Editorial note: Today’s picks split the difference between urgent security hygiene and delightful hardware tinkering. One story is a live, exploited browser bug that deserves an immediate update; the other is a compact, fully open FPGA that lowers the barrier to RISC‑V tinkering.
In Brief
Actively exploited sandbox RCE in all Chromium versions
Why this matters now: CVE-2026-85046 is an actively exploited V8 type‑confusion bug in Chromium’s JavaScript engine that lets attackers execute code inside the browser sandbox — update Chrome, Edge, Brave, Opera and other Chromium-based browsers immediately.
Google released emergency patches in Chrome 152.0.7977.82/.83 to fix a V8 "type confusion" flaw tracked as CVE-2026-85046, and said it is "aware that an exploit for CVE-2026-85046 exists in the wild." Because V8 is shared across Chromium forks, the fix is broadly required; the NVD lists the vulnerability as a sandboxed remote code execution with a CVSS of 8.8. Security practitioners on Hacker News pointed out the recurring pattern — this is the sixth Chrome zero‑day patched in 2026 — and debated whether CVSS adequately reflects the real‑world risk when exploitation is already happening.
"Google is aware that an exploit for CVE-2026-85046 exists in the wild."
Fomu — An FPGA board that fits inside your USB port
Why this matters now: Fomu is a palm‑sized, fully open FPGA with a RISC‑V softcore that plugs into a USB‑A port, making FPGA and RISC‑V experiments dramatically easier and more accessible right away.
Fomu ships with an ICE40UP5K FPGA, RGB LED, SPI flash and 128 KB of RAM and runs a RISC‑V softcore under a Python interpreter by default — but you can load any firmware you want. The project emphasizes an open toolchain (Yosys, IceStorm, nextpnr), avoiding vendor lock‑in and proprietary installers; it’s aimed at hobbyists, educators and anyone who wants a low-friction way to play with FPGA logic and RISC‑V cores. Community reactions range from practical use ideas (USB cable testing, softcore swaps) to simple appreciation that tiny, open hardware keeps getting better.
"Fomu is the easiest way to get started with FPGA or RISC‑V development."
(See the Fomu project page for specs, toolchain notes, and how to order.)
Deep Dive
Actively exploited sandbox RCE in all Chromium versions
Why this matters now: CVE-2026-85046 targets V8 in Chromium engines and is being exploited in the wild; any unpatched Chromium-based browser used for web browsing could be the initial foothold for a larger compromise.
This is one of those bugs you want fixed before you encounter it. The vulnerability is described as a V8 "type confusion" that allowed a remote attacker to run arbitrary code inside the sandbox via a crafted HTML page; Google pushed the patch quickly in Chrome 152.0.7977.82/.83 and is withholding technical exploit details for the moment, a common practice when exploitation is active. The practical implication is that a malicious web page could gain code execution within the browser process — a powerful position that can be chained with a separate sandbox escape to take over a system.
The speed and frequency of Chrome zero‑days this year matters. This is the sixth zero‑day fixed in 2026, which raises two operational flags: first, browsers remain high‑value targets for attackers, and second, defenders should assume exploits will appear before full technical disclosure. One community reaction captured that tension: "Only a score of 8.8?" — a pointed remark about how CVSS numbers sometimes underplay active exploitation scenarios. The takeaway is straightforward: CVSS is a useful metric, but an active exploit raises the real‑world urgency beyond any single numeric score.
Practical steps you can take now:
- Update any Chromium‑based browser immediately to the patched release listed in the vendor advisory.
- If patching isn't possible right away, reduce exposure: avoid untrusted sites, disable JavaScript selectively (or use script‑blocking extensions), and consider using a separate browser profile or virtual machine for risky browsing.
- Watch for follow‑up technical writeups and indicators of compromise; once researchers reverse‑engineer the exploit, more defensive telemetry and hunting rules will likely appear.
Google’s decision to delay technical disclosure is intended to keep the exploit out of wide circulation while users update. That buys time, but only if users actually install the update. Given that many enterprises lag on browser upgrades, the risk window can remain long — another reason to prioritize browser patching in your next maintenance cycle. For those running Chromium builds with long lifecycle policies (enterprise distributions), coordinate with your vendor’s security channel to get the patched binaries as soon as possible.
"Only a score of 8.8?" — Hacker News commenter, reflecting a common debate about CVSS versus active exploitation urgency.
Closing Thought
Security and curiosity took center stage today: one story is an immediate checklist item — patch browsers now — and the other is a reminder that open hardware keeps lowering barriers for learning and experimentation. Both are about control: control of risk, and control of platforms you can shape and understand.