Update: the exploited Chrome zero-day also hits every Electron app
The actively-exploited zero-day now reaches VS Code, Cursor and Slack; patch by Sept 18. Plus: OKF's git-native memory for coding agents.
Copy markdown
The delta: it's not just the browser
CVE-2026-85046 — the actively-exploited flaw Chrome patched Sept 4 in 152.0.7977.82 — rides in every Chromium-based Electron app, not just the browser. Any untrusted HTML your app renders can trigger code execution in the sandbox.
Your dev tools are the attack surface
Electron apps like VS Code, Cursor, and Slack all render untrusted content somewhere — a markdown preview, a pasted message, an email body. That's the daily-driver exposure the browser-only patch left open; a single crafted snippet is enough to rewrite files on disk.
Check process.versions.chrome, then patch
Electron shipped the fix on 2026-09-04+ — update apps built on it and verify with `process.versions.chrome`. Can't patch yet? Set `nodeIntegration: false` and `contextIsolation: true`, and audit every path that renders untrusted HTML or markdown.
The deadline: CISA says Sept 18
CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on Sept 4 and ordered federal agencies to patch by Sept 18 — a sane ceiling for everyone else. The exploit is confirmed in the wild; researcher Salvatore Gulizia first reported the flaw Aug 4.
Elsewhere: OKF ships git-native agent memory
OKF Agent Memory (MIT, pure Go) gives coding agents persistent memory stored in your git repo — no external database. It runs an embedded MCP server with sub-300µs BM25 search and claims 80% less token bloat. Install: `brew install okf-memory/tap/okf`.