1. Executive summary
CVE-2026-85046 is a high-severity (CVSS 8.8) type confusion vulnerability in Google Chromium's V8 JavaScript and WebAssembly engine, allowing a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalogue (added 2026-09-04), confirming active exploitation in the wild; Google shipped a fix in Chrome 152.0.7977.82. Any Chromium-derived browser is potentially affected, including Google Chrome, Microsoft Edge, and Opera. For EMEA financial services, the primary exposure is drive-by compromise of workstation browser sessions via a single malicious page — a realistic initial-access vector for credential theft, session hijacking, and downstream access to banking portals and internal web applications. CISA's KEV remediation due date is 2026-09-18.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | This vulnerability is a CISA-KEV-listed, actively exploited cyber threat affecting a client-side component (Chromium browsers) deployed across financial entities' estates | Clients must classify this threat within their ICT-related incident and cyber-threat classification process — an actively exploited browser flaw with workstation-wide reach is a material classification trigger, not routine patch hygiene |
| DORA Art. 24: digital operational resilience testing — general requirements | Post-patch verification is required to confirm Chromium-based browsers (including non-Google derivatives such as Edge and Opera) are actually on fixed builds across the estate | Resilience testing scope should include verification that browser update channels have propagated the fix to all endpoints, including VDI and terminal-server images |
No NIS2 or UK NIS article is directly engaged by the specific facts of this item beyond what DORA already captures for in-scope financial entities; the item is a vulnerability disclosure with confirmed exploitation, not a reportable incident at any identified entity.
3. Technical analysis & attack chain
Vulnerability mechanism. CWE-843 type confusion in the V8 engine — the JavaScript and WebAssembly execution engine shared by all Chromium-derived browsers. A crafted HTML page causes V8 to treat an object as a type it is not, producing a memory-safety violation that the attacker converts into arbitrary code execution. Critically, the execution occurs inside the browser sandbox: the bug yields renderer-process code execution, not immediate OS-level execution. A full workstation compromise requires pairing this with a separate sandbox escape, which is not described in the available sources and should not be assumed.
Confirmed attack chain (per CISA KEV and vendor advisory)
- Victim visits, or is lured to, a crafted HTML page under attacker control (typical delivery: link in phishing email/message, malvertising, or a compromised or attacker-controlled website).
- The page's JavaScript triggers the V8 type confusion.
- The attacker achieves arbitrary code execution inside the browser sandbox/renderer process.
- Attacker-controlled code runs in the context of the browser session — sufficient for in-session credential capture, session-cookie theft, and interaction with the victim's authenticated web sessions.
Affected products. Google Chromium V8; any browser built on Chromium is potentially affected, explicitly including Google Chrome, Microsoft Edge, and Opera (per CISA). Fixed in Google Chrome 152.0.7977.82 (per Google's advisory as reported by The Hacker News and GitHub advisory GHSA-84qv-4wj5-wwmm).
Exploitation status. Confirmed in the wild — CISA KEV listing, added 2026-09-04, with a federal remediation due date of 2026-09-18. EPSS is recorded at 0% in the verified reference data, which we assess as a lag in scoring for a newly KEV-listed bug rather than a genuine low-exploitation signal; the KEV listing is the authoritative exploitation signal. No ransomware campaign use is recorded (CISA: "Unknown"). No threat-actor attribution is present in any source; no exploitation campaign details, victimology, or delivery infrastructure are described. Any claim about who is exploiting this or how victims are being targeted is currently unconfirmed.
Single-source caveat. The Chrome version-to-CVE mapping (152.0.7977.82) rests on The Hacker News reporting of Google's release plus the matching GitHub advisory; CISA's KEV entry names the product but not the fixed build. Verify the fixed build against Google's official Chrome release blog before pinning version policy.
4. Mitigation & containment
P1 — within 24 hours
- Force-update Google Chrome to ≥ 152.0.7977.82 on all Windows, macOS, and Linux endpoints. Trigger enterprise update (e.g., Google Update Group Policy set to "Always allow updates" and expedited major-version rollout), or push the current stable MSI via endpoint management. Confirm build via
chrome://version. - Inventory all Chromium-derived browsers in the estate — Microsoft Edge, Opera, and any Electron-based or embedded Chromium applications. Edge and Opera consume Chromium/V8; confirm their vendors have shipped aligned builds and apply them. Do not assume only Chrome is deployed.
