Summary
Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.
Attribution
Unattributed; browser zero-days of this class are historically associated with commercial spyware vendors and state-aligned actors
Where
Japan
South Korea
Australia
India
Also: United States
Sectors: Government, Technology, Financial Services, Healthcare
EU relevance
Medium
Hit financial services in Australia, where the EU has Trade & Investment projects; 4 more such overlaps
Graded by rules: EU member states affected, EU response, EU sanctions, EU projects in the sector hit.