This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with

Right and in recent memory Google actually awarded a renderer sandbox escape with $250k [0]. Now you can see actually how serious this is.

[0]: https://news.ycombinator.com/item?id=44861106

If it’s being exploited “in the wild”, it means someone has already found how to chain it, otherwise what would be the point?

Right but this actually hasn’t happened…

"Google is aware that an exploit for CVE-2026-85046 exists in the wild."

I'm curious now, how is it being actively exploited? Unless there is already some other exploit with which it's currently being chained?

there are many vulns that are sitting idle waiting to be chained like this. plus in some cases adjacent bugs can be found once you find a bug like this.