One component inside several browsers: type confusion in Chromium V8
A type confusion flaw added to the catalog on 4 September 2026. The record itself states that it could affect multiple Chromium-based browsers, naming Chrome, Edge and Opera.
Key facts
- CVE IDCVE-2026-85046
- Affected (vendor / product)Google Chromium V8
- CWECWE-843
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-09-18 (U.S. federal civilian agencies, BOD 22-01)
Key points
- A type confusion vulnerability in V8, the JavaScript engine in Chromium, reachable through a crafted HTML page.
- The record itself states the flaw could affect several Chromium-based browsers, naming Chrome, Edge and Opera.
- V8 appears 40 times in the catalog, and 20 of those are the same weakness, CWE-843.
- The required action cites BOD 26-04 and forensics triage requirements rather than the usual BOD 22-01 text.
1A record listed under the name of a component
In the previous article the product field grouped several operating systems. Here it names Chromium V8 — not a browser but the JavaScript engine that runs inside one.
The description states for itself that the reach extends beyond Chrome, to browsers built on Chromium including Microsoft Edge and Opera. Anyone searching by the name of the browser they use will not find this record.
2Half of them are the same type
Twenty of V8's 40 entries are type confusion (CWE-843), a defect in which a value is handled as a type it is not. It recurs in systems where types are settled at run time, as in a JavaScript engine.
That contrasts with the 172 Windows entries, which scattered across many types. The narrower the role of a component, the narrower the range of defects found in it.
3The required action is worded differently
The remediation instruction on this record departs from the usual text. Most records say to apply mitigations per vendor instructions and follow BOD 22-01 guidance for cloud services. This one requires compliance with BOD 26-04, prioritizing security updates based on risk, and with forensics triage requirements, and the references carry URLs for both documents.
The next article takes up a record that asks for discontinuation rather than an update.
Why it matters
Tracking vulnerabilities by browser name misses records filed under the underlying component. Know what your browsers are built on and track by component name as well.
FAQ
What is type confusion?
Is this irrelevant if I do not use Chrome?
Is execution inside the sandbox limited in impact?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).