Google Patches Actively Exploited Chrome V8 Zero-Day as Browser Attacks Hit Record Pace
Google shipped an emergency Chrome update on Thursday to close a high-severity zero-day vulnerability that hackers are already using in the wild — marking the sixth time this year the company has had to patch a browser flaw under active exploitation.
The flaw, tracked as CVE-2026-85046 and carrying a CVSS score of 8.8, is a type confusion bug buried inside V8, the JavaScript and WebAssembly engine that powers Chrome. A remote attacker could exploit it by luring a victim to a specially crafted HTML page, triggering code execution inside Chrome's sandboxed renderer process. In plain terms: visiting a booby-trapped website could let an attacker run malicious code on your machine without any further interaction.
"Google is aware that an exploit for CVE-2026-85046 exists in the wild," the company said in its advisory, without revealing who is behind the attacks or how the bug is being leveraged. That restraint is deliberate — Google typically holds back technical details until most users have patched, to avoid handing a blueprint to copycat attackers.
The update bumps Chrome to version 152.0.7977.82 on Linux and 152.0.7977.82/.83 on Windows and macOS, rolling out gradually. Users can force an immediate update by navigating to Settings > About Chrome and clicking Relaunch once the download completes.
How the Bug Works: A V8 Compiler Glitch With Real Consequences
The researcher credited with finding the flaw, Salvatore Gulizia — who goes by "Serotav" online — reported it to Google on August 4 and received a $1,000 bug bounty for the responsible disclosure. In a write-up published alongside the patch, Gulizia laid out the technical root cause.
The bug lives in V8's optimizing compilers. Under certain conditions, an internal data structure called a "map" — V8's way of tagging the type and shape of JavaScript objects — gets confused. An array originally tagged as PACKED_ELEMENTS (a sequence of general objects) receives the map for PACKED_SMI_ELEMENTS (a sequence of small integers). That mismatch lets an attacker trick V8 into reading or writing memory at arbitrary offsets on the JavaScript heap.
An attacker who can read and write memory at will on the heap can bypass Chrome's sandbox protections. Chrome's renderer process — which handles the web page you see — runs in a restricted environment by design. But the sandbox is only as strong as the code running inside it. If an attacker achieves arbitrary read/write on the heap, they can chain additional exploits to break out of the sandbox and execute code at the operating system level.
Type confusion bugs are particularly prized by attackers because they sit at the intersection of performance and security. V8's optimizing compilers are among the most aggressively JIT-compiled engines in existence — they transform interpreted JavaScript into native machine code in real time to make web pages load faster. Every such transformation introduces the risk that the compiler will make an incorrect assumption about data types, and those assumptions are where type confusion flaws emerge.
Google's decision to keep the exploitation details classified suggests the bug is either straightforward to weaponize or is being used in targeted campaigns. Both scenarios explain the urgency: a polished exploit for a V8 type confusion can generate reliable code execution with minimal interaction, and the barrier to entry is low once the technique is documented.
CISA Adds It to the KEV Catalog With a Two-Week Deadline
The U.S. Cybersecurity and Infrastructure Security Agency moved quickly to escalate the threat. On September 4, CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog, ordering Federal Civilian Executive Branch agencies to patch by September 18.
The KEV listing carries weight beyond the federal government. State and local agencies, private-sector security teams, and managed service providers all use KEV deadlines as baselines for their own patch cycles. A two-week window is standard for actively exploited browser flaws — long enough for large enterprises to test and deploy, short enough to close the exposure before attackers reverse-engineer the fix and build a new exploit.
Browser patches are among the fastest-deployed updates in enterprise IT. Chrome auto-updates silently, and most users never notice. But organizations that lock down browser versions for compatibility testing, or that use legacy deployments of Chromium-based browsers, face longer cycles. CISA's deadline signals that federal IT teams should not assume the auto-update will reach every endpoint in time.
The severity rating underscores why. A CVSS base score of 8.8 places this bug firmly in the high-severity range, one notch below critical. The score reflects high impact (full code execution), moderate attack complexity (requires a crafted page but no authentication), and zero user interaction beyond visiting a URL. For threat actors running watering-hole campaigns — compromising legitimate websites to redirect visitors to exploit servers — that combination is extremely attractive.
Six Zero-Days in 2026: A Record-Breaking Year for Chrome
CVE-2026-85046 isn't an outlier. It's the sixth actively exploited zero-day that Google has patched in Chrome since January 2026, putting this year on pace to exceed every previous year for in-the-wild browser vulnerabilities.
