THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Google Chromium to its Known Exploited Vulnerabilities (KEV) catalog, specifically CVE-2026-85046. Described as a type confusion flaw in V8, the JavaScript and WebAssembly engine, the vulnerability has a CVSS score of 8.8 and is reported as actively exploited in the wild.
Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046, which could allow a remote attacker to execute arbitrary code inside the browser sandbox by presenting a specially crafted HTML page. The advisory notes that Google is aware of exploits in the wild, though no technical details or threat actor attribution are provided.
According to the piece, CVE-2026-85046 is the sixth actively exploited Chrome zero‑day of 2026. Google’s patching release updates Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux, with rollout continuing over the coming days. The article also lists other Chrome zero-days addressed this year: CVE-2026-2441 (February), CVE-2026-3909 and CVE-2026-3910 (March), CVE-2026-5281 (April) and CVE-2026-11645 (June).
The guidance references Binding Operational Directive 22-01, mandating that FCEB agencies fix identified vulnerabilities by the due date, with CISA instructing private organisations to review the KEV catalog and address the flaws in their infrastructure.