V8 type confusion in Chromium lets a crafted page run code in the browser sandbox (CVE-2026-85046)
Google shipped Chrome 152.0.7977.82 on September 3 for a V8 type confusion bug it says is exploited in the wild, and CISA added it to KEV on September 4; unpatched browsers can be compromised by simply visiting a crafted page.
A type confusion flaw in V8, Chromium's JavaScript and WebAssembly engine, lets a remote attacker execute arbitrary code inside the renderer sandbox when a user visits a crafted HTML page. It affects Google Chrome before 152.0.7977.82 and other Chromium-based browsers such as Microsoft Edge and Opera.
Affected: Google Chrome < 152.0.7977.82; Chromium-based browsers (Microsoft Edge, Opera and others) built on the affected V8
How to Test
Confirm the installed Chrome build is 152.0.7977.82 or later via the browser's About page or your endpoint management inventory; for managed fleets, report on any endpoints still on Chrome 151 or earlier 152 builds, and check that Edge, Opera and other Chromium-based browsers have received a build incorporating the V8 fix.
How to Patch
Update Google Chrome to 152.0.7977.82 or later and relaunch the browser so the new version takes effect; for managed fleets, force the stable-channel update and require relaunch. Update Microsoft Edge, Opera and other Chromium-based browsers as soon as their vendors publish releases containing the V8 fix.