Active Exploitation of Multiple Zero-Days: Chromium V8 Patch

Source Material: NVD, Google Chrome Stable Channel Update, CISA KEV Catalog | Technology: Google Chrome and Chromium-based browsers using V8 | Targeted Industries: Opportunistic

Executive Summary

Google has confirmed active in-the-wild exploitation for two Chromium V8 zero-day vulnerabilities: CVE-2026-85046 (High severity type confusion) and CVE-2026-87491 (Medium severity out-of-bounds write).

Google has released Chrome 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux which remediates both vulnerabilities. Customers should treat vulnerable browser versions as exposed and prioritize update deployment, verification, and restart completion across managed and unmanaged endpoints.

Threat Overview and Strategic Impact

CVE-2026-85046 affects V8, the engine that executes JavaScript and WebAssembly in Chrome. NVD describes the issue as type confusion that can permit a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The attack requires a user to access attacker-controlled or compromised web content; no prior authentication is described.

The primary business risk is browser-based compromise of endpoints used for privileged access, sensitive web applications, and cloud administration. Successful exploitation may allow code execution in the renderer sandbox; further impact depends on additional sandbox-escape or post-exploitation activity. Browser isolation reduces, but does not eliminate, risk to session data, local files, credentials, and connected enterprise services.

Security Hardening and Recommendations

Update Chrome desktop to 153.0.8010.36/.37 or later; Confirm the browser has restarted into the fixed version.
Prioritize endpoints used by administrators, finance, identity, remote access, and other high-value workflows. Accelerate deployment through enterprise policy and verify actual installed versions rather than relying only on update compliance jobs.
Identify Chromium-based browsers separately. Edge, Brave, Opera, Vivaldi, and other Chromium products may ship the V8 fix on different schedules and version strings; apply the respective vendor updates as they become available.
Reduce exposure by enforcing browser security policies, limiting high-risk browsing from privileged workstations, and using application isolation or remote browsing where available. These are compensating controls, not substitutes for patching.
If a vulnerable endpoint shows suspicious browser crashes or post-browser process activity, preserve relevant telemetry, isolate the host as appropriate, and investigate for credential or session exposure.

Detection Strategy

No public indicators of compromise or complete exploit signatures have been released for CVE-2026-85046 or CVE-2026-87491. Detection should therefore combine exposure management with behavior-based monitoring. Track browser product, channel, and full version for every endpoint, alert on versions below the vendor-fixed build, and verify update completion after restart.

In endpoint telemetry, review browser crashes and renderer failures around visits to newly registered, low-reputation, or compromised sites. Investigate unusual child-process creation, script interpreters, unsigned binaries, or persistence activity immediately following browser activity. Correlate browser history, DNS, proxy, EDR, and identity-provider logs for the same user and device.

How Deepwatch Protects Our Customers

Deepwatch experts protect our customers by monitoring endpoint, network, and identity telemetry for suspicious activity. Security operations teams should use the advisory’s version criteria to validate remediation coverage and investigate anomalous browser-linked processes or network behavior.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.

Threat Hunting Leads

Hunting should focus on vulnerable browser versions first, followed by suspicious browser-to-process or browser-to-network sequences. Treat a crash alone as non-specific; confidence increases when it coincides with abnormal process creation, outbound connections, credential access, or use of privileged sessions. Avoid blocking legitimate JavaScript broadly as a primary mitigation.

Version Audit: Identify endpoints running Chrome versions prior to 152.0.7977.82 and track non-Chrome Chromium-based browsers (Edge, Brave, Opera) missing corresponding V8 patch updates.
Process Execution & Anomaly Isolation: Monitor browser process trees for abnormal post-browsing events, including unsigned binary executions, unexpected script interpreter launches (cmd.exe, powershell.exe, bash), or novel persistence mechanisms.
Telemetry Correlation: Correlate browser history and DNS/proxy logs with EDR alerts to identify suspicious visits to low-reputation domains immediately preceding renderer crashes or elevated process activity.
Credential & Session Exposure: Review active high-value user sessions (identity providers, cloud consoles, administrative tools) initiated from vulnerable or compromised endpoints for anomalous token usage or privilege escalations.

Technical Artifacts

Please visit the Guardian Platform to access the associated technical artifacts.

Threat Object Mapping

Intrusion Set:

Unknown/Unattributed

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Initial Access	Drive-by Compromise	T1189	Crafted HTML page triggers V8 type confusion