CVE-2026-85046: Google Chromium V8 type confusion vulnerability

CVE-2026-85046 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-09-03

Google Chromium's V8 JavaScript engine contains a type confusion flaw that allows attackers to execute arbitrary code within the browser sandbox by sending a specially crafted HTML page. This vulnerability affects all major Chromium-based browsers including Chrome, Edge, and Opera, putting users at risk of account compromise, malware infection, and data theft.

Technologies: Google Chrome, Google Chromium, Google Chromium V8, Microsoft Edge, Opera Browser. Vendors: Google, Microsoft, Opera.

Quick answers

Is CVE-2026-85046 exploited in the wild?
Yes. CVE-2026-85046 is known to be exploited in the wild, first recorded on 4 September 2026. Treat it as urgent.
How severe is CVE-2026-85046?
Critical severity, with a CVSS score of 8.8, published 3 September 2026.
Which products and versions are affected?
Google Chrome <unknown>; Google Chromium <unknown>; Microsoft Edge <unknown>; Opera Browser <unknown>.
Is there a fix for CVE-2026-85046?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85046 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-85046?
Check whether you run Google Chrome, Google Chromium, Google Chromium V8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A type confusion vulnerability exists in Google Chromium's V8 JavaScript engine that allows remote code execution within the browser's sandbox. The vulnerability stems from improper type checking in the V8 engine, enabling an attacker to manipulate object types to bypass security checks. An attacker can exploit this flaw by crafting a malicious HTML page and enticing a user to visit it; no special privileges or authentication are required. Successful exploitation allows arbitrary code execution within the sandbox, from which further attacks on the system or user data may be mounted. The vulnerability is known to be exploited in the wild as of the publication date, making patching urgent.

Affected products

  • Google Chromium <unknown>
  • Google Chrome <unknown>
  • Microsoft Edge <unknown>
  • Opera Opera Browser <unknown>

Timeline

  • 2026-09-04: disclosed
  • 2026-09-04: exploited: Confirmed exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.