Actively exploited sandbox RCE in all Chromium versions
A newly disclosed Chrome/Chromium vulnerability (CVE-2026-85046) in the V8 JavaScript engine allows remote code execution inside the browser’s sandbox via a crafted web page, and is confirmed to be actively exploited in the wild. While the sandbox limits direct system compromise, commenters note it is a key step in common multi-bug exploit chains and highlights the risks of a browser monoculture and always-on JavaScript. The incident also reignites debate over Google’s relatively low bug bounty payout for this issue, and over the industry’s continued reliance on memory-unsafe languages for critical internet-facing software.
Nature of the vulnerability & sandbox model
- CVE-2026-85046 is a V8 type-confusion bug that allows arbitrary machine code execution inside Chromium’s renderer sandbox.
- Multiple comments clarify that this is not a sandbox escape: it gives full control of the renderer process, not the host OS.
- “RCE inside sandbox” is distinguished from “arbitrary JS”: native code can do invalid memory accesses, interact with IPC, and hit attack surface JS cannot, making it a key step in exploit chains.
- The sandbox itself relies on OS mechanisms (e.g., process isolation, syscall filtering); V8 also has its own heap sandbox, likely involved here.
Exploitability, impact & “actively exploited”
- Exploitation requires user interaction (visiting a crafted page), explaining the CVSS 8.8 score rather than 9.8–10.
- Several note that serious attacks typically chain this with a separate sandbox-escape bug; on its own it cannot access files, spawn processes, etc.
- Others stress that attackers commonly chain such bugs and that this CVE is in CISA’s Known Exploited Vulnerabilities catalog, so some real-world exploitation is confirmed, though details are undisclosed.
- There is debate over how “big a deal” this is: some see it as routine for modern browsers, others emphasize that it’s still an important foothold.
Browser ecosystem & configuration responses
- Affected Chrome versions are “up to (excluding) 152.0.7977.82”; fixes are now in stable Chrome and other Chromium-based browsers (Brave, Vivaldi, etc.).
- Some ask if hardened variants (e.g., with JIT disabled) are impacted in practice.
- Discussion touches on Chromium monoculture: any Chromium-based browser inherits these engine bugs; this motivates some to prefer non-Chromium engines (Firefox, WebKit, emerging Ladybird).
Bug bounty value & ethics
- Google reportedly paid $1,000 for the report; many see this as insultingly low for a high-impact sandbox RCE, given what grey/black markets might pay.
- Long subthread debates whether researchers should sell to brokers vs. report responsibly, and whether vendors should pay closer to “market value.”
- Some argue bounties are about incentivizing reporting, not outbidding criminals; others counter that underpayment will push talent toward underground markets.
Memory safety, JIT, and the JavaScript-heavy web
- Multiple comments connect this bug (type confusion → memory corruption) to the broader argument for memory-safe or type-safe languages and away from C/C++ in browser engines.
- JIT is criticized as a large and fragile attack surface; some disable it (or JS entirely), but note significant breakage and performance regressions on today’s web.
- Broader frustration about the necessity of running arbitrary JS/WASM for basic browsing appears, alongside nostalgia for simpler, more document-centric web usage.