CVE-2026-85046

This is a bug in Google Chrome’s JavaScript engine (V8) that can be triggered by a bad website page you open. If someone tricks a user into visiting that page, it can allow code to run inside Chrome’s “sandbox” (a safety container), and attackers can then act like the browser is behaving maliciously—potentially leading to theft of data from the sites you’re logged into or other downstream compromise.

This matters if your business computers run Google Chrome and users may visit untrusted websites (including links sent in emails or messages). There’s no need for the attacker to have a special account, but a user must open a malicious page (user interaction is required). Treat it as a risk when the affected Chrome version is reachable via normal browsing and you have employees browsing the web with Chrome versions prior to 152.0.7977.82.

This is urgent because it is confirmed as exploited in the wild and is included in CISA’s Known Exploited Vulnerabilities list. The fix is available, and CISA has set a remediation due date of 2026-09-18—so you should prioritize updating every Chrome-install immediately.

Confirm exposure

• On each workstation/server where Chrome is used, open Chrome → Settings → About Chrome and record the version.
• Any device running Google Chrome prior to 152.0.7977.82 is exposed to this issue.

Upgrade / remediation (target fix)

• Upgrade Google Chrome to 152.0.7977.82 or later.
• Use your normal enterprise update method if you manage browsers centrally; otherwise update directly on endpoints and verify the new version number.

Timing guidance

• CISA KEV remediation due date for this issue is 2026-09-18.
• If you are unable to upgrade right away, treat the temporary exposure as unacceptable for users who browse externally.

Temporary workarounds (if patching is delayed)

• Restrict or pause use of affected Chrome versions until updated.
• Tighten web access controls for untrusted sites (for example, URL filtering) to reduce the chance users land on malicious pages.
• Increase monitoring of endpoint and browser activity for suspicious behavior (unexpected downloads, unusual sign-in prompts on web apps, or abnormal navigation patterns).

What to monitor after updating

• Ensure Chrome auto-updates are enabled or managed so devices stay on 152.0.7977.82+.
• Check for alerts or indicators tied to user browsing sessions around the period before the update, especially on machines used by the most sensitive accounts.

Severity and weakness

• Reported as a high-severity browser sandbox escape path: Remote Code Execution inside the browser sandbox via V8 type confusion.
• Weakness category: CWE-843 (Type Confusion).

Attack mechanism and prerequisites

• Attack vector: Network.
• No authentication is required.
• A user must interact by visiting a crafted HTML page; exploitation relies on the victim loading the attacker-controlled content in Google Chrome prior to 152.0.7977.82.

Exploitation status

• CISA KEV: YES, added 2026-09-04, with a remediation due date of 2026-09-18.
• News/reporter confirmation indicates confirmed in-the-wild exploitation prior to the patch release.
• No public exploit code is recorded in the provided findings.

Fix

• Fixed in google chrome: 152.0.7977.82.

KEV meaning (operationally)

• KEV listing means authorities consider this vulnerability exploited in real environments; therefore organizations should treat it as an active, not theoretical, risk and prioritize patching/mitigations per vendor guidance and CISA BOD 26-04 instructions.