CISA adds critical Chrome V8 flaw to exploited vulnerabilities catalog
Actively exploited zero-day allows remote code execution via malicious HTML pages.
1Critical Chrome Vulnerability Identified
CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog, a V8 type confusion flaw with 8.8 CVSS score. This actively exploited vulnerability allows attackers to execute arbitrary code through crafted HTML pages. Google's latest Chrome update patches this among 12 security fixes. The bug affects Chrome's JavaScript/WebAssembly engine, compromising browser sandbox security. Researcher Serotav discovered it on August 4, 2026, earning a $1,000 bounty.
2Technical Details of the Exploit
The vulnerability stems from incorrect element type handling in V8's Maglev and Turbofan compilers. It causes arrays with PACKED_ELEMENTS to incorrectly receive PACKED_SMI_ELEMENTS maps, enabling arbitrary read/write on JavaScript heap. Google confirmed active exploitation but withheld attack specifics. This marks Chrome's sixth zero-day in 2026, following similar critical V8 and WebGPU flaws patched earlier this year. All carried identical 8.8 severity scores.
3Chrome's 2026 Security Challenges
Google has addressed multiple critical zero-days in 2026: February's CSS use-after-free (CVE-2026-2441), March's Skia graphics library OOB write (CVE-2026-3909) and V8 flaw (CVE-2026-3910), April's WebGPU issue (CVE-2026-5281), and June's V8 memory access bug (CVE-2026-11645). All were actively exploited with 8.8 CVSS scores. The consistent high severity highlights Chrome's ongoing security challenges despite Google's substantial bounty program and rapid patch cycles.
4Patch Deployment Timeline
Google released Chrome Stable versions 152.0.7977.82/.83 for Windows/Mac and 152.0.7977.82 for Linux. The update rolls out gradually over coming weeks. CISA mandated federal agencies to apply patches by September 18, 2026 under Binding Operational Directive 22-01. The directive requires FCEB agencies to remediate KEV catalog vulnerabilities by specified deadlines. Private enterprises are strongly advised to follow suit given the exploit's active use.
5Impact on Federal Systems
CISA's KEV catalog inclusion triggers mandatory patching for all federal civilian executive branch agencies. BOD 22-01 establishes strict timelines for addressing catalog vulnerabilities to reduce attack surfaces. The directive reflects growing concerns about nation-state actors exploiting known vulnerabilities. Federal systems face particular risks due to their attractiveness to advanced persistent threats and the cascading impacts of government network compromises.
6Enterprise Security Implications
While mandatory for federal agencies, CISA strongly recommends all organizations prioritize this patch. Browser vulnerabilities offer attackers wide reach across enterprise networks. The V8 engine's centrality to web applications makes this flaw particularly dangerous. Security teams should treat this as critical given the exploit's availability in wild. Organizations should accelerate patch cycles beyond typical schedules when facing actively exploited vulnerabilities.
7Chrome's Security Architecture
V8's sandbox design normally prevents arbitrary code execution, making this type confusion flaw particularly severe. Chrome's multi-process architecture and site isolation typically contain such issues, but this bypass demonstrates sandbox escape potential. The vulnerability highlights challenges in securing complex JavaScript engines that must balance performance with security. Google's $1,000 bounty for this discovery reflects the relatively low reward for high-impact browser vulnerabilities.
8Broader Cybersecurity Lessons
This incident underscores the importance of rapid vulnerability response programs. The short window between discovery and active exploitation demonstrates modern threat velocity. Organizations must maintain updated asset inventories to quickly identify affected systems. The recurring pattern of Chrome zero-days suggests attackers increasingly target browser infrastructure. This case reinforces why CISA's KEV catalog has become essential for prioritizing critical patches.