Skip to content
Hermes Codex

CVE-2026-85046: Google Chromium V8 Maglev/TurboFan Type Confusion Zero-Day

HTS

HERMES THREAT SCORE & OPERATIONAL EXPLOITABILITY

Target: Google Chrome & Chromium V8 Engine (Windows, macOS, Linux)
Confidence: 99%
95 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 15 / 20
Exposure 15 / 20
Prevalence 15 / 20
Impact 10 / 20
⚖️ Divergence & Operational Rationale

Elevated to 95 EXTREME by Hermes due to confirmed in-the-wild zero-day exploitation, CISA KEV listing (September 4, 2026), and weaponized watering-hole capability targeting enterprise browser endpoints.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-85046: Google Chromium V8 Maglev/TurboFan Type Confusion Zero-DayVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTGoogle Chromium / V8 Engine
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Google Chromium / V8 Engine documented in Hermes dossier.”

Supporting Verified Evidence:

Root Cause Analysis

Section titled “Root Cause Analysis”

In high-performance JavaScript engines like V8, execution speed depends on speculative optimization. To avoid boxing overhead, V8 represents internal objects through hidden classes known as Maps (v8::internal::Map) and divides JavaScript array storage into specialized element kinds:

Elements KindIn-Memory RepresentationPointer Tagging State
PACKED_SMI_ELEMENTSDense unboxed 31-bit small integersShifted integer (value << 1, lowest bit 0)
PACKED_DOUBLE_ELEMENTSDense raw 64-bit IEEE-754 floating pointsRaw binary IEEE-754 in raw backing store
PACKED_ELEMENTSDense boxed references to JS objects, strings, symbolsCompressed 32-bit pointers with lowest bit 1
V8 JavaScript Heap Layout & Elements Transition Defect:


   Standard JIT Speculation Flow:
   [JavaScript Array Created: [1, 2, 3]] ──► ElementsKind: PACKED_SMI_ELEMENTS
                 │
   Array Modification: arr[0] = {} ──────► Transition to: PACKED_ELEMENTS (Boxed Pointers)
                 │
   JIT Compiler Loop Invariant Invalidation:
   ┌────────────────────────────────────────────────────────────────────────┐
   │ Maglev / TurboFan Phase: In-place Map Check & Representation Redundancy│
   │                                                                        │
   │   Compiler assumes loop invariance of Map based on deopt guards:       │
   │   [INCORRECT MAP TRANSITION COLLAPSE]                                  │
   │   Array retains backing store with Boxed Pointers (HeapObject)         │
   │   BUT Compiler assigns Map: PACKED_SMI_ELEMENTS                        │
   └────────────────────────────────────────────────────────────────────────┘
                 │
                 ▼
   [CRITICAL TYPE CONFUSION (CWE-843)]
   Engine treats Raw Pointer Address as a Small Integer (Smi)
   Engine treats User-Controlled Integer as a Pointer Address

The Map Mismatch Bug in Maglev & TurboFan

Section titled “The Map Mismatch Bug in Maglev & TurboFan”

During aggressive loop-peeling and loop-invariant hoisting in V8’s Maglev (mid-tier) and TurboFan (optimizing backend), the compiler tracks the ElementsKind of arrays passed to optimized loops.

When an array transitions from storing pure integers to storing objects or functions, the runtime invokes JSObject::TransitionElementsKind(). However, under specific deoptimization-bailout pathways combined with custom prototype getters (Object.prototype.__defineGetter__), the JIT compiler failed to emit the required CheckMaps operator before inlined element stores.

As a result:

  1. The compiler hoisted an element load or store under the static assumption that the array remained PACKED_SMI_ELEMENTS.
  2. A side-effecting callback altered the array’s backing store to PACKED_ELEMENTS.
  3. The generated machine code continued to read and write elements using direct, unboxed Smi arithmetic without dynamic map verification.

