Chromium sandbox RCE exploited
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Google patched Chrome V8 type confusion CVE-2026-85046, actively exploited in the wild. Users should update Chrome to 152.0.7977.82 to block sandbox code execution.
Background
CVE-2026-85046 is a high-severity type confusion vulnerability in V8, Chrome's JavaScript engine, affecting versions before 152.0.7977.82. Google confirmed active exploitation in the wild, prompting an urgent stable channel update. The flaw allows remote code execution within Chrome's sandbox via a crafted HTML page, with a CVSS score of 8.8.
How it unfolded
- Sep 4, 2026Google releases Chrome Stable update to 152.0.7977.82/.83 for Windows/macOS and 152.0.7977.82 for Linux, addressing CVE-2026-85046.
- Sep 4, 2026CISA adds CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a due date of Sep 18, 2026.
- Sep 5, 2026A researcher claims an AI model weaponized the patch in under a day, but the claim remains unverified.
Who’s saying what
- Official
- Google confirmed the exploit exists in the wild but withheld details about threat actors and campaigns while the update rolls out.
- Analysts
- SOC Prime notes that CVE-2026-85046 alone may not give full OS control; attackers likely need an additional sandbox escape.
- Caution
- Security researchers caution that the AI exploit demo ran with sandbox disabled, so it does not prove effectiveness against default Chrome.
Still unverified
A researcher's claim that an AI model weaponized the Chrome V8 patch in under a day is unverified; the demo used sandbox-disabled Chromium and may not correspond to a patched CVE.