CVE-2026-85046 · High · CISA KEV

Type Confusion in Chromium V8: Remote Code Execution via Crafted HTML

Threat Engine Auto-Feed · data current as of 2026-09-05

A type confusion vulnerability in Google Chromium V8, listed in CISA KEV, allows remote code execution via a crafted HTML page. This impacts multiple web browsers utilizing Chromium, posing a risk to organizations whose users access untrusted web content.

  • CVSS:
  • EPSS percentile: 0.56435
  • Exploitation pressure: 59/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 56th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

Type confusion occurs when a program attempts to access a resource (like a memory location or variable) using an incompatible type. This mismatch can lead to unexpected behavior, memory corruption, or, in this case, allow an attacker to execute their own code within the affected software.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Any enterprise whose users regularly browse the internet using Chromium-based browsers (Google Chrome, Microsoft Edge, Opera)
  • Organizations with a high volume of web-based interactions or reliance on web applications

Misconfigurations that escalate it

  • Lack of robust web content filtering or sandboxing policies
  • Outdated browser versions across the enterprise

High-impact scenarios

  • Remote code execution within the browser's sandbox, potentially leading to further system compromise
  • Initial access for financially motivated actors (FIN7, LockBit affiliates, APT38) targeting financial services
  • Initial access for state-sponsored espionage (APT29, Scattered Spider) targeting technology sectors

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor for unusual process activity originating from web browsers
  • Implement and monitor browser security features and extensions
  • Analyze network traffic for suspicious outbound connections from user workstations

Contain

  • Isolate affected workstations from the network
  • Terminate all browser processes on potentially compromised machines

Patch

  • Prioritize patching and updating all Chromium-based browsers (Google Chrome, Microsoft Edge, Opera) to the latest secure versions as soon as patches are available.

Frontier verdict — High

High priority due to confirmed in-the-wild exploitation (CISA KEV) and potential for remote code execution across widely used browsers.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.