DK Dark Knight 2026-09-04 5 min read

CVE-2026-85046: Chromium Sandbox RCE Exploited in the Wild

Yesterday's Hacker News front page told you "Actively exploited sandbox RCE in all Chromium versions". Most people read that as "update Chrome", shrug, and move on. That's the wrong takeaway. I spent this cycle pulling release data from Google, Electron, Brave, and ungoogled-chromium, and the picture is uglier and more interesting: the fix landed in Chrome on September 3, but a week earlier Electron shipped its brand-new stable line on a vulnerable V8, and the entire Electron 43 and 42 lines — every app pinned to them — were still exposed as of this morning.

What CVE-2026-85046 Actually Is

CVE-2026-85046 is a type confusion in V8, Chrome's JavaScript engine. A crafted HTML page drives the bug to execute arbitrary code — inside the sandbox, per NVD's wording. Sandbox-constrained, which is why Google rates it High (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rather than Critical. A lone renderer RCE is nasty but contained; chain it with a sandbox escape and a single web page owns the machine.

Facts from the September 3 stable release:

graph LR
    A[Crafted HTML page] --> B[V8 type confusion
CVE-2026-85046]
    B --> C[Arbitrary code exec
inside sandbox]
    C --> D{Second bug:
sandbox escape?}
    D -->|yes| E[Full machine compromise]
    D -->|no| F[Contained
High, not Critical]

The 30-Day Lifecycle of a Wild Exploit

From report to patch: exactly 30 days.

Thirty days is a competent turnaround for a wild exploit. The uncomfortable part is what happened during those thirty days: the bug sat in every V8 that shipped. Embargoes are a feature — but they're also why the patch-propagation gap below is the only window that actually matters.

Blast Radius: The Electron Check Nobody Runs

I pulled the Chromium baseline from each Electron release tag via the GitHub API. This is what "all Chromium versions" actually means in embedded-app land:

# github.com/electron/electron/releases — "Chromium" line from each release body
v44.0.0 -> Chromium 152.0.7977.54   # Aug 25 — VULNERABLE (below .82)
v43.0.0 -> Chromium 150.0.7871.46   # Jun 30 — EXPOSED
v42.0.0 -> Chromium 148.0.7778.96   # May 6  — EXPOSED
# fixed baseline Google shipped: Chromium 152.0.7977.82

Now the number that should worry you: Electron's own release notes for 44.2.0 never mention CVE-2026-85046. They say "Updated Chromium to 152.0.7977.76" and "Backported fixes from upstream ANGLE, Chromium, Skia and V8". The ten cherry-picks almost certainly include the V8 fix — Electron grafts upstream fixes into its branch instead of jumping builds — but .76 is still below the .82 line Google labels as the minimum safe build, and the CVE is never named. Almost certainly is not a security policy.

And the 43 line? Electron 43.6.0 shipped September 4, two hours before 44.2.0 — with no Chromium bump in its notes. 43 is parked on Chromium 150. Every app on Electron 42 or 43 — and every vendor that pins to a minor instead of tracking the patch line — ran a V8 this exploit targets through yesterday. Meanwhile the browser vendors moved fast: Brave hit 152.0.7977.83 by September 4 and ungoogled-chromium shipped .82-1. The embedded long tail? Still catching up.

The $1,000 Bounty Is the Real Signal

Google paid Serotav $1,000 for a bug the same release note calls actively exploited. Chrome's VRP has historically paid five to six figures for V8 memory-safety bugs. Either the 2026 reward structure collapsed for renderer bugs, or the bar for "exploit" dropped so far that a type confusion reaching the wild is routine. Both readings are bad: the marginal cost of weaponizing these bugs is falling, and the incentive to report them is falling with it. One of those two things will break first.

What You Should Do Today

Bottom line: "update Chrome" is a rounding error disguised as advice. CVE-2026-85046 is the substrate story: one V8 type confusion, 30 days, and the browser isn't the product anymore — Chromium is the dependency. Google fixed its browser in 30 days; the ecosystem of embedded Chromium will take weeks, and the parts that never update will take forever. Chrome is already safe. Your Electron apps, your embedded kiosks, your CEF-based tooling are the ones still holding the bag.

Related Reading