Because V8 uses pointer tagging (where small integers have their least significant bit set to 0, while heap pointers have bit 0 = 1), treating a pointer as a Smi allows an attacker to leak the exact 32-bit compressed heap address of any JavaScript object. Conversely, writing a calculated integer into the array allows an attacker to fabricate a valid pointer, establishing the two fundamental exploit primitives: addrof and fakeobj.

Exploit Mechanics & Heap Primitives

Section titled “Exploit Mechanics & Heap Primitives”

Exploitation of CVE-2026-85046 requires enticing a target user to visit a maliciously crafted HTML page. The exploit chain operates entirely within the JavaScript environment of the browser’s tab process:

1. Triggering the Map Confusion

Section titled “1. Triggering the Map Confusion”

The attacker defines an array intended to trigger Maglev/TurboFan compilation through repeated execution in a hot loop:

// Conceptual trigger pattern (JIT optimization loop)
function trigger_confusion(arr, val) {
    arr[0] = val;
    return arr[0];
}


// Warm up JIT optimization for PACKED_SMI_ELEMENTS
for (let i = 0; i < 20000; i++) {
    let smis = [1, 2, 3, 4];
    trigger_confusion(smis, 42);
}


// Exploit trigger: pass an object to an array whose map check was elided
let target_arr = [1, 2, 3, 4];
let victim_obj = { leak_me: 0x1337 };


// Triggering the un-guarded side-effect
trigger_confusion(target_arr, victim_obj);

2. Crafting the addrof Primitive

Section titled “2. Crafting the addrof Primitive”

By reading an object reference through an array that V8 believes holds Smis, the raw heap pointer of victim_obj is returned to JavaScript space shifted by 1 bit, bypassing V8’s Compressed Pointer ASLR:

function addrof(obj) {
    confused_arr[0] = obj;
    // Read out the raw pointer address as if it were a small integer
    let tagged_ptr = confused_arr[0];
    return tagged_ptr >> 1; // Unshift Smi tag to yield absolute 32-bit heap offset
}

3. Crafting the fakeobj Primitive

Section titled “3. Crafting the fakeobj Primitive”

By writing a forged integer value into a second array that V8 believes holds objects, the engine dereferences the attacker’s arbitrary integer as an active heap pointer:

function fakeobj(addr) {
    // Inject the raw integer address tagged with bit 0 = 1 (HeapObject tag)
    confused_arr_obj[0] = (addr << 1) | 1;
    return confused_arr_obj[0]; // Returns reference to forged JavaScript object
}

4. Arbitrary Memory Read/Write via Fake Float64Array

Section titled “4. Arbitrary Memory Read/Write via Fake Float64Array”

With addrof and fakeobj, the attacker constructs a fake Float64Array whose external_pointer points to arbitrary process memory:

  1. Create a template object containing float properties.
  2. Leak its address via addrof().
  3. Construct a fake ArrayBuffer structure pointing its backing store to arbitrary process memory (e.g., the WebAssembly rwx page or Chrome renderer function tables).
  4. Modify memory bytes at will to inject shellcode, achieving arbitrary code execution inside the renderer process.

5. Sandbox Escape Chaining

Section titled “5. Sandbox Escape Chaining”

Because Chromium enforces multi-process site isolation and an OS-level sandbox (AppContainer on Windows, seccomp-bpf on Linux), weaponized threat actors chain CVE-2026-85046 with a separate Chromium Sandbox Escape or Windows Kernel Local Privilege Escalation (e.g., Win32k privilege escalation) to escape the browser process and establish persistent root/SYSTEM access.

