Our automated tracking framework flagged that CISA added CVE-2026-85046 (Google Chromium V8) to the Known Exploited Vulnerabilities (KEV) catalog on September 6, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-85046 by September 18, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-85046 |
| Vendor / product | Google Chromium V8 |
| Vulnerability | Google Chromium V8 Type Confusion Vulnerability |
| CVSS base score | 8.8 |
| Added to KEV | September 4, 2026 |
| Days public before listing (NVD → KEV lag) | 1 |
| Federal patch deadline | September 18, 2026 |
| Known ransomware use | No |
How This Compares to Google’s Track Record
This one was public for just 1 days before CISA confirmed exploitation — faster than Google’s 7-day median, meaning attackers moved unusually quickly.
| Google in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 73 |
| Median lag (public → KEV listing) | 7 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1695 tracked KEV entries is 260 days — Google’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Google KEV Additions
The most recent Google vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-11645 | Chromium V8 | June 9, 2026 | 0 | No |
| CVE-2026-5281 | Dawn | April 1, 2026 | 0 | No |
| CVE-2026-3909 | Skia | March 13, 2026 | 0 | No |
| CVE-2026-3910 | Chromium V8 | March 13, 2026 | 0 | No |
| CVE-2026-2441 | Chromium | February 17, 2026 | 4 | No |
What This Means for Defenders
CISA has added CVE-2026-85046, a Google Chromium V8 vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 8.8, this vulnerability demands immediate attention from security teams. The federal patch deadline for this flaw is September 18, 2026, giving agencies just two weeks to apply necessary updates. Organizations using Chromium V8 should prioritize patching to mitigate potential compromise.
Its rapid addition to the KEV catalog, just one day after public disclosure, indicates active and widespread exploitation. This minimal NVD-to-KEV lag suggests attackers are moving quickly, leaving a very narrow window for detection and response. There’s no known ransomware use for CVE-2026-85046.
If patching isn’t feasible before the September 18 deadline, restrict browser access or isolate critical workflows. Enhance endpoint detection and response (EDR) monitoring for anomalous activity and enforce strict application whitelisting policies to minimize the attack surface until patches can be deployed.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
