Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Google Chrome V8 type confusion security flaw (CVE-2026-85046)

Vulnerability
First reported
Last updated
Happening score
H score 36
2 unique sources, 5 articles

Summary

Hide ▲

CVE-2026-85046 is a Google Chrome V8 type-confusion vulnerability that was exploited in the wild before Google shipped fixes in 152.0.7977.82/.83 for Windows and Apple macOS and 152.0.7977.82 for Linux. The flaw was reported on August 4, 2026 by Salvatore Gulizia (aka Serotav) and can be triggered through a crafted HTML page. On September 9, 2026, Proofpoint described BlueMoon, a shared modular exploit kit, chaining CVE-2026-85046 with CVE-2026-87491 and CVE-2026-85880 to deliver Chrome remote code execution, sandbox escape, and Windows local privilege escalation. Volexity later linked BlueMoon activity to UTA0560 and JungleBamboo / APT31, with spear-phishing against multiple NGOs on September 1, 2026 and payloads including GRIMWEDGE and LONGTALE.

Related Happenings

UNC3569 Sogou Input Method exploitation campaign

Campaign
H score89 First: 11.09.2026 10:14 Last: 11.09.2026 10:14 Sources 1

About this happening: UNC3569 is using a crafted sgbiz: link to exploit Tencent’s Sogou Input Method for Windows and deploy the GRAYRABBIT backdoor. Gen Digital says the activity involv...

Open Happening

Google Chrome V8 out-of-bounds write security flaw (CVE-2026-87491)

Vulnerability
H score36 First: 09.09.2026 12:11 Last: 09.09.2026 12:11 Sources 1

How related: CVE-2026-87491: a V8 sandbox escape that corrupts WebAssembly metadata to run embedded shellcode

About this happening: CVE-2026-87491 is a V8 flaw in Google Chrome that allows arbitrary code execution inside the browser sandbox through a crafted HTML page. Google patched Ch...

Open Happening

Chrome V8 JavaScript engine out-of-bounds read/write zero-day exploited in the wild (CVE-2026-11645)

Vulnerability
H score45 First: 09.06.2026 09:56 Last: 09.06.2026 09:56 Sources 1

About this happening: Google has patched CVE-2026-11645, a Chrome V8 JavaScript engine zero-day that was exploited in the wild and could let remote attackers run code inside the browser...

Open Happening

Chromium JavaScript background RCE flaw

Vulnerability
H score16 First: 21.05.2026 21:13 Last: 21.05.2026 21:13 Sources 1

About this happening: The unfixed Chromium flaw keeps JavaScript running after the browser is closed, creating remote code execution risk across Chromium-based browsers. A malicious sit...

Open Happening

Chrome/Dawn actively exploited use-after-free flaw (CVE-2026-5281)

Vulnerability
H score1 First: 01.04.2026 13:25 Last: 01.04.2026 13:25 Sources 1

About this happening: Google Chrome Stable Desktop on Windows, macOS, and Linux is getting an emergency fix for CVE-2026-5281, a use-after-free flaw in Dawn/WebGPU. Google says...

Open Happening

Timeline

  1. 04.09.2026 10:18 6 articles · 14d ago

    Google patches actively exploited Chrome zero-day CVE-2026-85046

    Mitigation Patch Update

    Google releases security updates for Chrome, patching 12 vulnerabilities including CVE-2026-85046, and acknowledges that an exploit for the flaw exists in the wild; the bug affects Google Chrome prior to 152.0.7977.82, with fixes in 152.0.7977.82/.83 for Windows and Apple macOS and 152.0.7977.82 for Linux.

    Show sources
    Open in new tab
  2. 04.08.2026 03:00 1 articles · 1mo ago

    Researcher reports V8 type confusion flaw in Google Chrome

    Initial Disclosure

    Security researcher Salvatore Gulizia (aka Serotav) discovers and reports CVE-2026-85046, a high-severity type confusion flaw in V8, Google Chrome's JavaScript and WebAssembly engine, that can let a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page.

    Show sources
    Open in new tab