Forensic Markers & DFIR Analysis

Section titled “Forensic Markers & DFIR Analysis”

Digital Forensics and Incident Response (DFIR) teams triaging suspected browser compromise should look for the following endpoint and network telemetry:

1. Process Lineage & Behavioral Anomalies

Section titled “1. Process Lineage & Behavioral Anomalies”

The primary indicator of successful V8 exploitation is the abnormal execution of operating system shells or utilities directly spawned by the unprivileged browser renderer process:

  • Windows: chrome.exe (running with --type=renderer flag) spawning cmd.exe, powershell.exe, wscript.exe, certutil.exe, or rundll32.exe.
  • Linux: chrome or chromium-browser sandbox workers spawning /bin/sh, /bin/bash, or unexpected outbound socket connections.
  • macOS: Google Chrome helper processes spawning /bin/zsh, curl, or osascript.
Normal Lineage:
[explorer.exe] ──► [chrome.exe (Browser Parent)] ──► [chrome.exe (--type=renderer)]


Exploited Lineage (Sandbox Escape / Process Injection):
[chrome.exe (--type=renderer)]
       │
       ├─► [svchost.exe (Injected Thread / Process Hollowing)]
       └─► [cmd.exe /c powershell.exe -enc <Base64 Payload>]

2. Memory Forensics & Crash Dump Artifacts

Section titled “2. Memory Forensics & Crash Dump Artifacts”

Inspect Google Chrome crash dumps (.dmp) stored in:

  • C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Crashpad\reports\
  • Exceptions indicating STATUS_ACCESS_VIOLATION (0xC0000005) at V8 JIT addresses within the range 0x00007ff* or within Chrome’s compressed pointer heap boundary (v8::internal::Isolate).
  • V8 Heap analysis showing corrupted Map pointers pointing to invalid addresses or mismatched element kinds.

3. Network & Threat Intelligence Indicators

Section titled “3. Network & Threat Intelligence Indicators”
  • Navigation history in User Data\Default\History indicating visits to compromised websites hosting obfuscated JavaScript right before renderer crashes.
  • Heavy use of JavaScript obfuscation featuring massive array allocations (new Array(0x10000)), repeated eval(), and WebAssembly module compilation (WebAssembly.Instance).

Detection Rules

Section titled “Detection Rules”
title: Chrome Renderer Spawning Anomalous Shell or Command Interpreter (CVE-2026-85046)
id: f98a72b1-4089-4e2b-b850-460000085046
status: experimental
description: Detects child process creation originating from a Google Chrome or Chromium-based renderer process, indicative of browser exploitation such as CVE-2026-85046.
references:
  - https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Hermes Codex DFIR Intelligence
date: 2026-09-08
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
    ParentCommandLine|contains: '--type=renderer'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare custom enterprise web development automation tools (verify process parameters).
level: critical
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059.001
  - cve.2026.85046

Mitigation & Patching Matrix

Section titled “Mitigation & Patching Matrix”

1. Vendor Security Patches

Section titled “1. Vendor Security Patches”

Organizations must upgrade all Chromium installations to the specified patched versions immediately:

Browser ProductPlatformPatched Release Version
Google ChromeWindows / macOS152.0.7977.82 or 152.0.7977.83
Google ChromeLinux152.0.7977.82
Microsoft EdgeWindows / macOS / Linux152.0.3540.84 or higher
Brave BrowserAll PlatformsRelease 1.82.164 (Chromium 152.0.7977.82)
OperaAll PlatformsRelease 118.0.5432.48 or higher

2. Enterprise Defensive Hardening

Section titled “2. Enterprise Defensive Hardening”
  • Enable Chrome Strict Site Isolation: Ensure --site-per-process is enforced across GPO / MDM policies to prevent cross-site memory leaks across tabs.
  • Enable V8 V8Sandbox: Verify that Chromium’s in-process V8 Sandbox (--enable-v8-sandbox) is active, which limits out-of-bounds heap corruptions from easily dereferencing raw operating system pointers.
  • Endpoint EDR Monitoring: Ensure Endpoint Detection and Response (EDR) sensors actively alert on non-standard child processes of browser renderers.

Sources & Technical References

Section titled “Sources & Technical References”