Google fixes Chrome V8 zero-day exploited in the wild, its sixth of 2026

Google released an emergency Chrome update on Sept. 3 to fix a type confusion vulnerability in its V8 JavaScript engine, saying in its release notes that it "is aware that an exploit for CVE-2026-85046 exists in the wild."

The flaw lets a remote attacker run code inside Chrome's sandbox through a crafted web page, according to the NVD entry. That makes it a typical first stage in browser attacks: a victim only has to visit a malicious or compromised site, and the attacker then needs a second bug to escape the sandbox. Qualys counted it as the sixth Chrome zero-day Google has patched in 2026.

What was fixed

The update moves Chrome's stable channel to 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux, and includes 12 security fixes. Google credited the V8 bug to researcher Salvatore Gulizia, who reported it on Aug. 4. Google did not say who was exploiting it or against whom.

The other fixes include high-severity memory bugs in WebGL, Compositing, DevTools, Skia and another V8 race condition.

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on Sept. 4 and gave U.S. federal agencies until Sept. 18 to patch. Qualys reported that Microsoft Edge Stable 152.0.4191.62 includes the fix. Other Chromium-based browsers pick up V8 fixes on their own release schedules.

Earlier 2026 zero-days

Google had already fixed five exploited Chrome flaws this year: CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645, the last a V8 memory bug patched in June.

What to do

• Open Chrome's menu, choose Help, then About Google Chrome, and relaunch once the update downloads.
• Confirm Edge is on 152.0.4191.62 or later and check for updates to other Chromium-based browsers.
• Administrators should use their management console to force a browser relaunch, since updates are not applied until Chrome restarts.