The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Google Chromium V8 vulnerability, identified as CVE-2026-85046, to its Known Exploited Vulnerabilities (KEV) catalog. This type confusion flaw, affecting Chrome's JavaScript and WebAssembly engine, has a CVSS score of 8.8 and is actively being exploited in the wild.
Google recently released a security update for Chrome, addressing a total of 12 vulnerabilities, including CVE-2026-85046. The flaw could allow a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. Google has confirmed that an exploit for this vulnerability exists.
Security researcher Salvatore Gulizia, known as Serotav, reported the vulnerability on August 4, 2026, and received a $1,000 bug bounty. Serotav described the bug as a V8 compiler issue that causes an array with `PACKED_ELEMENTS` to incorrectly receive the `PACKED_SMI_ELEMENTS` map, which can be leveraged for arbitrary read/write operations on the JavaScript heap. The bug was present in both the Maglev and Turbofan compilers.
This marks the sixth actively exploited Chrome zero-day vulnerability addressed by Google in 2026. Previous zero-day flaws exploited in attacks this year include: CVE-2026-2441 (use-after-free in CSS) in February; CVE-2026-3909 (out-of-bounds write in Skia 2D graphics library) and CVE-2026-3910 (implementation flaw in the V8 JavaScript/WebAssembly engine) in March; CVE-2026-5281 (use-after-free in Dawn WebGPU component) in April; and CVE-2026-11645 (out-of-bounds memory access in the V8 JavaScript engine) in June. All these vulnerabilities also carried a CVSS score of 8.8.
Google has updated Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux. The rollout of these updates is expected to occur over the coming days and weeks.
In accordance with CISA's Binding Operational Directive (BOD) 22-01, federal civilian executive branch (FCEB) agencies are mandated to address vulnerabilities listed in the KEV catalog by a specified due date to safeguard their networks. CISA has set a deadline of September 18, 2026, for federal agencies to fix CVE-2026-85046. Private organizations are also strongly advised to review the catalog and remediate these vulnerabilities within their own infrastructure.
