Loading story…
Google patched CVE-2026-85046, a high-severity type-confusion vulnerability in the Chromium V8 JavaScript and WebAssembly engine that is under active exploitation. A maliciously crafted webpage can trigger arbitrary code execution within the browser sandbox when visited. The issue affects Google Chrome versions earlier than 152.0.7977.82 and extends to Chromium-based browsers, including Microsoft Edge, Brave, and Opera; CISA added the flaw to its Known Exploited Vulnerabilities catalog.
Microsoft Edge also received fixes for multiple Chromium-derived vulnerabilities, including sandboxed and sandbox-escape code-execution flaws, an access-restriction bypass, and a V8 out-of-bounds write. Organizations should urgently update Chrome to 152.0.7977.82 or later and Edge on Windows to 152.0.4191.66 or later, while validating and patching other deployed Chromium-based browsers against their vendors' fixed releases.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft's September 11 advisory addressed multiple Chromium-derived vulnerabilities in Edge for Windows. Organizations were advised to upgrade to Microsoft Edge version 152.0.4191.66 or later.
Google patched the actively exploited CVE-2026-85046 V8 type-confusion flaw, which affects Chrome versions before 152.0.7977.82 and can enable code execution within the browser sandbox through a crafted webpage.
CISA added CVE-2026-85046, a high-severity type-confusion vulnerability in Chromium V8 that was assessed as actively exploited, to its Known Exploited Vulnerabilities catalog.
Multiple Chromium-derived vulnerabilities, including sandboxed and sandbox-escape code-execution flaws, were published; the referenced vulnerability publication date is September 3, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcetenable.com
Open sourcecve.circl.lu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome Stable 152.0.7977.82 for Linux and 152.0.7977.82/.83 for Windows and macOS to fix **CVE-2026-85046**, a high-severity type-confusion zero-day in the V8 JavaScript and WebAssembly engine that is being exploited in the wild. A malicious website can trigger unsafe memory handling and potentially execute attacker-controlled code within Chrome's browser sandbox; an additional vulnerability could be chained to escape that boundary. The release contains 12 security fixes—10 rated high severity and two medium severity—affecting V8, WebGL, Compositing, Network, DevTools, Skia, and other components. Google has withheld exploit and targeting details while patch adoption increases. Organizations should force an update and relaunch Chrome across managed endpoints, verify deployed versions, and prioritize corresponding updates for Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi when available.
Sep 10, 2026
Microsoft Edge users were urged to update **Stable Channel** installations to version `146.0.3856.59` or later after **CVE-2026-3910** was disclosed as having an available exploit and being actively exploited in the wild. Advisory details indicate the flaw can allow **arbitrary code execution inside a sandbox** through a crafted HTML page, and additional Edge vulnerabilities may also enable **spoofing**, **remote code execution**, and **security restriction bypass**. HKCERT rated the Edge issue as **Extremely High Risk**, underscoring the urgency of patching. A separate advisory for **Google Chrome** addressed **CVE-2026-3909** in Chrome versions prior to `146.0.7680.80`, and CISA added that Chrome flaw to the **Known Exploited Vulnerabilities** catalog. Although both browser advisories were published the same day and concern actively exploited Chromium-based browser vulnerabilities, the Chrome item concerns a **different CVE and a different vendor advisory** and should be treated as a separate incident from the Edge-specific **CVE-2026-3910** disclosure.
Jun 29, 2026
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026