Actively Exploited Sandbox RCE Vulnerability in All Versions of Chromium

A vulnerability with the identifier CVE-2026-85046 has been registered in the US National Vulnerability Database (NVD). According to its description, it concerns remote code execution (RCE) with a sandbox escape that affects all versions of Chromium.

What makes it especially alarming is that the vulnerability is flagged as actively exploited — meaning attackers are already using it in practice rather than merely possessing a theoretical opportunity to attack. The process isolation mechanism (the sandbox) is one of the browser's key lines of defense: it is meant to prevent malicious code on a page from breaking out beyond the tab and reaching the system. Bypassing this mechanism in combination with remote code execution makes such a breach one of the most dangerous categories of problems for web browsers.

Since Chromium underpins not only Google Chrome but also a host of other browsers and applications — from Microsoft Edge to Electron programs — the potential blast radius is extremely wide. In such cases developers are usually advised to update to the fixed version as soon as possible, and users are urged not to put off installing browser updates.

The publication drew a noticeable response on Hacker News: the post gathered 124 points and 53 comments, reflecting the community's level of concern. As of this writing, a detailed technical description is absent from publicly available sources, so additional details — the exact affected builds, the nature of the exploitation, and the availability of a patch — should be verified directly in the NVD entry and in official security advisories.

Source: Hacker News