Google has patched an actively exploited zero-day vulnerability in Chrome’s V8 JavaScript engine, the sixth such bug the company has fixed this year. The flaw, tracked as CVE-2026-85046, is a type confusion issue reported by researcher Salvatore Gulizia, who works under the handle Serotav.
The emergency update brings Chrome to version 152.0.7977.82/.83 on Windows and macOS, and 152.0.7977.82 on Linux, in a gradual rollout. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the company’s advisory reads. Google withheld technical details, standard practice for exploited flaws, to give users time to update before attackers can reverse-engineer the patch.
Type confusion bugs let software misread one kind of object as another, corrupting memory in ways attackers can steer. V8 is the engine that compiles and runs the JavaScript on every website a user visits. A crafted page with malicious JavaScript could trigger this flaw and potentially execute code inside Chrome’s sandboxed renderer process. The sandbox limits the blast radius, but renderer code execution is a standard first stage in real attack chains, typically followed by a second exploit to escape the sandbox entirely.
Gulizia has a track record with the engine. His prior V8 findings have landed in Chrome’s reward program, and type confusion reports from him tend to come with working proof-of-concept code, which speeds up Google’s fix cycle but also raises the stakes on keeping the details sealed until most users are patched.
The full patch list
The zero-day is not the only fix. The update addresses 11 other vulnerabilities, nine of them rated high severity, including use-after-free and out-of-bounds memory bugs in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools and Skia, plus a race condition in V8.
| CVE | Type | Component | Fixed |
|---|---|---|---|
| CVE-2026-2441 | Iterator invalidation | CSSFontFeatureValuesMap | February |
| CVE-2026-3909 | Out-of-bounds write | Skia 2D graphics | March |
| CVE-2026-3910 | Inappropriate implementation | V8 engine | March |
| CVE-2026-5281 | Use-after-free | Dawn / WebGPU | April |
| CVE-2026-11645 | Out-of-bounds read/write | V8 engine | June |
| CVE-2026-85046 | Type confusion | V8 engine | September |
Three of the six exploited bugs this year were in V8. That is not a coincidence. V8’s just-in-time compiler makes aggressive assumptions about how objects behave, and those assumptions are exactly what type confusion and bounds bugs attack. It is also the most exposed code in the browser, since it processes untrusted script from every page. Memory-safe rewrites of parts of the stack, including the growing use of Rust in Chromium, aim at precisely this class of bug, but V8’s compiler remains C++ and stays the favorite entry point.
What users should do
The update arrives through the normal channel: Settings, then About Chrome, which triggers the download. A browser restart is required for the fixes to take effect. Users of Chrome-based browsers, including Microsoft Edge, Brave, Opera and Vivaldi, need the same update, though those vendors typically ship their builds a few days behind Google while they rebase their own patches on top of Chromium.
BleepingComputer noted that Google did not disclose any exploitation details beyond confirming attacks exist in the wild. That silence is deliberate. Once the patch is widely deployed, security firms will dissect it and publish working techniques, so every day of delay protects users who have not yet updated.
Enterprise administrators have an extra wrinkle. Chrome’s Extended Stable channel gets the fix on a slower cadence, and managed fleets often pin versions for compatibility testing. Google’s advisory applies to the stable channel, so organizations running Extended Stable should check their own rollout timeline rather than assume the patch has landed. For individuals, the practical advice is shorter: force the update check now and restart the browser, rather than waiting for the background updater to get around to it.
A steady drumbeat
Six actively exploited zero-days in eight months is roughly one every five weeks, a pace consistent with recent years. Chrome’s market share makes it the highest-value target in the browser world, and commercial spyware vendors and criminal groups both buy working Chrome exploits. The February, March, April and June fixes followed the same pattern as this one: a researcher report, confirmation of in-the-wild use, and a rushed patch with details withheld.
The economics explain the pattern. A verified Chrome renderer exploit sells for seven figures on the zero-day market, more if it chains with a sandbox escape. Defenders see the result as a steady drip of emergency patches; attackers see it as an efficient market where a single bug can reach billions of devices through nothing more than a link in a message.
The browser itself has also become more than a document viewer over the past two years. WebGPU, on-demand file system access and the expanding set of APIs exposed to web apps widen the attack surface with every release, and each new capability has shown up in vulnerability reports within months of shipping. Dawn, the WebGPU implementation patched in April, is a case in point: the standard was barely a year into broad deployment when its first exploited bug arrived.
There is one more angle worth watching. Earlier this week Microsoft warned that spammers have adopted ASCII smuggling, a prompt-injection technique developed in attacks on AI agents, to slip hidden content past email filters. The browser and the inbox are both turning into AI-adjacent attack surfaces, and the techniques are migrating between them faster than defenses have adapted so far.
discussion