CVE-2026-85046Vulnerability
Google Chromium V8 Type Confusion Vulnerability
Reported by 9 independent sources · first reported by Risky Business News · last reported
Last reported 8 days ago
Fix due 18 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 98% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
12 reports, newest first · the exact sentence from each-
Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP“CVE-2026-85046”
-
Multiples vulnérabilités dans les produits Palo Alto Networks (15 octobre 2026)“Référence CVE CVE-2026-85046”
-
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH)“CVE-2026-85046”
-
September 2026 CVE Landscape“CVE-2026-85046”
-
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware“The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser's sandbox and achieve remote code executi…”
-
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits“…ember 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors.”
-
Google Pixel phones pwned in zero-click attacks“Earlier this month, CISA added two Google Chromium vulnerabilities, CVE-2026-85046 and CVE-2026-87491, to its KEV catalog.”
-
14th September – Threat Intelligence Report“Check Point IPS provides protection against this threat (Google Chrome Type Confusion (CVE-2026-85046))”
-
Four groups caught using the same Chrome and Windows exploit kit“The first V8 vulnerability is tracked as CVE-2026-85046, and the Windows bug is tracked as CVE-2026-85880.”
-
Chinese espionage groups swarm to exploit triple-link chain of zero-days“The vulnerabilities include: CVE-2026-85046 and CVE-2026-87491, remote-code execution defects in the JavaScript engine for Chromium-based browsers; and CVE-2026-85880, a privilege-escalation zero-day that Microsoft disclosed Tuesday in Windows Advanced Local Procedure Call.”
-
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows“…ing recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046.”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“Tracked as CVE-2026-85046, the zero-day is a type confusion in Chrome's V8 JavaScript engine.”
Indicators reported together
named in the same reports- chinadigitaltimes[.]topin 2 reports
- americanprgoress[.]topin 2 reports
- thecovnresation[.]comin 2 reports
- cloud.shinewrist[.]netin 2 reports
- idscan[.]netin 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2026-85880, CVE-2026-87491, CVE-2026-81963, CVE-2026-58704, CVE-2026-86060, CVE-2026-85706, CVE-2026-67276, CVE-2026-19490, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-48710, CVE-2025-39964, CVE-2026-20316, CVE-2026-39987
Thanks — we review every report.