Loading vulnerability…
CVE-2026-85046 is a type-confusion vulnerability in the V8 JavaScript engine affecting Google Chrome versions before 152.0.7977.82 and affected Chromium-derived browsers. When an array's element type changes during sorting, V8's optimizing compilers can generate code that treats a value as the wrong type. A remote attacker can trigger the flaw through a crafted HTML page, causing memory corruption and enabling arbitrary code execution inside the sandbox. BlueMoon exploits the confusion to discover object addresses, forge object pointers, and corrupt a Float64Array to obtain arbitrary read/write access within the V8 heap cage. The vulnerability has been actively exploited in espionage campaigns as the initial stage of a chain involving separate sandbox-escape and Windows privilege-escalation vulnerabilities.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This is a standalone eight-file Chrome exploit chain and Linux validation harness, not a framework module. stage1.js implements the CVE-2026-85046 V8 Float64Array corruption primitive, producing cage-relative 32-bit read/write and object-address primitives. poc.js builds custom WebAssembly modules, abuses exception handling/forged getters to extend the primitive, discovers renderer code aliases, and writes embedded x86-64 code that changes memory protections and patches memcpy GOT entries, reporting FULL_RW on success. retarget-loader.js dynamically fetches and instruments poc.js, then creates a sandboxed iframe targeting /STAGE2_C. After renderer-stage completion it enables a user-facing button. retarget-receiver.js receives the iframe message and assigns its source window to a mailto URI, attempting to carry/misattribute the user activation and invoke Evolution externally. run.py serves the stages on an ephemeral localhost port, launches specific vulnerable/fixed Chrome artifact versions via Selenium, monitors /proc and process activity for xdg-open/Evolution, and compares vulnerable versus fixed behavior. The payload is operational but heavily version-specific and uses hard-coded layout assumptions, addresses, native code, and external-handler expectations.
This three-file browser exploit repository contains a README, an HTML launcher, and a 5 KB JavaScript PoC. run.html loads an external CVE-2026-85046 exploit bootstrap followed by poc.js; the bootstrap is not included in this repository, so the provided PoC is a second-stage/chained exploit rather than a standalone reproduction. poc.js programmatically constructs two WebAssembly modules and relies on the external primitive for heap-address and V8-cage memory manipulation. The chain creates WebAssembly instances sharing an imported function table and tag, forges an exception-related getter by copying a private exception key, and repeatedly invokes a driver function to encourage optimization. The getter changes a table entry while optimized code assumes no relevant side effects. This preserves instance A's stale implicit metadata while dispatching to instance D. Instance D uses memory index 6, which the exploit asserts aliases instance A's executable Wasm jump-table/code region. The resulting arbitrary read/write wrappers (arwRead/arwWrite) alter compiled Wasm instructions. main() patches a compiled Wasm body to execute getpid, adjusts a displacement, and then runPayload() overwrites the same body with hard-coded Linux x86-64 code that performs write(1, "PWNED 2026\\n", 11). Success is shown in the page and console as RAW_NATIVE data. The README identifies CVE-2026-85046 and CVE-2026-87491 and claims the target is Chrome 152.0.7977.75. No remote network service, C2 host, IP address, or HTTP API is contacted by the exploit; execution is entirely local to a victim browser renderer.
This three-file browser proof-of-concept repository contains a README, the main exploit logic in poc.js, and a minimal run.html loader. It targets an alleged Chrome 152.0.7977.75 JavaScript-engine vulnerability tracked as CVE-2026-85046. The JavaScript warms up helper functions, then abuses Array.prototype.sort() with a comparator that mutates its input array. The intended primitive leaks a WebAssembly.Module wrapper pointer as an integer, stores that value in an array slot not tracked as an object reference, and permits the original cloned module wrapper to be reclaimed by major/minor garbage collection. The script allocates cloned replacement modules and checks whether one is reallocated at the exact leaked stale address. If so, holder[100] is treated as the replacement module and instantiated, despite originating from a stale pointer. The replacement WebAssembly payload imports env.print, logs a success string, and returns 0x2222. No remote network destinations, IP addresses, domains, registry keys, or external services are embedded; execution is entirely local in the browser context. This is a PoC rather than a weaponized exploit: it depends on an exact browser build, exposed GC, allocation/GC timing, and only demonstrates replacement-module execution and a JavaScript callback.
The repository contains one standalone HTML proof of concept, poc.html, with embedded JavaScript and a small user interface to launch the exploit and display diagnostic output. It targets a claimed V8 Maglev type-confusion condition in the Array.prototype.sort inlining path (TryReduceArrayPrototypeSort). The exploit trains optimized code using mixed PACKED_SMI and PACKED element kinds, uses a sort comparator to cause a receiver-map migration, and abuses insufficient post-sort map validation. It then derives addrof and fakeobj primitives, uses an unbarriered old-to-young reference plus minor-GC/spray reclamation to place a fake JSArray, and creates master/victim aliases for arbitrary reads and writes. Constants for V8 JSArray maps and the empty fixed array are hardcoded for Chromium 150.0.7871.181 on Debian Linux x64. The HTML detects the browser version from navigator.userAgent and may be triggered manually through a button or through its documented local auto-run mode. There are no exploit-network requests or callback endpoints; the four embedded HTTPS URLs are documentation/advisory links only. The implementation is an operational, build-specific browser memory-corruption PoC that demonstrates in-sandbox memory access, not a complete RCE chain.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
357 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Chrome V8 type-confusion vulnerability exploited by BlueMoon Exploit Kit as part of a chain that turns malicious website visits into Windows malware execution. The reported campaigns used spearphishing to direct victims to exploit pages.
A V8 type-confusion vulnerability exploited as the first stage of the BlueMoon exploit chain. Attackers obtain object addresses, create fake object pointers, and corrupt a Float64Array to read and write memory within the V8 heap cage. This enables the subsequent V8 sandbox escape. The content reports exploitation against stable browser releases available during the campaigns.
A high-severity V8 type-confusion vulnerability affecting Google Chrome and Chromium before version 152.0.7977.82. A crafted HTML page can trigger arbitrary code execution inside the browser sandbox; sandbox escape is not stated. The reference reports available exploits and a CISA Known Exploited Vulnerability remediation deadline of September 18, 2026. The CVSS v3 base score is 8.8.
A Chrome V8 JavaScript-engine type-confusion vulnerability reportedly used as part of a zero-day exploitation chain against targeted government, NGO, and public-policy organizations.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.