Evidence record / codex
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-codex-v8-sort-safety-backport-reaches-stable-code-mode
V8 sort safety backport reaches stable Code Mode. Codex upgrades V8 and backports CVE-2026-85046 sort guards. Comparator mutation could let optimized sort write objects into incompatible array storage. The CNA record describes arbitrary code execution inside Chrome’s sandbox through crafted HTML, published on 3 September 2026. That Chrome impact is not evidence of a Codex sandbox escape or exploitation; the October event is the Codex backport reaching stable.
Channel: tagged-release. Half: defect. Date: 2026-10-23.
Operator consequence: Include 0.164.0 in Code Mode runtime upgrade tests. An empty repository/npm advisory feed would have missed this dependency repair. Verify the runtime version actually serving embedded scripts; no exploit was run.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-v8-sort-safety-backport-reaches-stable-code-mode
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-codex-v8-sort-safety-backport-reaches-stable-code-modegithub.com/openai/codex/commit/6ae8b8aa7c608730d4315d59c5c081897ae02780tagged commit file2026-10-24-codex-v8-sort-safety-backport-reaches-stable-code-modeopenai/codex / patches/v8_array_sort_elements_kind.patchofficial docs2026-10-24-codex-v8-sort-safety-backport-reaches-stable-code-modecveawg.mitre.org/api/cve/CVE-2026-85046
Versioned source: run artifact