What is the CVSS score of CVE-2026-85046?

CVE-2026-85046 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Google Chrome are affected by CVE-2026-85046?

Google Chrome users across the organization face remote code execution risk when visiting attacker-controlled websites, potentially enabling data theft and credential compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-85046?

Yes, a public proof-of-concept exploit is available for CVE-2026-85046. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-85046?

Within 24 hours, notify all users and IT teams of the vulnerability and confirm patch availability (Chrome 152.0.7977.82 or later). Within 7 days, test the patch in non-production environments and deploy across all organizational Chrome deployments via your existing browser management tool or update mechanism, prioritizing systems handling sensitive data. Within 30 days, verify 100% deployment coverage through audit logs and establish monitoring for any public reports of active exploitation or additional V8 vulnerabilities.

Google Chrome CVE-2026-85046

EUVD-2026-70702 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-09-03 Chrome

GHSA-84qv-4wj5-wwmm

RCE Google Memory Corruption Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-delivered via webpage (AV:N), straightforward exploit path (AC:L), no authentication (PR:N), single user click required (UI:R); full renderer memory access justifies C:H/I:H/A:H within the sandboxed scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Threat Model Generated

Sep 06, 2026 - 23:32 vuln.today

POC Analysis Generated

Sep 04, 2026 - 19:25 vuln.today

Added to CISA KEV

Sep 04, 2026 - 17:48 CISA

Analysis Generated

Sep 03, 2026 - 20:16 vuln.today

CVE Published

Sep 03, 2026 - 19:26 cve.org

HIGH 8.8

DescriptionCVE.org

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 3

POC Chrome V8 Sandbox Escape PoC Chaining CVE-2026-85046, CVE-2026-87491, CVE-2026-87606, and CVE-2026-87575 Sep 12, 2026 POC CVE-2026-85046 + CVE-2026-87491: Chained V8 Type Confusion and WASM Exploit for Chrome Renderer RCE Sep 10, 2026 POC CVE-2026-85046: Chrome Zero-Day Exploited in the Wild - Python PoC Published Sep 04, 2026

AnalysisAI

Type confusion in V8 (Chrome's JavaScript engine) in versions prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within Chrome's renderer sandbox by enticing a user to visit a specially crafted HTML page. The flaw exploits V8's type system, allowing an attacker to manipulate object type metadata in the JavaScript heap to gain controlled memory access and code execution inside the renderer process. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special server-side configuration is required - any Chrome version prior to 152.0.7977.82 on desktop is vulnerable by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the threat model: network-reachable exploitation requiring only that the victim visit a malicious page, with no authentication or complex precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update Google Chrome to version 152.0.7977.82 or later immediately, as documented in the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html. … Detailed patch versions, workarounds, and compensating controls in full report.