close

DEV Community

Anoymask
Anoymask

Posted on

Chrome CVE-2026-85046: V8 Type Confusion Vulnerability Actively Exploited

#security #threatintel

1. Basic Information

2. Executive Summary

CVE-2026-85046, a type confusion vulnerability in the Chrome V8 engine, has been actively exploited in the wild. Google has released a security update, and CISA has added the vulnerability to its KEV catalog.

3. Attack Flow

From Malicious Web Content to V8 Memory Corruption

This is the exploitation mechanism based on Google's CVE information. Delivery vectors and subsequent actions in real-world attacks have not been disclosed.

  1. An attacker prepares a crafted HTML page that exploits CVE-2026-85046.
  2. A vulnerable Chrome browser processes the page, triggering a type confusion in V8.
  3. If successful, arbitrary code is executed within the sandbox.
  4. Inference: Compromising the device outside the sandbox may require another vulnerability or additional techniques. Such chaining has not been confirmed in real-world attacks.

4. Attacker Position and Execution Location

  • A remote attacker who causes a vulnerable Chrome browser to process a crafted HTML page. The execution scope is within the sandbox.

5. Visibility for Victims and Administrators

Victims

  • Inference: There may be no noticeable signs when the page is displayed. It might appear as an abnormal termination of a tab or browser, but this alone does not confirm exploitation.

Administrators

  • Inference: If crash logs are collected, Chrome or V8 errors may remain. If the subsequent code launches another process, suspicious child processes originating from the browser may appear in EDR process creation logs.

6. Success and Failure Conditions

Success Conditions

  • Running a Chrome version older than 152.0.7977.82, which is identified as affected by Google's CVE information. Even if an update has been downloaded, the older version may still be running until the browser restarts.
  • The crafted HTML page is processed by a vulnerable Chrome browser.

Failure Conditions / Risk Mitigation

  • Update Chrome to 152.0.7977.82/.83 or later on Windows and macOS, and 152.0.7977.82 or later on Linux, then restart the browser.
  • Check the availability of updates for Chromium-based browsers and restrict access to dangerous sites until updates are applied.
  • Inference: Monitoring browser child process generation and abnormal terminations can serve as an investigation trigger. Monitoring alone does not prevent exploitation.

7. What Happens on Success

  • The impact indicated in Google's CVE information is arbitrary code execution within the sandbox.
  • Inference: This could lead to unauthorized access to in-browser data or device compromise when combined with another vulnerability.
  • Inference: If device compromise is achieved, it could lead to credential theft or subsequent compromise. These have not been confirmed in real-world attacks.

8. Observable Logs

  • Email: Inference: Check for emails containing malicious URLs, shortened URLs, or attached HTML files.
  • Proxy/SWG/DNS: Inference: Check recently visited URLs, transfer paths, downloads, and communication to unknown domains.
  • Endpoint/EDR: Inference: Check for chrome.exe crashes, V8-related errors, suspicious child processes originating from the browser, and the creation of executable files.
  • Identity/IdP: Inference: Check for abnormal authentication, token usage, or session reuse following browser usage.
  • SaaS/Cloud: Inference: Check for suspicious sessions, changes in device information, or data access within webmail or SaaS applications.
  • Network: Inference: Check for communications to unknown destinations, retrieval of additional payloads, and outbound connections immediately following page views.

9. Attack Success Criteria

These are evaluation criteria for internal investigations. They do not mean that success at each stage has been confirmed in the article.

  • Attack Attempt Observed (Success Unconfirmed): Confirm logs indicating the delivery and processing of crafted HTML. Access to a URL or related communications alone does not determine whether it was an exploitation attempt.
  • User Action Confirmed: Confirm that a user opened the target page. Logs of automatic loading alone do not count as confirmed user action.
  • Initial Execution Confirmed: Confirm evidence that the attack code executed within the sandbox. If there are only abnormal terminations or memory corruption, successful code execution remains unconfirmed.
  • Malware Execution or Authentication Success Confirmed: Investigate starting from suspicious child processes and confirm the execution of subsequent payloads. The mere presence of child processes does not prove malware execution.
  • Information Theft or Session Compromise Confirmed: Confirm unauthorized access to cookies, credentials, or SaaS data.
  • Subsequent Compromise Confirmed: Confirm execution outside the sandbox, persistence, or lateral movement.

