Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
Google released a critical security update for Chrome to address a zero-day vulnerability (CVE-2026-85046) that was actively being exploited. This vulnerability, stemming from a type confusion bug in V8, allowed attackers to execute arbitrary code within the browser's sandbox. Google is withholding details about the exploitation to encourage widespread patching and minimize further attacks.
Google released a security update for Chrome on Thursday to patch 12 vulnerabilities, including a high-severity zero-day. The vulnerability, identified as CVE-2026-85046 (CVSS score: 8.8), is a type confusion bug within V8, Chrome's JavaScript and WebAssembly engine. Security researcher Salvatore Gulizia (aka Serotav) discovered and reported the flaw on August 4, 2026, earning a $1,000 bug bounty for responsible disclosure. Gulizia described the issue as a V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, which can be turned into arbitrary read/write on the JavaScript heap. Google acknowledged that an exploit for CVE-2026-85046 exists in the wild, but refrained from providing details to prevent further exploitation and encourage users to update. This is the sixth actively exploited Chrome zero-day since the beginning of the year, alongside CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. To ensure users have the latest protections, Google recommends updating Chrome to version 152.0.7977.82/.83 for Windows and Apple macOS, and 152.0.7977.82 for Linux. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, should also apply the fixes as they become available.