CVE

CVE-2026-85046

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Exploitation IoCs 4

Domain coder-infra[.]com

IP 103[.]102[.]31[.]18

IP 82[.]192[.]72[.]4

IP 99[.]84[.]67[.]186

MITRE ATT&CK TTPs 9

T1027

Obfuscated Files or Information

Defense Evasion

T1059

Command and Scripting Interpreter

Execution

T1068

Exploitation for Privilege Escalation

Privilege Escalation

T1071

Application Layer Protocol

System Information Discovery

Ingress Tool Transfer

Source Articles

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Multiple active threats were reported this week, including a Chrome zero-day under active exploitation (CVE-2026-85046), which allows remote code execution via a crafted HTML page. MikroTik RouterOS devices are being targeted using an exploit chain called MikroTrick, combining CVE-2026-67276 and CVE-2026-86060 to achieve unauthenticated remote code execution. Unpatched Magento and Adobe Commerce stores are being compromised via a zero-day named StyleSmuggler, leading to backdoor installation. A supply chain attack on Coder's infrastructure delivered malicious Terraform modules that steal credentials. Additionally, the RevStealer information stealer is spreading via fake game cheats and a counterfeit Claude desktop app, using blockchain-based dead drops for resilience.

hacker-news Sep 7, 2026