CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks
CISA added the actively exploited Chromium V8 type confusion zero-day CVE-2026-85046 to its KEV catalog, urging patching of Chrome, Edge, and Opera.
CISA added CVE-2026-85046, a V8 type confusion flaw (CWE-843) in Chromium-based browsers, to its Known Exploited Vulnerabilities catalog. A remote attacker can trigger arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Google Chrome is directly affected, and Microsoft Edge, Opera, and other Chromium-based browsers may also be impacted depending on their V8 version. Google has released a Stable channel Chrome update, and CISA directs mitigations under Binding Operational Directive 26-04.
- CVE-2026-85046 is a V8 type confusion flaw (CWE-843) enabling arbitrary code execution in the browser sandbox.
- CISA added it to the KEV catalog, confirming exploitation is observed in real attacks.
- Google shipped a Stable channel fix; Edge and Opera users must track their vendors' updates.
- Enterprises should inventory all Chromium browsers, verify updates, and monitor proxy and endpoint telemetry.
- CVEs
- CVE-2026-85046
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA has added a critical Google Chromium V8 type confusion vulnerability, tracked as CVE-2026-85046, to its Known Exploited Vulnerabilities (KEV) Catalog, warning that the flaw is being actively exploited in attacks. CVE-2026-85046 affects the V8 JavaScript and WebAssembly engine used by Chromium-based browsers. The vulnerability stems from type confusion, classified under CWE-843, a weakness that […]
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.