10. Investigation Playbook

  • Trigger: Devices running pre-patch Chrome that visited suspicious URLs, V8 crashes, or suspicious execution originating from the browser.
  • Initial Triage: Preserve the exact Chrome version, restart time, browsing history, proxy logs, and crash timestamps.
  • Endpoint: Investigate browser process trees, crash dumps, generated files, persistence mechanisms, and access to credentials.
  • Authentication/Cloud: Check post-visit SaaS and IdP sessions, cookie usage, authentication source IPs, and device information.
  • Subsequent Activity: Track additional payloads, outbound communications, privilege escalation, and connections to other devices.
  • Containment: Update and restart the browser, isolate suspected devices, and revoke related sessions and credentials.
  • Classification: Categorize findings into browsing only, renderer anomaly, code execution, out-of-sandbox compromise, and information theft.

11. Defense and Detection Ideas

  • Single Event: V8 crashes on unpatched Chrome, or the launch of unusual executables from chrome.exe.
  • Chronological Correlation: Inference: Correlate suspicious URL visits, abnormal Chrome terminations, child process generation, unknown destination communications, and abnormal SaaS authentication in chronological order. This does not indicate that this specific order was observed in actual attacks.
  • Hunting: Within the available log retention period, search for crashes and suspicious browser-initiated executions during the period when unpatched Chrome was running. Do not treat the publication date as the start date of the attack.
  • Log Gaps: Without web access logs and browser version management, it is difficult to identify targeted devices and the exposure period before updates.
  • Prioritized Mitigations: Prioritize updating and restarting Chrome, confirming patch status for Chromium-based browsers, and monitoring browser-initiated behaviors.

12. Facts / Inference / Hypothesis

Facts

  • According to Google's CVE information, CVE-2026-85046 is a V8 type confusion vulnerability that can allow arbitrary code execution within the sandbox via a crafted HTML page.
  • Google has confirmed that the vulnerability is being actively exploited in the wild.
  • The fixed versions are 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux.
  • Google has withheld technical details of the attacks to allow time for patch deployment.
  • CISA added the vulnerability to its KEV catalog on September 4, 2026, setting a compliance deadline of September 16, 2026, for federal agencies.

Inference

  • Because details of real-world attacks are private, correlating web access with endpoint execution logs helps distinguish between simple browsing and successful compromise.

Hypothesis

  • Real-world attacks may have used sandbox escape vulnerabilities or social engineering, but these have not been confirmed.

13. MITRE ATT&CK Mapping

  • T1189 Drive-by Compromise (Medium): Viewing malicious web content can serve as an attack entry point.
  • T1203 Exploitation for Client Execution (High): Exploits V8 type confusion to target code execution within the browser.

14. Unknowns and Further Investigation

  • Delivery vectors, targets, and threat actors behind the active exploitation.
  • Specific inputs and IOCs that exploit the vulnerability.
  • Presence of sandbox escapes or subsequent payloads.

15. Impact on SOCs and Organizations

In this incident, completing the update requires not only distributing the fixed version but also restarting the browser. Effective patch management requires verifying not just whether an update has been distributed, but also which version is actively running.

Active exploitation is confirmed, but delivery vectors and subsequent actions are private. SOCs should use browser crashes as an investigation trigger while connecting web access with endpoint execution logs to make a determination. Do not treat a crash alone as successful code execution, and consider the investigation window to include the unpatched running period prior to public disclosure.

16. Summary by Role

  • For SOCs: Correlate pre-patch V8 crashes, browser-initiated child processes, outbound communications, and authentication anomalies.
  • For Administrators: Update Chrome to the fixed version, verify browser restarts, and ensure Chromium-based browsers follow suit with updates from their respective vendors.
  • For Users: Save work and restart the browser when update notifications appear, and report any anomalies after opening suspicious links.

Top comments (0)