The IT Guys Security Alert with Jennifer Hudsen • September 4, 2026 • Cutoff 4:53 p.m. EDT / 20:53 UTC
CISA Adds Actively Exploited Chrome V8 Flaw to KEV: Update and Relaunch Chrome Now
Current status: CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4 and set a September 18, 2026 remediation due date for the catalog entry. Google says an exploit exists in the wild and released fixed Chrome desktop builds beginning with 152.0.7977.82. [1] [3]
What happened
CISA’s live KEV record identifies CVE-2026-85046 as a type-confusion vulnerability in Chromium’s V8 engine. The agency says a remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The record names Google Chrome, Microsoft Edge and Opera as examples of Chromium-based browsers that could be affected. [1]
The wording “inside the sandbox” is an important boundary. The opened primary sources do not establish a separate sandbox escape, full device takeover, malware installation or compromise of a named organization. They also do not identify the attacker, victims, delivery campaign, geographic scope or number of successful attacks. CISA marks known ransomware-campaign use as “Unknown.” [1] [4]
Google’s September 3 desktop release says the Stable channel moved to 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. Google says the rollout will continue over days or weeks and explicitly states that it is aware of an exploit for CVE-2026-85046 in the wild. [3]
Why the KEV listing changes the priority
A vendor acknowledging exploitation is already a strong reason to patch quickly. CISA’s KEV addition adds a second primary-source signal and a concrete federal remediation date. CISA says KEV entries are based on evidence of active exploitation; its September 4 alert tells organizations to prioritize timely remediation as part of vulnerability management. [2]
The September 18 date should be described precisely. It is the due date recorded in CISA’s KEV catalog for this vulnerability, not a universal legal deadline imposed on every home user or private business. Federal civilian executive-branch agencies have binding obligations tied to CISA directives; everyone else can use KEV as a high-value risk-prioritization signal. [1]
Our practical assessment: home users and small businesses should not wait for September 18. Browser exposure is broad, Google says exploitation is already occurring, and the update is available. Managed fleets should treat installation, relaunch and version verification as separate steps: an updater downloading files does not prove that every running browser process has loaded the fixed build.
Who should check
- Chrome users on Windows and macOS: verify version 152.0.7977.82 or 152.0.7977.83, or a later stable build. [3]
- Chrome users on Linux: verify version 152.0.7977.82 or later. Distribution packaging can differ, so managed Linux systems should also check the package source and confirm the running process was restarted. [3]
- Organizations using Edge, Opera or another Chromium-derived browser: inventory those products and consult each vendor’s own security release. CISA says the V8 flaw could affect multiple Chromium browsers, but Google’s Chrome version numbers must not be treated as Edge or Opera fixed versions. [1]
- Kiosk, shared-workstation, VDI and unattended systems: check machines that may stay signed in or keep browser processes open for long periods. A central console’s “update available” or “downloaded” state is not the same as a verified running version.
What readers should do now
- Open Chrome’s update page. In Chrome, select the three-dot menu, choose Help, then About Google Chrome. You can also enter
chrome://settings/helpin Chrome’s address bar. - Let the update complete, then relaunch. Save important work first. Use Chrome’s Relaunch button when offered. Reopen the About page afterward and confirm the displayed version meets or exceeds the fixed build for your operating system. Google says rollout occurs over days or weeks, so a system that has not yet received the build should be rechecked and managed through the organization’s approved deployment channel. [3]
- Close stale sessions on shared or managed systems. Confirm old Chrome processes are gone after relaunch. On managed fleets, verify the active executable version rather than relying only on a deployment success message.
- Check every Chromium browser separately. Use Edge’s, Opera’s or another vendor’s own About/security page and advisory. Do not paste Chrome’s build number into a policy for a different product.
- Keep normal browsing defenses in place. Avoid unexpected links and attachments, especially when they push urgency. That reduces exposure opportunities but is not a substitute for installing the vendor’s fix.
Upside, cautions and unknowns
Upside: Google has shipped a stable-channel correction, CISA has elevated the issue into a widely consumed prioritization catalog, and users can verify the running Chrome version without executing a scanner or proof of concept. [3] [2]
Caution: “Actively exploited” does not reveal how widespread exploitation is. It also does not prove a public exploit is available or that every Chromium browser is vulnerable in the same version range. CISA’s product-family warning and Google’s Chrome release must be kept separate.
Unknowns: The primary records reviewed by The IT Guys do not name an actor, victims, campaign size, delivery infrastructure or a separate sandbox-escape vulnerability. CISA records ransomware use as unknown. Google says bug details may remain restricted until most users have updated, which limits public technical detail while patching is underway. [1] [3]
| Question | What the evidence supports | What it does not establish |
|---|---|---|
| Exploitation | Google says an exploit exists in the wild; CISA added the CVE to KEV based on active-exploitation evidence. [3] [2] | Actor, victim count, attack scale or ransomware use. |
| Technical impact | Crafted HTML can enable arbitrary code execution inside the browser sandbox. [4] | A separately demonstrated sandbox escape or full host compromise. |
| Chrome remediation | Chrome desktop 152.0.7977.82/.83 on Windows/macOS and 152.0.7977.82 on Linux. [3] | Equivalent fixed-version numbers for Edge, Opera or other Chromium products. |
| Deadline | CISA’s KEV entry lists September 18, 2026. [1] | A universal legal deadline for every private user or business. |
Frequently asked questions
What do the official sources confirm?
Google confirms that an exploit for CVE-2026-85046 exists in the wild, and CISA confirms that the vulnerability is in its Known Exploited Vulnerabilities catalog. Those facts establish active exploitation and patch urgency without requiring a broader label about when exploitation began relative to patch availability. [3] [1]
Does updating Chrome automatically protect Edge or Opera?
No. Those are separate products with separate release channels. CISA’s record warns that Chromium-based browsers could be affected; users and administrators should consult each browser vendor’s current advisory and verify that product independently. [1]
Does this prove attackers can take over the whole computer?
No. The CVE and CISA descriptions support code execution inside the browser sandbox through crafted HTML. The reviewed primary sources do not establish a separate sandbox escape or full-system compromise. [4]
How do I know Chrome is actually updated?
After relaunching, revisit chrome://settings/help and compare the displayed version with Google’s fixed builds for your operating system. In a managed environment, also verify that no stale browser process remains and that the active executable—not merely the downloaded package—is current.
Sources
- CISA — Known Exploited Vulnerabilities Catalog JSON — catalog version 2026.09.04; CVE-2026-85046 added September 4, 2026, due September 18, 2026.
- CISA — “CISA Adds One Known Exploited Vulnerability to Catalog” — September 4, 2026.
- Chrome Releases — “Stable Channel Update for Desktop” — September 3, 2026.
- CVE Program — CVE-2026-85046 canonical record — published September 3, 2026; current record retrieved September 4.
Reporting cutoff: September 4, 2026, 4:53 p.m. EDT / 20:53 UTC. This daytime security alert covers one subject and was checked against The IT Guys’ public and nonpublic WordPress posts, recent subject ledger and prior handoffs. Hero: ORIGINAL EDITORIAL CONCEPT — NOT AN INCIDENT PHOTOGRAPH.