Google patches a V8 type confusion already being exploited against Chrome users
Google says an exploit exists in the wild for CVE-2026-85046, a type confusion in Chrome's V8 engine, and it is the sixth Chrome zero-day the company has patched under active attack since January.
The Watch · Security desk
What happened
- Google shipped a Chrome security release covering 12 vulnerabilities, one of which it says is already being exploited in the wild.
- The exploited flaw is CVE-2026-85046, a high-severity type confusion in V8, Chrome's JavaScript and WebAssembly engine, rated CVSS 8.8.
- Per the CVE record, versions before 152.0.7977.82 let a remote attacker run arbitrary code inside the sandbox from a crafted HTML page.
Why it matters
- Who's exposed exposure Edge, Brave, Opera and Vivaldi users are told to apply fixes as they become available, which puts their exposure window on each vendor's rebuild schedule rather than on Google's release day.
- What it limits constraint With no vector or indicators published, there is nothing to hunt for in logs, and the only state a defender can measure across a fleet is the installed build number.
- Who has to decide decision Estates that let browsers run for weeks now have to choose between session continuity and closing a bug that has a working exploit behind it.
- What it sets up precedent A four-figure award on a V8 report that surfaced in live attacks is the public price the next researcher weighs when deciding where to send a heap read/write primitive.
Next story · Security · 2d ago
XBOW built a Windows Chrome exploit chain in six days with about $40,000 of AI computeConfirmed4 publishers
Gulizia's writeup gives the mechanism in one line: a compiler bug lets an array holding PACKED_ELEMENTS receive the map for PACKED_SMI_ELEMENTS, and the mismatch is turned into arbitrary read and write on the JavaScript heap [7]. The CVE record stops at arbitrary code execution inside the sandbox, delivered by a crafted HTML page [5]. Google acknowledged only that an exploit exists in the wild and withheld the attack details until most users are updated [2], so whether the live chain paired this bug with a sandbox escape is not public, and neither is who is running it.
Eleven of the twelve fixes in this release carry no public evidence of attack; the twelfth does [1][12]. A browser that has not been relaunched keeps running the old binary, and Google's own instruction ends at Relaunch after a check under More > Help > About Google Chrome [10]. The fixed builds are 152.0.7977.82 and .83 on Windows and macOS, and 152.0.7977.82 on Linux [8].
On the pattern: this is the sixth Chrome zero-day Google has fixed under active exploitation since the start of the year, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645 [4][11]. The material does not say which components the other five sat in, so a V8-specific rate is not something to read off this release.
Then the payment. Gulizia reported the bug on August 4, 2026 and was awarded $1,000 for the disclosure [6]. Two halves of that story need to stay apart. The report date is documented, but Google described none of the attacks, so the point at which exploitation began is not [2]. What the record does not say is whether an attacker found the same bug independently, whether the in-the-wild activity predates August 4, or whether Google revisited the award once it knew the bug was live. What is on the record is a four-figure payout attached to a V8 read/write primitive that someone was using against users, and researchers price their next disclosure off published numbers like that one.
What to watch
- Whether Google or a third party later names the delivery page, the targets, or the operator behind the in-the-wild exploit.
- How many days behind Chrome the Edge, Brave, Opera and Vivaldi rebuilds carrying the V8 fix land.
- Whether CVE-2026-85046 is added to CISA's known exploited vulnerabilities catalog with a federal remediation date.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption52
- Hype gap+8
- Incentives58
- Confidence74
Perspective Coverage
9 publishers- Builder
- Builder 25%
- Operator
- Operator 70%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google released security updates on Thursday patching 12 vulnerabilities in Chrome, including one that has come under active exploitation in the wild.
- [2]
Google acknowledged that an exploit for CVE-2026-85046 exists in the wild but did not reveal any details about the nature of the attacks, in order to let a majority of users update and to prevent further exploitation.
- [3]
The high-severity vulnerability is tracked as CVE-2026-85046, carries a CVSS score of 8.8, and is described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine.
- [4]
With this update Google has addressed a total of six actively exploited Chrome zero-days since the start of the year, the earlier ones being CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645.
- [5]
CVE.org describes the flaw as: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
- [6]
Security researcher Salvatore Gulizia (aka Serotav) is credited with discovering and reporting the flaw on August 4, 2026, and was awarded a bug bounty of $1,000 for responsible disclosure.
- [7]
In a separate blog post, Gulizia described the issue as a V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, which can be turned into arbitrary read/write on the JavaScript heap.
- [8]
Users are advised to update to Chrome 152.0.7977.82/.83 for Windows and Apple macOS, and 152.0.7977.82 for Linux.
- [9]
Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera and Vivaldi, are advised to apply the fixes as and when they become available.
- [10]
To confirm the update is installed, users can navigate to More > Help > About Google Chrome and select Relaunch.
- [11]
The five previously listed exploited Chrome CVEs plus CVE-2026-85046 account for the stated year-to-date total of six actively exploited Chrome zero-days.
- [12]
Eleven of the twelve vulnerabilities fixed in this Chrome release have no publicly reported exploitation.
Sources
9 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comGoogle warns of new Chrome zero-day flaw exploited in attacks
2 articles · September 4, 2026
- cisa.govCISA Adds One Known Exploited Vulnerability to Catalog
1 article · September 4, 2026
- CISA KEV catalog — Cyber Trackr
cyber.trackr.live
1 article · September 6, 2026
- cyberinsider.comGoogle fixes actively exploited Chrome V8 zero-day vulnerability
1 article · September 4, 2026
- esecurityplanet.comGoogle’s Chrome Update Patches Sixth Zero-Day Exploited in 2026
1 article · September 4, 2026
- helpnetsecurity.comGoogle patches actively exploited Chrome zero-day (CVE-2026-85046)
2 articles · September 4, 2026
- securityaffairs.comGoogle fixes the sixth actively exploited Chrome zero-day of 2026
2 articles · September 4, 2026
- securityweek.comGoogle Patches 6th Chrome Zero-Day of 2026
2 articles · September 4, 2026
- thehackernews.comGoogle Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
2 articles · September 4, 2026