🚨 Chrome fixed an actively exploited V8 vulnerability — but updating employee laptops is only half the job.

🚨 Chrome 152 fixed an actively exploited V8 flaw. Your CI and headless browser runtimes may still be vulnerable.

CVE-2026-85046 is a high-severity V8 type confusion vulnerability affecting Chromium-based browser runtimes.

Google fixed it in:

Windows/macOS: Chrome 152.0.7977.82 or .83
Linux: Chrome 152.0.7977.82
CISA KEV deadline: September 18

For developers and engineering teams, the difficult part is inventory.

Chrome may also exist inside:

Playwright caches
Puppeteer caches
Docker/CI images
PDF services
Screenshot infrastructure
Crawlers
Kiosk applications
Embedded Chromium builds

npx playwright install --list
npx @puppeteer/browsers list --path ~/.cache/puppeteer

google-chrome --version

The vulnerability has a public technical write-up involving an optimized Array.prototype.sort path, but the disclosed V8 primitive should not automatically be interpreted as a complete host compromise. Renderer sandbox boundaries still matter.

The real remediation task is broader than updating Chrome on laptops:

Find → identify → update → verify every browser runtime.

Full analysis:
https://blog.invidelabs.com/chrome-cve-2026-85046-headless-runtimes/

CyberSecurity #DevSecOps #Chromium #Chrome #CVE #Playwright #CI