized field as a raw integer, or vice versa — giving the attacker’s script a way to read or write memory it should not have access to, effectively turning a type-safety violation into an arbitrary memory read/write primitive.
4. With this primitive, an attacker can corrupt heap object metadata to achieve broader control over the renderer process’s memory, ultimately hijacking control flow to execute attacker-supplied code — again, constrained to the sandboxed renderer process rather than full system privileges, absent a separate sandbox-escape bug.

Type confusion and out-of-bounds write bugs (as in the companion CVE-2026-87491) represent two of the most common root causes behind in-the-wild V8 exploitation, both frequently surfaced through fuzzing of the JIT compiler’s optimization passes.

Real-World Exploitation Evidence

CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog on 4 September 2026, confirming — by the nature of KEV listing — that CISA has evidence of active exploitation in the wild, not a theoretical or lab-only demonstration.

No specific threat actor, campaign, or intrusion set is named in the available KEV record for this entry. No specific threat actor has been publicly attributed to exploitation of this CVE; its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. As with other recently exploited V8 zero-days, this class of vulnerability has historically been associated with high-cost, targeted exploitation — commercial spyware operators and well-resourced intrusion sets using watering-hole or spear-phishing delivery against specific individuals — though no such attribution has been confirmed for this particular CVE.

The knownRansomwareCampaignUse field for this entry is marked “Unknown” — CISA has not confirmed ransomware use of this CVE at this time, consistent with the typical targeted-access use case for browser renderer exploits rather than mass-deployment ransomware campaigns.

Impact Assessment

A remote, near-zero-click code execution vulnerability in a universally used browser engine carries severe practical impact:

• Confidentiality: Successful exploitation grants the attacker code execution within the renderer process, exposing whatever data that process has access to — rendered page content, and potentially cached session or credential material depending on process isolation boundaries in the specific browser build.
• Integrity: Renderer-level code execution allows script injection, page content manipulation, and serves as a launching point for attempts to escape the sandbox into the broader browser process or operating system.
• Availability: Failed or partial exploitation attempts commonly manifest as renderer process crashes, which can be weaponized independently as a denial-of-service nuisance against targeted users.
• Ecosystem-wide exposure: Because V8 is shared infrastructure across the Chromium ecosystem, a single root-cause fix must propagate to Chrome, Edge, Opera, Brave, and other derivatives — meaning the real-world remediation timeline is gated not just by Google’s patch but by every downstream vendor’s update cadence.

Sector-specific risk: As with most browser 0-days, risk is best framed by user profile rather than industry: high-value targets (government officials, journalists, policy researchers, corporate executives with access to sensitive negotiations or IP) face the most acute risk from the sophisticated, targeted use this vulnerability class typically sees, while the broader user base faces secondary risk once technical details proliferate into more widely available exploit kits.

Affected Versions

Google’s Chrome stable channel release notes (linked below) are the authoritative source for the exact affected version range; this guidance extends to other Chromium-based browsers, which typically patch shortly after the upstream Chromium fix.

Remediation Steps

CISA’s required action directs organizations to apply vendor mitigations per BOD 26-04 guidance and follow Forensics Triage Requirements, or discontinue use of the product if mitigations are unavailable.

1. Update Chrome (or your Chromium-based browser) to the latest stable version immediately. Check the current version and force an update check:

chrome://settings/help

2. Push updates fleet-wide via enterprise management tooling — Google Workspace browser policies, Microsoft Intune for Edge, or equivalent MDM/endpoint management for other Chromium derivatives — rather than relying solely on individual auto-update behavior.

3. Fully restart the browser after updating. V8 fixes are loaded at process start; existing open browser sessions remain exposed until restarted.

4. Inventory all Chromium-based browsers in the environment, including those installed as a side effect of other software (certain enterprise tools bundle Chromium Embedded Framework instances), since these are equally affected and easily missed during patch audits.

5. Prioritize patching for high-risk user groups (executives, legal, government-facing roles) given the historical targeting pattern for this vulnerability class, even while broader fleet-wide patching proceeds on standard timelines.

Detection Guidance

Exact IOCs for this specific exploit have not been publicly disclosed, consistent with Google’s practice for actively exploited V8 bugs. General detection approaches:

• Renderer crash telemetry: Enterprises with browser crash reporting/EDR visibility should review for anomalous renderer crashes correlated with visits to unusual or newly registered domains.
• Endpoint detection (EDR): Watch for unexpected child processes or anomalous memory/behavioral patterns originating from the browser process shortly after a user visits an untrusted site — a potential indicator of a chained sandbox-escape attempt following initial V8 exploitation.
• Network/proxy logs: Review for connections to low-reputation or newly registered domains immediately preceding anomalous browser behavior — a common delivery pattern (watering hole, malicious ad network) for this exploit class.
• Patch compliance as primary control: In the absence of public technical IOCs, patch-level compliance remains the most reliable detection-adjacent control; any unpatched browser instance should be treated as a live exposure.

Timeline

References

• Chrome Releases — Stable Channel Update for Desktop
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-85046