Google Chrome Fixes Actively Exploited V8 Zero-Day Flaw

Google released an emergency security update for its Chrome browser on September 5, 2026, to patch a severe vulnerability in its V8 JavaScript engine. This zero-day flaw, identified as CVE-2026-85046 and carrying a high CVSS score of 8.8, has been actively exploited in the wild by malicious actors.

The vulnerability is a type confusion bug within V8, Chrome's engine responsible for processing JavaScript and WebAssembly code. According to the CVE.org description, a remote attacker could exploit this flaw by tricking a user into visiting a specially crafted HTML page, allowing them to execute arbitrary code within the browser's sandbox environment. This could lead to significant security breaches on affected systems.

Security researcher Salvatore Gulizia, also known by his alias Serotav, is credited with discovering and reporting this critical vulnerability. Gulizia identified the flaw on August 4, 2026, and was awarded a $1,000 bug bounty for his responsible disclosure. In a detailed technical explanation, Gulizia described the issue as stemming from a compiler error in the V8 engine. This error allows an array with a specific element type to be incorrectly assigned a different map type, potentially enabling arbitrary read and write capabilities on the JavaScript heap. Such capabilities are highly sought after by attackers for code execution.

Broader Context and User Recommendations

Google has confirmed that an exploit for CVE-2026-85046 is already in circulation, although the company has refrained from disclosing specific details about the attacks to encourage widespread adoption of the fix and prevent further exploitation. This marks the sixth actively exploited Chrome zero-day vulnerability that Google has addressed this year, highlighting an ongoing increase in sophisticated attacks targeting web browsers. Previous zero-days patched in 2026 include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

To ensure protection, users are strongly advised to update their Google Chrome browser immediately. For Windows and Apple macOS users, the recommended versions are 152.0.7977.82 and 152.0.7977.83. Linux users should update to version 152.0.7977.82. Users can verify their current version and initiate an update by navigating to the 'More' menu (represented by three vertical dots), selecting 'Help,' and then 'About Google Chrome.' The browser will then check for and download the latest updates, often requiring a relaunch to apply them.

The security implications of actively exploited zero-days cannot be overstated. These vulnerabilities represent unknown weaknesses that attackers can leverage before developers have a chance to create a patch. The rapid exploitation of CVE-2026-85046 underscores the persistent threat landscape and the importance of timely security updates. Beyond Chrome, users of other browsers built on the Chromium project, such as Microsoft Edge, Brave, Opera, and Vivaldi, should also remain vigilant and apply security updates provided by their respective browser vendors as soon as they become available.