CVE-2026-85046: Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Overview
A type confusion flaw in the V8 JavaScript engine's Maglev JIT compiler affects Google Chrome prior to version 152.0.7977.82, as well as other Chromium-based browsers including Microsoft Edge and Opera. An attacker who can direct a user to a crafted HTML page can trigger arbitrary code execution inside the V8 sandbox without any authentication or prior access. Google has confirmed active exploitation in the wild, making prompt patching a priority for any organization running affected browser versions.
Vulnerability details
The flaw resides in Maglev's inlined Array.prototype.sort optimization within maglev-graph-builder.cc. When Maglev JIT-compiles a sort call trained on both PACKED_SMI_ELEMENTS and PACKED_ELEMENTS arrays, it performs a post-sort map check that verifies only whether the receiver array's current map belongs to the set of maps seen at compile time, not whether the map is identical to the one present before sorting began. This membership-only check is the core weakness: it permits a map transition between the two accepted kinds to go undetected, causing V8 to copy object references into an array the engine treats as containing only small integers.
An attacker crafts a JavaScript payload that first trains the JIT with mixed array types to produce the vulnerable mixed-map feedback, then supplies a comparator function to Array.prototype.sort that calls Array.prototype.fill during the sort to migrate the array's element-kind map from PACKED_ELEMENTS back to PACKED_SMI_ELEMENTS. The weakened post-sort check passes, producing a type confusion that yields arbitrary read and write on the JavaScript heap inside the V8 sandbox. The researcher who discovered this flaw further chained it with a separate n-day sandbox escape to achieve full code execution, though the CVE itself is scoped to heap-level exploitation inside the sandbox. Exploitation requires only that the user visit a crafted page.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor JavaScript engine crash telemetry and renderer process crash reports in Chrome's crash reporting infrastructure; repeated renderer crashes tied to V8 or array operations on a specific host, particularly without a corresponding user-reported action, may indicate failed exploitation attempts against this flaw.
- Audit enterprise browser management logs (such as Google Admin or Microsoft Intune device compliance reports) for hosts where Chrome's reported version has not advanced to 152.0.7977.82 or later despite update policies being active, which may indicate update suppression or a managed device that has not yet received the patch.
Remediation
Additional hardening
- Update Google Chrome to 152.0.7977.82 or later on Windows and Linux, and 152.0.7977.82 or later on Mac; other Chromium-based browsers such as Microsoft Edge and Opera should be updated to their respective releases incorporating this V8 fix.
- Enforce browser update policies through enterprise management tooling (Google Admin, Microsoft Intune, or equivalent) to ensure automatic updates are not suppressed and that version compliance is actively reported and remediated.
- Restrict access to untrusted or external web content for high-risk user populations through DNS filtering, web proxy categorization, or browser isolation, reducing the likelihood that a user visits a page delivering the crafted JavaScript payload.
- Disable or restrict JavaScript execution in contexts where it is not operationally required, using browser policy or content security controls, as the exploit depends entirely on JIT-compiled JavaScript running in the renderer.
Key dates
References
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-85046
- https://issues.chromium.org/issues/542403045
- https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md
- https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67
- https://news.ycombinator.com/item?id=49570669
Frequently asked questions
Does CVE-2026-85046 affect my FedRAMP authorization?
If Google Chromium V8 runs inside your authorization boundary, CVE-2026-85046 is a direct concern for your Federal Risk and Authorization Management Program (FedRAMP) authorization. CISA has listed this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 18, 2026. An unpatched KEV inside your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it.
How does Knox help me handle CVE-2026-85046?
Knox does not patch Google Chromium V8 on your behalf. Under the FedRAMP shared-responsibility model, that remediation is yours to own. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours. Managing your compliance posture while you do it is not something you have to handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. When something like CVE-2026-85046 surfaces, exposure appears during routine monitoring rather than only when an assessor flags it at review time, giving you more time to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-85046 isn't remediated by September 18, 2026?
An unremediated CVE-2026-85046 becomes a Plan of Action and Milestones (POA&M) item, and a growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out and documenting the remediation is what keeps your authorization and the agency relationship clean.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
