CVE-2026-85046 is a type-confusion vulnerability in the Google Chrome V8 JavaScript engine, used as the first stage of a multi-stage browser exploit chain by Chinese-linked espionage groups. Reported to the Chromium project on 4 August 2026 and fixed upstream, the bug was exploited as a zero-day against Chrome users during a four-week "patch gap" in which the Chromium source fix had not yet reached a released Chrome version. The exploit gains arbitrary read/write within the V8 sandbox, then chains a WebAssembly sandbox-escape flaw (CVE-2026-87491) and a Windows kernel vulnerability (CVE-2026-85880) to escape the browser's sandboxed renderer and inject code into the Chrome process.
The exploit kit, dubbed "BlueMoon" and used by UTA0560, JungleBamboo (APT31/Violet Typhoon) and four other suspected China-linked clusters, was deployed against US defence contractors, NGOs, mining firms and Southeast Asian government agencies starting 1 September 2026. Google has since moved Chrome to a two-week release cycle to shorten the patch gap.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-85046 |
| Type | Type confusion (V8 memory corruption) |
| Exploited | In the wild (Chrome zero-day, Aug–Sep 2026) |
| Chain | CVE-2026-85046 + CVE-2026-87491 + CVE-2026-85880 |
| Affected | Google Chrome (fixed in upstream Chromium; Chrome stable lagged) |
| Source | Volexity / Proofpoint — Tier 1/4 |