Chrome Zero-Day CVE-2026-85046: V8 Flaw Exploited

The most-used browser on the planet is patching another hole that attackers found first. On September 3, 2026, Google shipped an emergency Chrome update to fix CVE-2026-85046, a type-confusion vulnerability in V8, the browser’s JavaScript and WebAssembly engine. Google confirmed that an exploit already existed in the wild — meaning attackers were using the flaw before the fix landed. It is the sixth actively exploited Chrome zero-day Google has patched in 2026, and because the bug lives in the open-source Chromium core, it reaches far beyond Chrome itself.

The vulnerability

CVE-2026-85046 carries a CVSS score of 8.8, in the “high” severity band just below critical. The flaw is a type confusion in V8 — a class of memory-safety bug that has become the single most productive hunting ground for browser exploit writers.

Type confusion happens when a program is tricked into treating a chunk of memory as one kind of object when it is actually another. In a JavaScript engine, that mismatch lets an attacker manipulate memory in ways the code never intended. In this case, crafted HTML or JavaScript content can cause V8 to mishandle the type of a memory object, giving an attacker arbitrary read and write access to the browser’s memory. From there, that read/write primitive can be turned into arbitrary code execution inside the browser’s sandbox.

The attack surface is what makes V8 bugs so dangerous: the vulnerable code runs automatically whenever the browser renders a web page. There is no download to open, no attachment to click. A victim simply has to visit a malicious or compromised website, and the exploit fires. That drive-by profile is why the zero-day category is prized by attackers and why browser makers treat V8 flaws as top-priority fixes.

What the fix does and doesn’t cover

Google has shipped the patch in the following stable-channel builds:

• Windows and macOS: Chrome 152.0.7977.82 and .83
• Linux: Chrome 152.0.7977.82

Users on those versions or later are protected. Chrome updates in the background and applies the fix on relaunch, so the single most effective action is to fully close and reopen the browser rather than leaving it running for days — a habit that quietly leaves many machines exposed well after a patch is available.

One important caveat on scope: code execution “inside the sandbox” is not the same as full control of the machine. Chrome’s renderer runs in a restricted sandbox designed to contain exactly this kind of compromise, so a working exploit for CVE-2026-85046 typically needs to be chained with a separate sandbox-escape bug to fully take over a device. That does not make it low-risk — sandbox escapes are routinely paired with renderer bugs in real-world attack chains, and a memory read/write primitive in the renderer is a powerful first stage — but it is the reason the flaw is rated high rather than critical.

Not just Chrome

Because Chrome is built on the open-source Chromium project, the vulnerable V8 code ships inside every Chromium-based browser. That means Microsoft Edge, Brave, Opera, and Vivaldi all inherit CVE-2026-85046 and need the same underlying fix, delivered through each vendor’s own update channel. Users of those browsers should not assume that patching Chrome, or leaving Chrome closed, protects them — the engine flaw travels with the browser they actually use.

This shared-code reality is a recurring theme in browser security: a single V8 bug becomes an industry-wide patch event overnight, and defenders have to account for the full family of Chromium derivatives, not just Google’s flagship.

Discovery, disclosure, and the exploitation timeline

The vulnerability was reported to Google on August 4, 2026 by security researcher Salvatore Gulizia, who works under the handle Serotav, and earned a $1,000 bug bounty for the disclosure — a modest sum for a bug that turned out to be exploitable in the wild, a reminder that bounty amounts are set before a flaw’s real-world impact is fully understood.

Google, per its standard practice, has withheld technical details and the identity of the attackers using the flaw. The company routinely restricts access to bug specifics “until a majority of users are updated with a fix,” a deliberate policy to keep working exploit details out of circulation while the patch propagates to billions of installs.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) moved quickly, adding CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalog on September 4, 2026. That listing sets a hard deadline of September 18, 2026 for U.S. Federal Civilian Executive Branch agencies to apply the update under Binding Operational Directive 22-01. The KEV catalog is federal policy on paper, but it functions as an industry-wide priority signal: inclusion is an authoritative confirmation that a flaw is being exploited and should be patched now, not at the next maintenance window.

A pattern, not an anomaly

CVE-2026-85046 is the sixth Chrome zero-day exploited in the wild and patched in 2026, and the tally reflects a durable trend rather than a bad month. Memory-safety bugs in V8 — type confusion chief among them — account for a large share of the browser zero-days that reach active exploitation, which is precisely why Google and other vendors have invested heavily in mitigations and in migrating security-sensitive code toward memory-safe languages over time.

For now, the engine remains a favored target. Browser flaws are attractive to sophisticated attackers because the browser is the one application nearly everyone runs, constantly, against untrusted content from across the internet. Each patched zero-day narrows one avenue; the cadence of new ones shows how many remain. The same dynamic plays out across the enterprise-software landscape, from the VMware vCenter flaw under mass exploitation to the Cisco firewall zero-day that defenders raced to close earlier this year — attackers reliably reach the software with the widest deployment first.

What it means

For individual users, the takeaway is simple and immediate: relaunch your browser today. An update that has downloaded but not been applied protects no one, and the gap between “patch available” and “patch installed” is exactly the window attackers count on. Anyone running Edge, Brave, Opera, or Vivaldi should update those browsers too, not just Chrome.

For enterprise defenders, the CISA KEV listing and the confirmed in-the-wild exploitation make this an emergency-patch item, not a routine one. The September 18 federal deadline is a useful benchmark for private-sector teams as well: any organization still running unpatched Chromium builds after that date is exposed to a flaw with public attention, active exploitation, and — given the number of public proof-of-concept efforts that typically follow a KEV listing — a widening pool of capable attackers.

The broader signal is about cadence. Six exploited Chrome zero-days into 2026, the pattern is unmistakable: the browser is a front line, V8 is its most-probed component, and the interval between disclosure and exploitation keeps compressing. The defensive playbook does not change — patch fast, keep browsers current, and treat “close and reopen” as a security control rather than an afterthought — but the frequency with which it must be executed is the real story. In a year defined by relentless exploitation of widely deployed software, CVE-2026-85046 is less a surprise than a scheduled reminder to keep the update mechanism, and the humans who ignore it, moving faster than the attackers.