CISA added an actively exploited Chrome V8 type confusion bug to the Known Exploited Vulnerabilities catalog on September 4, 2026, with a federal remediation deadline of September 18 — and filed it under Chromium, which is a much larger surface than the browser.
What happened
Google shipped Chrome 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux, on Thursday, September 3, 2026. The release notes carry twelve security fixes and one sentence that changes how the rest of them read: “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”
CVE-2026-85046 is a type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine. NVD published the record at 8:17 p.m. UTC on September 3 and last modified it at 7:03 p.m. UTC on September 4. It carries CWE-843 and a CVSS v3.1 base score of 8.8, High, on the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, scored by Google as the CNA. The description, in Google’s own words, is narrower than the headline number suggests: “Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.”
On September 4, CISA added it to the Known Exploited Vulnerabilities catalog. Read from NVD’s republication of CISA’s own fields rather than from any press report, the record states cisaExploitAdd of 2026-09-04 and cisaActionDue of 2026-09-18 — a fourteen-day federal clock, expiring Friday, September 18, 2026. The cisaVulnerabilityName is “Google Chromium V8 Type Confusion Vulnerability.”
The cisaRequiredAction string is the standard BOD 26-04 boilerplate, including its citation of “Forensics Triage Requirements.” That clause appears on fourteen-day entries as well as three-day ones and carries no per-entry information; this publication established that in August after briefly getting it wrong. It is not evidence of a band here, and it is not read as such.
The bug did not come from Google’s own threat hunters. The release note line reads, verbatim: “[$1,000][542403045] High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04.” An outside researcher reported it through the Vulnerability Reward Program on August 4, 2026, and was paid $1,000. Google shipped the fix thirty days later. CISA listed it one day after that.
The Chromium bug tracker entry, issue 542403045, is marked Permissions Required. Google’s standing note applies: “Access to bug details and links may be kept restricted until a majority of users are updated with a fix.” Nobody outside Google can currently read the technical detail or the exploitation evidence.
Why it matters
Three things in this record do not line up, and each of them changes what an operator should do this week.
CISA named Chromium, not Chrome. The catalog entry is “Google Chromium V8 Type Confusion Vulnerability.” Google’s CVE description names Chrome and a Chrome version. Those are different scopes, and the catalog’s is the wider one. V8 is not a Chrome component that happens to be shared; it is the engine underneath Microsoft Edge, Brave, Opera, and Vivaldi, and underneath every application built on Electron or the Chromium Embedded Framework — chat clients, ticketing tools, code editors, vendor consoles, and the internal desktop app somebody wrapped around a web page years ago and has not touched since.
Chrome itself is close to a non-problem: it updates on relaunch, and most fleets will be current within days without anyone doing anything. Everything else in that list is a problem, because an Electron application ships its own copy of Chromium and updates on its vendor’s schedule, not Google’s. A federal remediation deadline attaches to the affected asset, not to the convenient one. An agency that reads “Chrome” and pushes a browser update has done the easy tenth of the work.
Google’s own fix is still rolling out. The release note says the new version “will roll out over the coming days/weeks.” That is Google’s normal staged-delivery language, and normally it is unremarkable. Against a fixed September 18 date it is not. Staged rollout means some machines will receive the update on Google’s timetable, which may land after the deadline. Waiting for automatic delivery is not a remediation plan here; forcing the update is. The distinction matters most for exactly the endpoints least likely to be checked — laptops that have not relaunched a browser in a fortnight.
The bug is described as staying inside the sandbox. Google’s description says the attacker executes arbitrary code “inside the sandbox.” A renderer-process compromise reaches everything the tab can reach, but on its own it does not reach the host. Getting there requires a second bug, a sandbox escape, that this record does not describe and Google has not disclosed. Coverage that flattens this to “remote code execution” is not wrong about the CVSS, which is 8.8 precisely because the scope is unchanged, but it is misleading about what an attacker gets. It does not lower the deadline, and it should not change anyone’s patching decision. It should change what a responder looks for.
