Chrome 152 sandbox RCE actively exploited (CVE-2026-85046) [PoC]

Actively exploited in the wild - CVE-2026-85046 is a high-severity type confusion vulnerability in Google Chrome’s V8 JavaScript engine (versions prior to 152.0.7977.82) that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The fix is available in Chrome 152.0.7977.82 - update immediately.

Overview

CVE-2026-85046 is a type confusion bug in the V8 JavaScript engine used by Google Chrome. Type confusion occurs when the browser mistakenly treats one kind of data as another, which can corrupt memory in predictable ways. An attacker who successfully triggers this bug can then execute arbitrary code on the victim’s machine, albeit within the confines of Chrome’s sandbox.

The attack vector is straightforward: a victim only needs to visit a maliciously crafted web page. No additional user interaction beyond the page load is required, making this a practical and dangerous attack chain when combined with a sandbox escape. Google has rated this vulnerability as High severity, and the Chromium security team assigned it a severity rating consistent with the CVSS score of 8.8.

Impact

Successful exploitation grants the attacker code execution within the Chrome renderer sandbox. While the sandbox limits what the attacker can do directly, code execution inside the browser is a critical first step in a multi-stage attack. Threat actors frequently chain such browser bugs with a separate sandbox escape to achieve full system compromise.

The vulnerability requires no authentication and can be triggered over the network with low attack complexity. The only mitigating factor is that user interaction is required - the victim must open the malicious page.

Remediation

Google has released Chrome 152.0.7977.82, which contains the fix for CVE-2026-85046. Users and administrators should:

1. Update Chrome to version 152.0.7977.82 or later immediately.
2. Enable automatic updates to ensure future patches are applied without delay.
3. Enterprise administrators should push the update across managed devices promptly, as this bug is confirmed as actively exploited.

This is not the first Chrome V8 zero-day this year. See our coverage of CVE-2026-11645, a similar V8 bug exploited in the wild, and the broader weekly threat roundup covering recent Chrome and Ivanti zero-days. CISA has also added this CVE to its Known Exploited Vulnerabilities catalog, as detailed in our coverage of the KEV additions.

Security Insight

The regularity of V8 type confusion bugs in Chrome’s patch cycle is becoming a pattern that defenders cannot ignore. Between CVE-2026-11645 and now CVE-2026-85046, attackers are consistently weaponizing JavaScript engine bugs within days of discovery. This cadence suggests that either the V8 codebase remains too complex for comprehensive fuzzing coverage, or that exploit developers have developed reliable tooling that maps type confusion vulnerabilities directly to working exploits. For organizations, the practical takeaway is that browser patching must be treated with the same urgency as operating system patching - the browser is now the primary attack surface for most users.

Further Reading

• Weekly Threat Roundup: Ivanti & Chrome Zero-Days (June 8-14)
• CISA adds Cisco, Chrome flaws to KEV catalog
• Chrome V8 zero-day CVE-2026-11645 exploited in wild
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs