Google has patched a Chrome vulnerability that attackers were already exploiting by the time the company found it, the latest in a string of zero-days affecting the world's most widely used web browser. The flaw, tracked as CVE-2026-85046, was fixed in a stable-channel update Google shipped Sept. 3.
The bug is a type-confusion flaw in V8, the JavaScript and WebAssembly engine at the core of Chrome and every Chromium-based browser, and carries a severity score of 8.8 out of 10. A malicious webpage could exploit it to corrupt memory and run arbitrary code inside Chrome's sandboxed renderer process — the kind of foothold that, paired with a separate sandbox-escape bug, can lead to a full device compromise. In its release notes, Google said it was "aware that an exploit for CVE-2026-85046 exists in the wild," though it withheld technical details of the attacks to give users time to update.
The vulnerability was reported to Google on Aug. 4 by security researcher Salvatore Gulizia, who publishes under the handle "Serotav" and received a $1,000 bug bounty for the disclosure. Gulizia's writeup, summarized by The Hacker News, describes a bug that lets an array meant to hold one type of data receive the wrong internal type — a mix-up that can be turned into arbitrary read-and-write access on the JavaScript heap.
A Familiar Pattern
CVE-2026-85046 is the sixth actively exploited Chrome zero-day Google has patched in 2026, following earlier flaws in V8 itself, the Skia graphics library and the WebGPU implementation known as Dawn. The pace, noted by Bleeping Computer, underscores how often attackers now probe Chrome's rendering and scripting engines for entry points, since a single working exploit can potentially reach billions of installations across Windows, macOS and Linux.
The U.S. Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until Sept. 18 to apply the patch. Google's fix is rolling out gradually to the stable channel in versions 152.0.7977.82 and .83 for Windows and macOS, and 152.0.7977.82 for Linux; users who don't want to wait can force the update immediately from Chrome's settings menu.
