Chrome Fixes Sixth Zero-Day of 2026: Active Attacks Target V8 Engine

Google has released a Chrome security update addressing 12 vulnerabilities, including a flaw already exploited in real-world attacks. The most urgent issue is CVE-2026-85046, a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.

The Stable desktop update was released on September 3, 2026. Google confirmed that a working exploit has been used “in the wild,” but did not describe the observed attacks or attribute them to a specific threat group.

CVE-2026-85046 is the sixth Chrome zero-day actively exploited in 2026. The vulnerability has a CVSS score of 8.8, with potentially high impacts on confidentiality, integrity, and availability.

Chrome Versions to Install

The fixed builds listed for the Chrome Stable channel are:

• Windows and macOS: 152.0.7977.82 or 152.0.7977.83;
• Linux: 152.0.7977.82.

The rollout is gradual, so the update may not reach all devices at the same time. Users and administrators should verify the version actually installed rather than assume that automatic updating has already been completed.

The exact vulnerable versions preceding the update have not been disclosed. The listed builds should therefore be treated as the operational target for supported systems.

The Chrome bulletin identifies the release as a Stable channel update for desktop. The builds and other available technical details were reported by SecurityAffairs, while Google’s publicly accessible advisory does not provide enough information to verify them independently.

After installation, users should confirm that the browser has completed the update. In corporate environments, administrators should centrally check the builds installed on Windows, macOS, and Linux, including remote or rarely used devices.

How Type Confusion Works in V8

The vulnerability affects V8, the component Chrome uses to process JavaScript and WebAssembly code. Exploitation can occur when a victim is induced to open an HTML page specially crafted by an attacker.

A type confusion occurs when the engine treats an in-memory structure as if it belonged to a type different from its actual type. In CVE-2026-85046, the anomalous behavior involves the maps associated with JavaScript arrays.

Technical analysis indicates that an array containing PACKED_ELEMENTS can improperly be assigned the PACKED_SMI_ELEMENTS map. The first category can contain references to objects, while the second is associated with small integers represented internally by V8. Confusing these structures undermines the assumptions used by the compiler to optimize data access.

The flaw was present in both V8 compilers involved in code optimization, Maglev and TurboFan. By manipulating the array’s state and the representations interpreted by the engine, an attacker can turn the error into arbitrary read and write primitives in the JavaScript heap.

These primitives are particularly dangerous because they allow an attacker to inspect or modify memory areas outside the page’s intended logic. The exploit can ultimately lead to arbitrary code execution within the Chrome sandboxed process.

The sandbox remains a separate security boundary. The available information does not clarify whether the attacks combined CVE-2026-85046 with a second vulnerability to escape the sandbox and compromise the operating system more broadly.

Simply Visiting a Crafted Page May Be Enough

The CVSS vector associated with the vulnerability is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The overall score is 8.8. The vector describes a network-based attack with low complexity that requires neither privileges nor prior authentication. User interaction is required, however—in this case, the user must process web content controlled by the attacker.

A malicious page could be reached directly, opened through a link, or loaded through content supplied by third parties. The methods used in real-world campaigns are not known.

Google has not disclosed the targeted organizations or users, geographic distribution, malware deployed, or infrastructure used by the attackers. No indicators of compromise, domains, hashes, or exploit-specific detection procedures are currently available.

Researcher Salvatore Gulizia, known online as Serotav, reported the flaw to Google on August 4, 2026. He received a $1,000 reward for the discovery.

No Workaround: Updating Is the Priority

No workaround, configuration change, or temporary mitigation specific to CVE-2026-85046 has been published. The required action is therefore to update Chrome to the fixed builds through the official channel.

Priority should be given to systems that:

• routinely browse external or untrusted websites;
• open links received through email or messaging platforms;
• process web applications and third-party content;
• use a browser to access corporate data, cloud services, or administrative panels.

Administrators should also identify devices where automatic updates are disabled, blocked by policy, or awaiting completion. In the absence of public indicators, detecting a potential compromise cannot rely on signatures specific to this exploit.

As of September 4, 2026, it is not known whether CVE-2026-85046 has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. No catalog inclusion date or federal remediation deadline is therefore available for this vulnerability.

The absence of confirmation in KEV does not change the central operational fact: Google is aware of active exploitation. This is not merely a laboratory proof of concept.

Six Zero-Days in Eight Months, Three of Them in V8

CVE-2026-85046 follows five Chrome vulnerabilities that were actively exploited and already added to CISA’s KEV catalog:

Vulnerability	Component and flaw	KEV inclusion	CISA deadline
CVE-2026-2441	Use-after-free in CSS	February 17, 2026	March 10, 2026
CVE-2026-3909	Out-of-bounds write in Skia	March 13, 2026	March 27, 2026
CVE-2026-3910	Improper implementation in V8	March 13, 2026	March 27, 2026
CVE-2026-5281	Use-after-free in Dawn/WebGPU	April 1, 2026	April 15, 2026
CVE-2026-11645	Out-of-bounds read and write in V8	June 9, 2026	June 23, 2026

All five have a CVSS score of 8.8 and share the same vector as CVE-2026-85046. For vulnerabilities listed in KEV, CISA requires organizations to apply the vendor’s mitigations, follow BOD 22-01 where applicable for cloud services, or discontinue use of the product if no mitigations are available.

With this latest case, three of the six zero-days directly affect V8: CVE-2026-3910, CVE-2026-11645, and CVE-2026-85046. This is significant from a risk-management perspective because the engine automatically processes code from visited pages and represents a remotely reachable attack surface.

The immediate response remains straightforward: verify the installed build, force the update where necessary, and confirm that deployment has been completed across the entire device fleet.