Google has patched the Chrome V8 zero-day CVE-2026-85046, a high-severity type confusion flaw in Chrome’s JavaScript engine that was already being exploited in the wild when the fix landed. The update brings Chrome to version 152.0.7977.82/.83 on Windows and macOS, and 152.0.7977.82 on Linux, rolling out gradually across the browser’s install base.
Type confusion bugs cause software to misinterpret one type of object as another, which opens the door to memory corruption. Because CVE-2026-85046 lives in V8, Chrome’s open-source JavaScript and WebAssembly engine, it could in principle be triggered by a specially crafted HTML page carrying malicious JavaScript, potentially leading to remote code execution inside Chrome’s sandboxed renderer process. Google’s advisory carries the customary note: ‘Google is aware that an exploit for CVE-2026-85046 exists in the wild.’ The company has held back technical details to give users and downstream projects time to apply the patch before a more complete picture of the attack surface becomes public.
Who Found It and What It Cost Google
The flaw was reported to Google by researcher Salvatore Gulizia, better known online as ‘Serotav’. According to SOCPrime, Gulizia submitted his findings on 4 August 2026, and Google awarded him a $1,000 bug bounty for the report. That figure sits at the modest end of Chrome’s reward scale, though the real-world exploitation of the vulnerability underlines that the discovery mattered.
Help Net Security notes the CVE carries a CVSS score of 8.8, placing it firmly in the high-severity tier. For context, a CVSS score in that range typically indicates a vulnerability that is readily exploitable and capable of causing serious impact, even if it does not reach the 9.0-plus critical threshold.
CVE-2026-85046 Joins the CISA Known Exploited Vulnerabilities Catalogue
The patch’s significance was underlined when, according to Cyber One Solutions, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalogue on 4 September 2026. Inclusion in the KEV catalogue carries a formal remediation deadline for US federal civilian agencies, and it tends to accelerate patching decisions across the wider enterprise market too.
Beyond the V8 flaw, this update addresses nine other high-severity vulnerabilities covering a broad sweep of Chrome’s internals: use-after-free and out-of-bounds memory issues in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, and Skia, along with a race condition in V8 itself. The breadth of that list is a reminder that Chrome’s attack surface is substantial even when the headline zero-day gets all the attention.
Chrome’s Running Tally for the Year
CVE-2026-85046 is the sixth actively exploited vulnerability Google has patched in Chrome since January. The previous five span a range of bug classes and components. An out-of-bounds read and write in V8 (CVE-2026-11645) was patched in June after exploitation in the wild. An iterator invalidation flaw in CSSFontFeatureValuesMap (CVE-2026-2441) was fixed in mid-February. March brought two zero-days at once: an out-of-bounds write in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation issue in V8 (CVE-2026-3910). April saw the patching of a use-after-free in Dawn (CVE-2026-5281), the cross-platform WebGPU implementation used by Chromium.
Six actively exploited bugs patched in a single year is not unusual for a browser of Chrome’s complexity and market reach, but it does illustrate why security teams treat browser updates as a priority item rather than routine maintenance.
How to Apply the Update
Chrome users can check for and install the update by navigating to Settings > About Chrome and allowing the download to complete, then restarting the browser to activate the fix. Users of Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi should apply equivalent updates from those vendors, though delivery may lag by a couple of days while the respective teams integrate and test Google’s upstream changes. With CISA’s KEV listing in place, organisations running any of these browsers in managed environments have a clear prompt to treat this one as urgent.