- Check VDI golden images, terminal servers, and build pipelines for stale Chromium builds; these are the assets most likely to miss browser auto-update.
P2 — within 72 hours
- Verify patch coverage: query endpoint management for Chrome/Edge/Opera versions below the fixed builds and remediate stragglers. Target full coverage ahead of the CISA KEV due date of 2026-09-18.
- Review web-filtering and proxy logs for the past 30 days for endpoints running vulnerable builds visiting low-reputation or newly-registered domains — the delivery vector is a crafted HTML page, so browsing telemetry is the relevant hunting surface. Note: no specific delivery domains or URLs are identified in the sources, so this is exposure hunting, not IOC matching.
- Confirm browser hardening is in place on build standards: site isolation enabled (default in current Chrome, mitigates renderer-level RCE impact), and extension policy locked down.
P3 — within 7 days
- Update browser baseline standards to require the fixed builds and enable auto-update enforcement for all Chromium-family browsers.
- For any managed Chromium fork or embedded-Chromium application where the vendor has not shipped a fix: follow CISA's stated required action — apply vendor mitigations per instructions, or discontinue use of the product if mitigations are unavailable.
- Record the threat classification and patch verification under your DORA Art. 18 classification and Art. 24 resilience-testing processes.
5. Indicators of compromise
No indicators of compromise available in the source material. The sources describe no exploitation infrastructure, payload hashes, domains, or URLs associated with in-the-wild exploitation of CVE-2026-85046.
6. Detection
Insufficient indicators to author detection rules. The sources contain no threat artefacts — no payload strings, command-line indicators, file paths, or network signatures — only vulnerability description text, which is not usable for detection authoring. Patch-state verification (§4) is the actionable detection control: identify endpoints running Chromium-family browsers below the fixed builds.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-85046 | 8.8 High | ⚠ KEV 2026-09-04 | 0% | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the san… |
7. Sources
- NVD — CVE-2026-85046 — https://nvd.nist.gov/vuln/detail/CVE-2026-85046 — 2026-09-03
- CISA Known Exploited Vulnerabilities — CVE-2026-85046 entry (via NVD record) — added to KEV 2026-09-04, due date 2026-09-18
- The Hacker News — "Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day" — https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html — 2026-09-04
- GitHub Security Advisory GHSA-84qv-4wj5-wwmm — Type Confusion in V8 in Google Chrome prior to 152.0.7977.82 — https://github.com/advisories/GHSA-84qv-4wj5-wwmm
- GitHub Security Advisory GHSA-jjq9-8qj4-4mq9 — Type confusion in V8 in Google Chrome prior to 152.0.7977.65 — https://github.com/advisories/GHSA-jjq9-8qj4-4mq9
- GitHub Security Advisory GHSA-mh8j-cw3w-4f8w — Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 — https://github.com/advisories/GHSA-mh8j-cw3w-4f8w
- GitHub Security Advisory GHSA-rrr3-5825-8cg8 — Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 — https://github.com/advisories/GHSA-rrr3-5825-8cg8
- CISA Known Exploited Vulnerabilities — CVE-2026-11645 (context: prior Chromium V8 KEV entry) — https://nvd.nist.gov/vuln/detail/CVE-2026-11645
8. Adverse Trace position
High severity, actively exploited: CVSS 8.8, CISA-KEV listed as of 2026-09-04 with a 2026-09-18 remediation deadline, and a working exploit path that requires only victim navigation to a crafted page — no user interaction beyond the click, no authentication, and delivery via the most common channel in financial-sector targeting (the browser). The sandbox boundary limits immediate OS compromise, but renderer-level execution is fully sufficient for session and credential theft against banking portals and internal web apps, which is the realistic loss scenario here. Attribution is unconfirmed — no source identifies the exploiting actor or campaign, and the EPSS 0% figure should be disregarded as scoring lag on a fresh KEV entry. The Chrome fixed-build mapping (152.0.7977.82) is corroborated by two sources but should be confirmed against Google's official release notes; the multiple GitHub advisories at different version thresholds are a flag that older Chromium branches carry related type-confusion fixes and must not be treated as in-date. We will monitor for exploitation reporting, IOCs, and Edge/Opera aligned builds, and will reissue if a sandbox-escape pairing or actor attribution emerges.
Published via PulseTrace — Adverse Trace threat intelligence.