CISA Adds CVE-2026-85046 to KEV List Amid Exploitation Evidence

## Overview CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) list on September 4, 2026. This addition indicates a federal deadline for remediation. The vulnerability affects Chromium V8, which is used in multiple web browsers, including Google Chrome, Microsoft Edge, and Opera. Evidence of exploitation has prompted this urgent notification. ## Technical Details CVE-2026-85046 is a type confusion vulnerability in the V8 engine of Chromium. It allows a remote attacker to execute arbitrary code within the browser's sandbox environment. This exploitation occurs through a specially crafted HTML page. The vulnerability impacts versions of Chromium prior to 152.0.7977.82. The CVSS score of 8.8 signifies a high severity level, emphasizing the critical nature of this flaw. ## Impact Successful exploitation of this vulnerability can lead to unauthorized code execution. Attackers can leverage this flaw to bypass security measures in the sandbox, potentially compromising user data and system integrity. Given the widespread use of Chromium in various browsers, the impact extends beyond Google Chrome, affecting many users across different platforms. ## Mitigation Defenders should prioritize updating to Chromium version 152.0.7977.82 or later. Organizations must ensure that all instances of affected browsers are patched to mitigate the risk associated with this vulnerability. Regularly monitoring for updates and applying security patches promptly will help protect against potential exploitation.