Chromium's newest RCE is already being used against people — and Google paid £790 for it

What’s actually confirmed

A sandbox-escape vulnerability, catalogued as CVE-2026-85046, affects Chromium — the open-source engine underpinning Google Chrome, Microsoft Edge, Brave, Opera and most other non-Firefox, non-Safari browsers. Google has already shipped a fix through its stable channel release, and — crucially — the flaw is being actively exploited in the wild, not just theorised about in a lab.

That’s the part worth taking seriously: this isn’t a “researcher found a clever trick” story. Real attacks using this bug were happening before the patch landed.

What a “sandbox RCE” actually means

Browsers run web page code inside a sandbox — a deliberately restricted, walled-off compartment designed so that even if a malicious website manages to run code, it can’t reach the rest of your computer. A “sandbox escape” leading to remote code execution (RCE) means an attacker can break out of that compartment entirely, potentially running arbitrary code on the machine simply because someone visited a booby-trapped page. That’s about as serious as browser bugs get, which is why it’s drawing attention well beyond the usual patch-notes crowd.

So who is actually at risk

Anyone running an unpatched Chromium-based browser is theoretically exposed, since the bug affects the underlying engine rather than one specific product. In practice, most mainstream browsers push security updates automatically, and Google has already released the fix — so the realistic risk window is narrow for anyone who keeps auto-updates switched on and restarts their browser occasionally. The people who should actually worry are those running outdated builds, locked-down corporate images that lag behind on patching, or niche Chromium forks that update slowly.

There’s no indication in the available reporting of mass, indiscriminate exploitation — the “actively exploited” language typically points to targeted attacks discovered by threat researchers, not a smash-and-grab against ordinary users. But the underlying mechanism — visit a page, get compromised — is exactly the kind of bug that matters for everyone, which is why it’s being flagged loudly.

The bit everyone’s actually arguing about

Ironically, the technical severity isn’t what’s generating the most discussion. On Hacker News, commenters have zeroed in on the fact that Google reportedly paid the reporting researcher around $1,000 (about £790) for flagging a critical, actively-exploited sandbox escape — a bounty some argue is wildly disproportionate to what such a bug would fetch on grey or black markets, where full working exploit chains for browser sandboxes can command six-figure sums. One commenter countered that a vulnerability already being exploited in the wild is arguably less valuable, since its “shelf life” as a secret weapon is effectively zero once it’s public and patched. It’s a genuinely unresolved debate rather than a settled fact, and worth reading with a sceptical eye either way — bounty economics are opinion, not verified fact.

What to do about it

Check that your browser is set to update automatically, and if you haven’t restarted it in a while, do so — updates don’t apply until the browser relaunches. Beyond that, there’s nothing exotic required: this is a routine “make sure you’re patched” situation dressed up in dramatic language, because the underlying bug genuinely is serious.

The sensible takeaway: the vulnerability is real and was exploited before disclosure, but Google has already fixed it, and normal update hygiene closes the door. The bounty argument is an interesting sideshow about how the industry values security research — not a reason to panic about your browsing history today.