Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a c…

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

1. 2026-09-03 0-day patched (Project Zero)
2. 2026-09-03 Published
3. 2026-09-04 Added to CISA KEV
4. 2026-09-05 CISA SSVC: exploitation active
5. 2026-09-18 CISA patch deadline

Added

2 mo ago (2026-09-04)

Patch by

2026-09-18 (52 d ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

Google, Chromium V8

CISA name

Google Chromium V8 Type Confusion Vulnerability

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched

2026-09-03

Details

project zero tracker

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

2 mo ago (2026-09-05)

1.81% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

• serotav.github.io https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/ referenced PoC, tagged "exploit" by a source, unverified
• github.com https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md referenced PoC, tagged "exploit" by a source, unverified

• Google Chrome

Weakness

• CWE-843 Access of Resource Using Incompatible Type

Technology feeds

• Google Chrome rss critical rss

• github.com /v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67

  patch

• serotav.github.io /Writeups/v8/when-sorting-leads-to-confusion/

  exploit, third-party-advisory

• github.com /Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md

  exploit, third-party-advisory

• chromereleases.googleblog.com /2026/09/stable-channel-update-for-desktop_01882797386.html

  release-notes, vendor-advisory

• issues.chromium.org /issues/542403045

  permissions-required

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046

  government-resource, us-government-resource

• news.ycombinator.com /item?id=49570669

  issue-tracking, third-party-advisory

• CVE List CVE-2026-85046
• NVD CVE-2026-85046

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: NVD's google:v8 range has no starting version; the vulnerable code was added in 14.9.78, reverted in 14.9.135, re-added in 14.9.196, and fixed in 15.3.48.