The five earlier zero-days were:
- CVE-2026-2441, patched in January
- CVE-2026-3909, patched in March
- CVE-2026-3910, patched in April
- CVE-2026-5281, patched in June
- CVE-2026-11645, patched in July
Each was a memory corruption flaw in a different part of the browser stack, from V8 to the graphics rendering pipeline to the PDF parser. The sheer volume suggests two things. First, the security research community is getting better at finding these bugs — more researchers with advanced fuzzing tools are attacking V8 and Chromium's surface area. Second, the demand for zero-days from commercial surveillance vendors and state-sponsored groups has not diminished. Google's Threat Analysis Group (TAG) and Project Zero have documented a thriving market for browser exploits, with prices reportedly reaching seven figures for reliable, unpatched code execution chains.
This year's pace also reflects a broader reality: browser engines are among the most complex software artifacts in existence. V8 alone contains over a million lines of C++ code, compiled through a pipeline that includes an interpreter, a baseline compiler (Sparkplug), and two optimizing compilers (Maglev and TurboFan). Each layer introduces the possibility of memory safety violations. Add Chromium's networking stack, rendering engine, and hundreds of extension APIs, and the attack surface becomes staggering.
The Update Also Patches 11 Other Vulnerabilities
The Chrome 152.0.7977.82 update does not stop at the zero-day. Google addressed a total of 12 vulnerabilities in this release, including nine additional high-severity bugs.
The other high-severity issues include use-after-free flaws in Crash Reporting, Network, Compositing, and WebGL, as well as out-of-bounds memory access in CacheStorage, DevTools, and Skia — Chrome's 2D graphics library. A race condition in V8 itself was also patched, adding to the zero-day as the second V8-related fix in this cycle.
Use-after-free bugs are the bread and butter of browser exploitation. They occur when the browser frees a block of memory but continues to hold a pointer to it. An attacker who allocates new data in the freed region can corrupt the object that the browser still references, redirecting execution flow. These flaws account for roughly a third of all Chrome zero-days in recent years and remain difficult to eliminate entirely because they stem from the fundamental tension between performance and memory management.
The WebGL fix is noteworthy because graphics rendering has become a frequent attack vector. WebGL exposes GPU acceleration to web pages, and the complexity of translating JavaScript commands into GPU driver calls has produced a steady stream of vulnerabilities. Google has invested heavily in sandboxing GPU access, but the translation layer between V8 and the GPU process remains a source of exploitable bugs.
What Chrome-Based Browser Users Need to Do
The patch is not limited to Google Chrome. Microsoft Edge, Brave, Opera, Vivaldi, and every other browser built on the Chromium codebase inherits the same vulnerabilities — and the same fixes, once each vendor integrates the upstream patch.
Microsoft typically ships Chromium updates within days of Google's release, and Brave and Opera follow similar timelines. But the lag between Google's patch and a third-party browser's update can be days or weeks. During that window, users of those browsers remain exposed.
The practical advice is simple: update now. Open your browser, go to the about page, and confirm you are running the latest version. If your browser has not received the fix yet, avoid visiting unfamiliar websites until it does — particularly sites that may have been compromised as part of a watering-hole campaign targeting the vulnerability.
For organizations, the CISA deadline should prompt an inventory check. Any managed Chromium deployment that pins a specific version or that uses a delayed update cycle needs manual intervention. The two-week window is already halfway elapsed.
A Pattern That Points to an Uncomfortable Reality
The sixth Chrome zero-day of 2026 fits a pattern that has been building for years: browser security is improving on the defensive side, but attackers are innovating faster. Google's investments in sandboxing, control-flow integrity, and memory-safe language adoption are real and measurable. Chromium's security architecture is arguably the most sophisticated of any browser. But the attack surface keeps growing as new features ship, and the researchers — both independent and state-sponsored — keep finding new bugs.
For now, the immediate task is patching. But the long-term question is whether the browser security model — a monolithic, multi-million-line C++ engine running untrusted code from every website on the internet — can keep pace with the threat. The answer will determine whether zero-days remain a manageable risk or become an insurmountable one.
For more on the latest threats, check the Cybersecurity section of this site. BleepingComputer first reported the flaw on September 4, 2026. The Hacker News provided additional technical context from the researcher's disclosure. Google's official advisory is mirrored by Help Net Security.