One component inside several browsers: type confusion in Chromium V8
A type confusion flaw added to the catalog on 4 September 2026. The record itself states that it could affect multiple Chromium-based browsers, naming Chrome, Edge and Opera.
Key facts
- CVE IDCVE-2026-85046
- Affected (vendor / product)Google Chromium V8
- CWECWE-843
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-09-18 (U.S. federal civilian agencies, BOD 22-01)
- Required action (CISA)Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Key points
- A type confusion vulnerability in V8, the JavaScript engine in Chromium, reachable through a crafted HTML page.
- The record itself states the flaw could affect several Chromium-based browsers, naming Chrome, Edge and Opera.
- V8 appears 40 times in the catalog, and 20 of those are the same weakness, CWE-843.
- The required action cites BOD 26-04 and forensics triage requirements rather than the usual BOD 22-01 text.
1A type confusion flaw in Chromium V8
CVE-2026-85046 is a type confusion vulnerability (CWE-843) in V8, the JavaScript engine inside Chromium. The record states that a crafted HTML page could let a remote attacker execute arbitrary code inside the sandbox, and that the flaw could affect multiple browsers that use Chromium, including Google Chrome, Microsoft Edge and Opera.
It was added on 4 September 2026 with a remediation date of 18 September, a fourteen-day window. The required action cites compliance with BOD 26-04, prioritizing security updates based on risk, and with forensics triage requirements. If the browser you use is built on Chromium, it is in scope.
2A record listed under the name of a component
Elsewhere in the catalog, the Apple record has a product field grouping several operating systems. Here it names Chromium V8 — not a browser but the JavaScript engine that runs inside one.
The description states for itself that the reach extends beyond Chrome, to browsers built on Chromium including Microsoft Edge and Opera. Anyone searching by the name of the browser they use will not find this record.
3Half of them are the same type
Twenty of V8's 40 entries are type confusion (CWE-843), a defect in which a value is handled as a type it is not. It recurs in systems where types are settled at run time, as in a JavaScript engine.
That contrasts with the 172 Windows entries, which scattered across many types. The narrower the role of a component, the narrower the range of defects found in it.
4The required action is worded differently
The remediation instruction on this record departs from the usual text. Most records say to apply mitigations per vendor instructions and follow BOD 22-01 guidance for cloud services. This one requires compliance with BOD 26-04, prioritizing security updates based on risk, and with forensics triage requirements, and the references carry URLs for both documents.
The next article takes up a record that asks for discontinuation rather than an update.
Why it matters
Tracking vulnerabilities by browser name misses records filed under the underlying component. Know what your browsers are built on and track by component name as well.
FAQ
What is type confusion?
Is this irrelevant if I do not use Chrome?
Is execution inside the sandbox limited in impact?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).