Active Exploited V8 Type‑Confusion Flaw in Google Chrome (CVE‑2026‑85046) Added to CISA KEV Catalog
What It Is — A type‑confusion vulnerability in Chrome’s V8 JavaScript/WebAssembly engine (CVE‑2026‑85046) that permits remote code execution when a malicious HTML page is rendered. Google confirms the flaw is being exploited in the wild.
Exploitability — Actively exploited; CVSS 8.8 (High). A patch was released in Chrome 152.0.7977.82/83 for Windows, macOS, and Linux.
Affected Products — Google Chrome browser (stable channel) on Windows, macOS, and Linux.
Why It Matters for Trust & Control Assurance
- Highlights the criticality of a Vulnerability Management control that continuously inventories, scores, and remediates known‑exploited flaws.
- Satisfies the “timely remediation” objective that maps to many frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6), giving auditors concrete evidence of due‑diligence.
- Enables a defensible audit trail: patch‑deployment logs, remediation tickets, and continuous‑monitoring data demonstrate compliance to regulators and enterprise partners.
Recommended Actions
- Deploy Chrome 152.0.7977.82 (or later) to all endpoints without delay.
- Verify patch rollout with automated inventory tools and retain logs as compliance evidence.
- Map CVE‑2026‑85046 to your vulnerability‑management control objective; capture remediation tickets for audit readiness.
Source: Security Affairs