Actively exploited sandbox RCE in all Chromium versions
Points and comments are a snapshot, not live.
CVE-2026-85046 is an actively exploited sandbox RCE in all Chromium versions via V8 type confusion.
CVE-2026-85046 is a type confusion vulnerability in Google Chrome's V8 JavaScript engine, affecting versions prior to 152.0.7977.82. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page. The CISA Known Exploited Vulnerabilities Catalog lists it, requiring mitigation by September 18, 2026. The vulnerability is rated High severity by Chromium. An ADP vector from CISA-ADP gives a CVSS 3.1 base score of 8.8, with network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.
What commenters are saying
Commenters question the CVSS score of 8.8, noting that sandbox RCE requires chaining with another exploit for full system compromise. Several explain that sandbox RCE allows native code execution but still requires a separate sandbox escape. Some debate browser security: Vanadium and Brave are praised for patching faster than Chrome, while Firefox with uBlock Origin is recommended for blocking exploits. Others criticize the $1000 bug bounty as too low for a critical vulnerability being exploited in the wild. A minority argue Chrome has an excellent security track record despite this bug.