# CVE-2026-85046: Google Chromium V8 type confusion vulnerability

Source: https://junglewise.ai/threats/cve-2026-85046-google-chromium-v8-type-confusion-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-85046 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-09-03

Google Chromium's V8 JavaScript engine contains a type confusion flaw that allows attackers to execute arbitrary code within the browser sandbox by sending a specially crafted HTML page. This vulnerability affects all major Chromium-based browsers including Chrome, Edge, and Opera, putting users at risk of account compromise, malware infection, and data theft.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Google Chromium](https://junglewise.ai/threats/technologies/chromium), [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8), [Microsoft Edge](https://junglewise.ai/threats/technologies/edge), [Opera Browser](https://junglewise.ai/threats/technologies/opera-browser). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [Opera](https://junglewise.ai/threats/vendors/opera).

## Quick answers

**Is CVE-2026-85046 exploited in the wild?** Yes. CVE-2026-85046 is known to be exploited in the wild, first recorded on 4 September 2026. Treat it as urgent.

**How severe is CVE-2026-85046?** Critical severity, with a CVSS score of 8.8, published 3 September 2026.

**Which products and versions are affected?** Google Chrome <unknown>; Google Chromium <unknown>; Microsoft Edge <unknown>; Opera Browser <unknown>.

**Is there a fix for CVE-2026-85046?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85046 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85046?** Check whether you run Google Chrome, Google Chromium, Google Chromium V8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability exists in Google Chromium's V8 JavaScript engine that allows remote code execution within the browser's sandbox. The vulnerability stems from improper type checking in the V8 engine, enabling an attacker to manipulate object types to bypass security checks. An attacker can exploit this flaw by crafting a malicious HTML page and enticing a user to visit it; no special privileges or authentication are required. Successful exploitation allows arbitrary code execution within the sandbox, from which further attacks on the system or user data may be mounted. The vulnerability is known to be exploited in the wild as of the publication date, making patching urgent.

## Affected products

- Google Chromium <unknown>
- Google Chrome <unknown>
- Microsoft Edge <unknown>
- Opera Opera Browser <unknown>

## Timeline

- 2026-09-04: disclosed
- 2026-09-04: exploited: Confirmed exploited in the wild

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)