CVE-2026-85046 + CVE-2026-87491 + CVE-2026-87606 + CVE-2026-87575

Talk about a giant pain to sneak a path out of the renderer.

550 mg of caffiene and going up and down chrome CVE's all night, you too can bounce out of the renderer.

• CVE-2026-85046 corrupts a Float64Array for V8-cage read/write.
• CVE-2026-87491 overwrites compiled Wasm and runs native renderer code.
• CVE-2026-87606 retargets a navigation to the sandboxed popup.
• The popup receives one real user click.
• CVE-2026-87575 misattributes that activation to the navigation.
• Chrome launches the existing Evolution mail handler outside the renderer.

Other notes:

• V8 has quite a bit of a shaky runtime and likes to move up and down
• The cage can info disclose itself at times because of the slide (Spectre style side watching via js)
• The renderer is the renderer once you pop out, standard stare around and look for jumps
• Just look for misaligned permissions and sort of just roll out depending on target

Chipset:

• PKU chips can increase the chance of runway and create RWX pages, otherise you'd have to modify the runway

python3 run.py vulnerable
python3 run.py fixed --attempts 1