Actively exploited sandbox RCE in all Chromium versions

Let's take a moment to talk about the monetary value of this vulnerability.

According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.

The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?

It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet?

The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains:

> When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer

Memory safety is specifically intended to prevent errors like these from becoming arbitrary out-of-bounds memory access and native code execution. Even type safety --- from the 1970s --- can prevent type confusion.

The CISA and the NSA have called for the adoption of memory-safe languages.[3] We exercise poor engineering judgment and poor ethics, as an industry, when we continue to expose users to classes of wholly avoidable security weaknesses in Internet-facing software.

[1] https://en.wikipedia.org/wiki/Heartbleed

[2] https://cwe.mitre.org/data/definitions/843.html

[3] https://www.nsa.gov/Press-Room/Press-Releases-Statements/Pre...

> Type confusion in V8

Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.

Is the HN title true that it affects all "all Chromium versions"?

Per OP link, it only affects Chrome versions prior to .82; .82 was released as stable 2 days ago. [1]

(HN title also does not match the original title, which is the CVE ID -- not particularly intuitive.)

[1] https://chromereleases.googleblog.com/2026/09/stable-channel...

It’s really a shame that my engineering school requires me to use Google Chrome because their Honorlock browser extension[1] requires Google Chrome.

You would think that an engineering school would be wiser than to require their students use a specific web browser that’s tied to a specific vendor.

[1] https://app.honorlock.com/install/extension

Not to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.

I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.

Brave is beating GrapheneOS on update timeliness:

https://github.com/GrapheneOS/Vanadium/releases

https://github.com/brave/brave-browser/releases

Only if you use Nightly wait maybe not.

It seems like the Chromium issue on their bugboard, which presumably would have the example HTML and vuln patch, is blocked from being viewed. Is this because making it public increases the risk of exploitation?

https://issues.chromium.org/issues/542403045

Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?

I don't like this question, but why Google still open source Chrome as AI finding exploits so fast?

I want Chrome stay open source, but why should I believe it's possible?

> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

What's the difference between "executing arbitrary code inside the sandbox via a crafted HTML page" and running whatever is in the <script> tag?

What do CVEs like this one mean for the likes of fly.io and cloudflare who use V8 for sandboxing 3p workloads? I guess they have some degree of KYC and some hardening outside the sandbox, but chaining this with a container escape running under a free tier account could pwn the host.

So basically, Edge, Brave and any other browser built on Chromium. Nice.

For what is this exploited in the wild when it doesn't include a sandbox escape?

Is this chained with n-days?

Does anybody have a source for the "actively exploited" part of the HN title?

Next time, sell it to me, I’ll pay $1001!

Is this known to be exploitable in any Electron apps, and specifically VSCode extensions?

I prefer firefox, but doesn't firefox have a history of more similar exploits?

I would guess it's now trivial for attackers to have an llm analyse every new commit to chromium repo linking to an issue that's 403 for security reasons, but maybe I'm missing something.

Google has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable.

Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.

Just outta curiosity because I can't find it at a cursory look - what exactly would be the type (coersion?) that would allow v8 to execute arbitrary code? Is this like something in post data to nodejs that terminates early and is able to run exec or something, like unto a sql injection?

Hell yea. Let's see some real leaks.

Sounds wild.

(Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)

struct MessageBuffer

{

  int msgType;


  union {


    char *name;


    int nameID;


  };

};

That finally convinced me getting data using functions (accessors, getters, setters) is a good thing, even in C :) Just all that unnecesary if's are so annoing and killing performance...

Aren’t all the big chrome vulnerabilities type confusion?

Why is this 8.8?

It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.

Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.

As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising.

"Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."

NIST probably had this one filed and ready to announce years ago

like those news agencies have obituaries of famous old people pre-written

Doesn't everyone else immediately update everything on their computer before they start doing anything?

CVE-2026-85046 and Northstar web browser:

https://github.com/nordstjernen-web/northstar-browser/blob/m...

Only a score of 8.8?

Another type confusion vulnerability! Interesting.

Chromium, or just Chrome?

There's something funny about the site needing JavaScript to display anything

$1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.

Good antivirus should protect you from such attacks. Even zero day ones.