Google patches Chrome V8 zero-day CVE-2026-85046, exploited in the wild

Google moved the Chrome stable channel to 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, on 3 September 2026. The release carries 12 security fixes. One of them, CVE-2026-85046, is under active attack.

The advisory is blunt about it: Google states that an exploit for CVE-2026-85046 exists in the wild. It gives no attribution, no targeting detail and no indicators, which is standard practice while a fix is still reaching users. Google also notes that access to the bug report stays restricted until most users have updated.

The flaw was reported on 4 August 2026 by Salvatore Gulizia, who works under the handle Serotav and received a $1,000 bounty. Gulizia also reported a second bug fixed in the same release, CVE-2026-85053, an improper resource exposure issue in CacheStorage.

CVE-2026-85046 is a type confusion flaw in V8, the JavaScript and WebAssembly engine that Chrome uses to run every page it loads. Type confusion means the engine handles a chunk of memory as one kind of object when it holds another. In a JIT compiler that optimises aggressively on assumed object shapes, that mismatch turns into read and write access to memory the page should never touch.

The published CVE record puts the outcome plainly: a remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page, in Chrome builds before 152.0.7977.82. The class is CWE-843, access of a resource using an incompatible type.

One nuance matters for triage. Code execution inside the renderer sandbox is not full control of the machine. Turning it into host compromise normally needs a second bug to break out of the sandbox. That does not make this low risk, since credentials, session tokens and everything else in browser memory sit inside that boundary.

Google rates the issue High and publishes no CVSS score of its own. The 8.8 figure circulating in coverage comes from the CVE record's enrichment, not from Google.

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on 4 September 2026, one day after the patch, describing it as a Google Chromium V8 type confusion vulnerability and citing evidence of active exploitation.

One detail is worth getting right, because a lot of coverage still gets it wrong. CISA's alert cites Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, as the directive setting vulnerability management requirements for federal civilian agencies. Write-ups that reference BOD 22-01 for this listing are quoting a superseded directive. Reporting puts the federal remediation deadline at 18 September 2026.

Private-sector teams aren't bound by any of this, but the KEV listing is the useful signal. Fewer than one percent of published CVEs make the catalogue, and a listing means someone has confirmed real exploitation rather than modelled it.

V8 is part of Chromium, not of Chrome alone. Microsoft Edge, Brave, Opera and Vivaldi all ship the same engine, so each one carries CVE-2026-85046 until its maintainer pulls in Google's fix and publishes a build. Patching Chrome across a fleet and calling the job done leaves whatever else is installed exposed.

Firefox and Safari use different JavaScript engines, SpiderMonkey and JavaScriptCore, and are not affected by this particular flaw.

The less obvious exposure is embedded Chromium. Electron applications bundle their own Chromium build and stay on the vulnerable version until the app vendor ships an update, which is usually slower than a browser release. Any Electron app that loads remote web content is worth putting on the same list as the browsers.

Get Chrome to 152.0.7977.82 or later and make sure it has been restarted. The patched binary does not run until the browser process restarts, so a user who leaves 40 tabs open for a week stays exposed after the update downloads.

Don't rely on auto-update timing. Google's own wording is that the release rolls out over the coming days and weeks, in stages. On managed estates, push the version through your existing browser management channel and verify the installed build rather than assuming.

On Windows and macOS, either 152.0.7977.82 or .83 is patched. On Linux the fixed build is 152.0.7977.82. Check the actual version at chrome://settings/help, which also triggers an update check.

After Chrome, work through the rest: Edge, Brave, Opera, Vivaldi and any Electron application in your inventory, each against its own vendor's release notes. There are no published indicators of compromise for this campaign, so detection has to lean on browser version telemetry and post-exploitation behaviour rather than on hashes or domains.

The zero-day arrived with nine more high-severity fixes and two medium ones. Google credits its own internal teams and tooling for most of them, with three of the remaining high-severity bugs coming from outside researchers.

The high-severity set covers an out of bounds read in CrashReporting, incomplete cleanup in Network, a use after free in Compositing, a race condition in V8, an out of bounds write in WebGL, improper resource exposure in CacheStorage, use after free bugs in DevTools and Skia, and a second type confusion issue in Compositing. The two medium fixes are improper input validation in the Transactions Platform and use of a released resource in Mobile.

None of these carries an exploitation note. They matter because they ship in the same build: an organisation that patches for the zero-day picks up all 12, and one that delays keeps all 12 open.

CVE-2026-85046 is the sixth Chrome zero-day patched in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. Three of the six, counting this one, sat in V8.

That cadence is the planning input. A browser zero-day roughly every six weeks means the question for most teams isn't whether they can respond to this one, it's whether they can compress browser patching to days as a standing capability rather than as an incident each time.

Watch for the Chromium issue to open up once the rollout completes, which usually brings the first real technical detail, and for downstream vendor advisories from the other Chromium browsers.