CISA adds Chrome vulnerability to known exploited catalog

CISA said Sept. 4 that it added one vulnerability to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The agency identified the issue as CVE-2026-85046, a Google Chromium V8 type confusion vulnerability.

CISA said it uses the catalog to flag flaws it considers to present real-world risk and that should be patched first. In its notice, the agency said this type of vulnerability is a frequent attack path for malicious cyber actors and poses significant risks to the federal enterprise.

The agency also repeated guidance under Binding Operational Directive 26-04, which it says applies to Federal Civilian Executive Branch agencies. The directive requires agencies to prioritize rapid remediation of high-risk vulnerabilities, especially CVEs listed in the KEV Catalog on publicly exposed assets that can give an attacker total control after exploitation.

The notice said the directive also sets expectations for when agencies must check whether threat actors compromised a system before the patch was applied. CISA said that step is part of the broader process for handling known exploited flaws.

CISA encourages all organizations to use risk-based vulnerability management and to prioritize remediation of KEV Catalog entries. The agency said it will keep adding vulnerabilities that meet its criteria.

According to CISA, a potential catalog addition must have a CVE ID, evidence of exploitation, and clear mitigation guidance. The agency did not say in the notice when CVE-2026-85046 was first exploited or how widely it had been used.

Sources

• CISA: CISA adds one known exploited vulnerability to catalog

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.