Then there is the $1,000. Chrome’s reward amounts are set at triage and broadly reflect how exploitable the program judged a report to be. This one was assessed at the low end of the scale — the same release lists other high-severity bugs at “TBD” and Google-internal finds at “N/A” — and it is the one Google now says has an exploit in the wild. That is not a criticism of the triage; a reward tier is a judgment made in August about a bug report, not a prediction about attacker behavior in September. It is a caution about using severity proxies as a queue. The bounty figure, the CVSS score, and real-world exploitation are three different measurements, and here they disagree.
What the record does not say is whether the in-the-wild exploit is related to Gulizia’s report at all. Google’s wording — “is aware that an exploit…exists” — is the phrasing it uses whether the exploitation was found first or the bug was. The bug tracker is restricted, so the sequence is not publicly checkable. This is worth stating as unresolved rather than assuming the usual pattern, in which Google’s Threat Analysis Group finds an attack and works backward to the bug. As far as the public record shows, that is not what happened here.
One more detail from the same release is worth a line for anyone tracking how these bugs are being found. CVE-2026-85045, a separate race condition in V8 fixed in the same build, is credited to Brendan Dolan-Gavitt of XBOW, a company doing automated, model-driven vulnerability discovery. Two V8 bugs in one release, one from a human bounty hunter and one from an AI-assisted program, is a reasonable snapshot of where browser bug-finding currently sits.
What to do
Update to 152.0.7977.82 or later on Linux, and 152.0.7977.82/.83 or later on Windows and Mac. Check at chrome://settings/help, which also triggers the update. Do not wait for the staged rollout; push it.
- Force the relaunch. Downloading the update is not applying it. Chrome finishes the job on restart, and a browser left open for weeks is still vulnerable with the new binary sitting on disk. Enterprise fleets can use the
RelaunchNotificationandRelaunchNotificationPeriodpolicies to make the restart mandatory rather than a dismissible bubble. - Check the other Chromium browsers. Edge, Brave, Opera, and Vivaldi each rebase on Chromium on their own cadence. Confirm the build in use is based on Chromium 152.0.7977.82 or later rather than assuming a recent-looking version number covers it.
- Inventory Electron and CEF applications. This is the part that will not be done by September 18 unless it starts now. Enumerate desktop applications that embed a browser engine, get the Chromium version each one bundles, and open tickets with the vendors that are behind. Internally built Electron apps need their own rebuild.
- Federal civilian agencies are on the clock to September 18, 2026, under BOD 26-04. Private-sector adoption is voluntary; CISA encourages it.
- For detection, the useful artifacts are renderer-process crashes and anomalous child processes from browser and Electron parents in the window before patching. Because the exploit is described as sandbox-contained, evidence of a successful follow-on escape is a separate hunt from evidence of the initial trigger.
Sourcing note
The KEV dates in this story come from NVD’s republication of CISA’s own fields at services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85046, not from any press report: cisaExploitAdd 2026-09-04, cisaActionDue 2026-09-18, cisaVulnerabilityName “Google Chromium V8 Type Confusion Vulnerability.” The NVD record was published September 3, 2026 at 8:17 p.m. UTC and last modified September 4 at 7:03 p.m. UTC, with a status of Analyzed. CISA’s own catalog page and alert were not readable: cisa.gov returns HTTP 403 to automated fetching, and the two public KEV mirrors checked were both stale — the GitHub-hosted catalog copy still reported catalog version 2026.08.27, and a third-party KEV API returned nothing newer than the September 2 batch. The addition is confirmed here through NVD only.
The version numbers, CVE list, reward amount, reporter credit, report date, rollout language, and the exploitation sentence are quoted from Google’s Chrome Releases post of Thursday, September 3, 2026. Chromium issue 542403045 is marked Permissions Required and could not be read. Whether the in-the-wild exploit is connected to the August 4 bounty report is not stated by Google and remains unresolved. No independent confirmation of exploitation was found beyond Google’s own sentence, and no attribution is asserted. The claim that this bug is limited to the renderer sandbox is Google’s characterization in the CVE description, not an independent assessment.
Sources: Chrome Releases, September 3, 2026; NVD, CVE-2026-85046.