CISA Adds Google Chromium V8 Type Confusion Vulnerability to Known Exploited Catalog

On September 4, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2026-85046, is a type confusion flaw in the Google Chromium V8 JavaScript engine. CISA determined that the vulnerability is being actively exploited in the wild, qualifying it for inclusion under the KEV program.

Type confusion vulnerabilities in the V8 engine are a frequent attack vector for malicious cyber actors. Such flaws can allow an attacker to execute arbitrary code within the context of the browser, potentially leading to full system compromise if a user visits a specially crafted web page.

CISA's Binding Operational Directive (BOD) 26-04, which establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, reinforces the importance of the KEV Catalog. The directive requires federal agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. BOD 26-04 also establishes expectations for agencies to check whether threat actors had compromised the system before a patch was applied.

While BOD 26-04 applies specifically to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. Google Chrome and Chromium-based browsers are affected; users and administrators should update to the latest browser version to mitigate the risk.