Actively exploited sandbox RCE in all Chromium versions
A critical, actively exploited Type Confusion vulnerability in Chromium's V8 JavaScript engine has been discovered and patched. This RCE within the browser's sandbox allows attackers to execute arbitrary code, highlighting the continuous cat-and-mouse game of browser security. HN discussed the nuances of 'sandbox RCE' and the swiftness of browser updates.
The Lowdown
A significant security flaw, CVE-2026-85046, has been identified and actively exploited in the V8 JavaScript engine that powers Google Chrome and other Chromium-based browsers. This vulnerability, classified as a 'Type confusion' issue, enables remote attackers to execute arbitrary code within the browser's sandbox environment using a specially crafted HTML page.
- Vulnerability Type: Type confusion within the V8 engine, a common source of memory corruption bugs.
- Impact: Allows for Remote Code Execution (RCE) inside the browser's sandbox. While contained, this is a critical first step for sophisticated attacks that might chain with other vulnerabilities to escape the sandbox.
- Severity: Graded as 'High' by Chromium's security team, with a CVSS 3.1 vector indicating high confidentiality, integrity, and availability impacts, requiring user interaction (e.g., visiting a malicious page).
- Affected Versions: Google Chrome versions prior to 152.0.7977.82 were vulnerable.
- Resolution: The vulnerability has been addressed in Chrome version 152.0.7977.83 and later.
- CISA Alert: This CVE has been added to CISA's Known Exploited Vulnerabilities Catalog, mandating timely mitigation by U.S. federal agencies by September 18, 2026.
This actively exploited flaw underscores the persistent threat landscape for web browsers and the critical importance of keeping software updated to the latest security patches.
The Gossip
Sandbox Severity Sizing
The HN community debated the true severity and implications of 'RCE inside a sandbox.' Some users questioned the CVSS score's adequacy, wondering if it fully captured the risk. Others clarified that while it grants arbitrary machine code execution, the sandbox theoretically confines the exploit, suggesting it would likely need to be chained with another vulnerability to achieve full system compromise, differentiating it from a complete RCE.
Browser Patching Punctuality
Discussion naturally gravitated towards the speed at which the fix was deployed and adopted across various Chromium-based browsers. Users confirmed that the updated Chrome version containing the patch (152.0.7977.83) was already available. There was also a comparison of update timeliness between different browsers and operating system distributions, highlighting concerns about prompt security remediation.