CISA’S Known Exploited Vulnerabilities (KEV) catalog lists CVE-2026-85046 as a Google Chrome/Chromium V8 type confusion vulnerability. It allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The KEV entry notes that the vulnerability could affect multiple web browsers built on Chromium, including Google Chrome, Microsoft Edge, and Opera.
The record provides guidance to organisations: apply mitigations in accordance with vendor instructions and align with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk. The entry specifies a date added of 04 September 2026 and a due date of 18 September 2026. It also directs stakeholders to assess each asset’s internet exposure and follow the applicable BOD 26-04 patching guidance, including considerations for cloud services or discontinuing use if mitigations are unavailable.
Extra references include linked Chrome release notes and NVD details for CVE-2026-85046. The KEV page clarifies the severity of exploitation in the wild as unknown in terms of “Known To Be Used in Ransomware Campaigns,” and notes that forensic triage requirements are not mandated by BOD 26-04. Respondents should monitor vendor advisories and ensure timely patching while maintaining compliance with the directive framework.