CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Google Chrome CrashReporting out-of-bounds read, High severity, no reported exploitation

cve · CVE-2026-85052

Coverage
1
first 2026-09-04 → last 2026-09-30
Latest activity
2026-09-04
Google ships an emergency Chrome update for a V8 flaw it says is already being exploited
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-85052, newest first. Check the date before acting on an older one.

  • Confirm Chrome auto-update policy is active fleet-wide (or push 152.0.7977.82+ via enterprise management) on every Windows, Mac and Linux endpoint, and check any Chromium-based browser in use (Edge, Brave, Vivaldi) for its own equivalent fix, since Google states an exploit for CVE-2026-85046 already exists in the wild.
    2026-09-04CVE-2026-85046 +11

Defender insights

What each entry about CVE-2026-85052 tells a defender to do, newest first.

2026-09-04HIGHexploitedGoogle ships an emergency Chrome update for a V8 flaw it says is already being exploited

Detection

Story timeline

  1. 2026-09-04CVE-2026-85046, Google Chrome: V8 type confusion exploited in the wild via a crafted HTML page
    trending-vulnerabilitiesGoogle ships an emergency Chrome update for a V8 flaw it says is already being exploited

Hunting pivots

Affected products
Google Chrome
Tags
actively-exploitedpatch-availablercevulnerabilitieszero-day
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessDrive-by Compromise
  • ExecutionExploitation for Client Execution

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-09-04/cve-2026-85046-chrome-v8-type-confusion-exploited · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-09-04/cve-2026-85046-chrome-v8-type-confusion-exploited · ATT&CK page ↗

Entries about Google Chrome CrashReporting out-of-bounds read, High severity, no reported exploitation (1)

2026-09-04 · view entry permalink →

HIGHCVE-2026-85046 +11exploitedupdatedNATOA1

CVE-2026-85046, Google Chrome: V8 type confusion exploited in the wild via a crafted HTML page

Google's Chrome 152.0.7977.82/.83 Stable release (2026-09-03) fixes 12 security bugs, headed by CVE-2026-85046, a type confusion in the V8 JavaScript engine (Google Chrome Releases, 2026-09-03). CISA's KEV record describes it as letting a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page and classes it CWE-843 (CISA KEV catalog, 2026-09-04). Google's release notes state that "Google is aware that an exploit for CVE-2026-85046 exists in the wild", and the bug (Chromium issue 542403045) was reported by external researcher Salvatore Gulizia ("Serotav") on 2026-08-04 (Google Chrome Releases, 2026-09-03). Google publishes no numeric CVSS score.

Code run through the type confusion stays inside the renderer sandbox (CISA KEV catalog, 2026-09-04), so the flaw is not a sandbox escape by itself and full host compromise needs further bugs. Proofpoint has since documented the BlueMoon exploit kit, used by several state-aligned threat actors, which chains CVE-2026-85046 with a V8 sandbox escape and a Windows kernel privilege-escalation flaw (Proofpoint, 2026-09-08). The remaining 11 fixes in the same release (9 High- and 2 Medium-severity issues across V8, Compositing, WebGL, Skia, DevTools, CacheStorage, CrashReporting, Network, Mobile and the Transactions Platform, most found by Google's own security team) carry no exploitation report from Google (Google Chrome Releases, 2026-09-03).

Google is aware that an exploit for CVE-2026-85046 exists in the wild.

Google Chrome Releases 2026-09-03
Correctionrun 2026-09-30T0639Z-auditsourcescvessourcing_noteevidencebodyreferencesverificationclassification

CISA's KEV record, not Google's release note, is the source for the crafted-HTML-page vector, code execution inside the sandbox and the CWE-843 class (CISA KEV catalog, 2026-09-04). The earlier text gave CISA-ADP's CVSS 8.8 score, which comes from CISA's enrichment of the CVE record rather than from a cited advisory, so no score is shown. It also called the flaw a sandbox-escape primitive. Code run through it stays inside the renderer sandbox (CISA KEV catalog, 2026-09-04), so it is not a sandbox escape. The earlier statement that no source described chaining no longer holds: Proofpoint documents the BlueMoon exploit kit chaining CVE-2026-85046 with a V8 sandbox escape and a Windows kernel privilege-escalation flaw (Proofpoint, 2026-09-08). Google lists CVE-2026-85043 as incomplete cleanup in Network (Google Chrome Releases, 2026-09-03). The earlier detection guidance assumed Google was withholding exploit specifics. Proofpoint has since described the chain's post-exploitation step, in which the Chrome browser process runs curl to download and execute a file (Proofpoint, 2026-09-08).

Builds on: Six espionage clusters ran the identical click-to-SYSTEM exploit kit within days of each other…

vulnerability04 Sep 05:00Zmulti-sourceOpen finding →
Sources: Google Chrome Releases · CISA KEV catalog · Proofpoint

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • chromereleases.googleblog.com1 (33%)
  • cisa.gov1 (33%)
  • proofpoint.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)