On September 3, 2026, Google released an update to the stable Chrome channel for desktop platforms, addressing 12 vulnerabilities, including CVE-2026-85046 — a type confusion bug in the V8 engine with a CVSS 8.8 rating that is already being actively exploited by attackers. This is the sixth Google-confirmed Chrome zero-day vulnerability since the beginning of 2026. All users of Chrome and Chromium-based browsers must immediately update to version 152.0.7977.82 or later.
Technical details of the vulnerability
The CVE-2026-85046 vulnerability belongs to the type confusion class and affects V8, the JavaScript and WebAssembly engine used in Google Chrome. According to the entry in the GitHub Advisory Database, the flaw allows a remote attacker to execute arbitrary code inside the browser sandbox via a specially crafted HTML page.
The core issue lies in incorrect behavior of the V8 compilers: an array whose element type is PACKED_ELEMENTS is assigned a PACKED_SMI_ELEMENTS map, creating a mismatch between the array’s actual contents and its internal representation in the engine. This discrepancy enables arbitrary read and write access within the JavaScript heap — a classic primitive for further exploitation.
Affected versions and fixes:
- Windows and macOS: versions prior to 152.0.7977.82 are vulnerable; fixed in 152.0.7977.82/.83
- Linux: versions prior to 152.0.7977.82 are vulnerable; fixed in 152.0.7977.82
The vulnerability was discovered and reported by security researcher Salvatore Gulizia (also known as Serotav) on August 4, 2026. Google paid a $1,000 bounty for responsible disclosure. About 30 days passed between the researcher’s report and the release of the patch — a typical timeframe for high-severity vulnerabilities in Chrome.
The sixth Chrome zero-day in 2026
Including CVE-2026-85046, Google has now confirmed active exploitation of six zero-day vulnerabilities in Chrome in 2026. Each of the previous five was also rated high severity:
- CVE-2026-2441 — use-after-free in the CSS component (February 2026)
- CVE-2026-3910 — implementation bug in V8 (March 2026)
- CVE-2026-3909 — out-of-bounds write in Skia (March 2026)
- CVE-2026-5281 — use-after-free in Dawn (March 2026)
- CVE-2026-11645 — out-of-bounds memory access in V8 (June 2026)
Three of the six zero-days (CVE-2026-3910, CVE-2026-11645, and now CVE-2026-85046) are related to the V8 engine, underscoring its role as a primary attack surface. V8 processes all JavaScript code on web pages, and its JIT compilers are a complex optimization system in which typing errors arise at the intersection of interpretation and compilation.
Impact assessment
Google has confirmed the existence of an exploit for CVE-2026-85046 “in the wild” but has not disclosed any details of the attacks — no targeted sectors, geography, or attribution. The company limits access to vulnerability details until most users have installed the update.
Although code execution is confined to the Chrome sandbox, type confusion vulnerabilities in V8 have historically been used in exploit chains: first achieving code execution inside the sandbox, then using a separate vulnerability for a sandbox escape. The CVSS 8.8 score reflects a high level of severity and the possibility of exploitation without user interaction beyond visiting a malicious page.
Given Chrome’s share of the desktop browser market, the potential attack surface covers billions of devices. Users of Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi — are also at risk until their developers release corresponding updates.
Recommendations
The update should be applied immediately:
- Open Chrome and go to Menu → Help → About Google Chrome
- The browser will automatically check for updates and download version 152.0.7977.82 or later
- Click “Relaunch” to apply the update
- Make sure the displayed version is at least 152.0.7977.82
For enterprise environments with centralized browser management, it is recommended to forcibly distribute the update via Group Policy or configuration management systems instead of waiting for automatic updates. Users of other Chromium-based browsers should monitor the release of patches from their respective vendors and apply them as soon as they become available.
Six confirmed zero-days in the first eight months of 2026 — three of them in V8 — indicate a sustained interest by attackers in the JavaScript engine in Chrome. The only effective protective measure is to keep the browser up to date. Check the Chrome version on all work and personal devices and make sure build 152.0.7977.82 or newer is installed.
