## https://sploitus.com/exploit?id=14859BF6-CABE-54BE-AF18-C2152F60F38B
# CVE-2026-85046 + CVE-2026-87491 + CVE-2026-87606 + CVE-2026-87575
Talk about a giant pain to sneak a path out of the renderer.
550 mg of caffiene and going up and down chrome CVE's all night, you too can bounce out of the renderer.
- CVE-2026-85046 corrupts a `Float64Array` for V8-cage read/write.
- CVE-2026-87491 overwrites compiled Wasm and runs native renderer code.
- CVE-2026-87606 retargets a navigation to the sandboxed popup.
- The popup receives one real user click.
- CVE-2026-87575 misattributes that activation to the navigation.
- Chrome launches the existing Evolution mail handler outside the renderer.
Other notes:
- V8 has quite a bit of a shaky runtime and likes to move up and down
- The cage can info disclose itself at times because of the slide (Spectre style side watching via js)
- The renderer is the renderer once you pop out, standard stare around and look for jumps
- Just look for misaligned permissions and sort of just roll out depending on target
Chipset:
- PKU chips can increase the chance of runway and create RWX pages, otherise you'd have to modify the runway
```text
python3 run.py vulnerable
python3 run.py fixed --attempts 1
```