Google Chrome V8 Zero-Day CVE Actively Exploited

Google released an emergency security update for Chrome on September 3, 2026, to patch an actively exploited zero-day vulnerability in the V8 JavaScript engine. The high-severity flaw, tracked as CVE-2026-85046, allows remote attackers to execute arbitrary code inside the Chrome sandbox through a crafted HTML page.

What Happened: Chrome V8 Type Confusion Zero-Day Under Active Attack

Google confirmed on Thursday that threat actors are already exploiting CVE-2026-85046 in the wild. The vulnerability is a type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine. It affects Google Chrome versions prior to 152.0.7977.82.

Security researcher Salvatore Gulizia, also known as Serotav, discovered and reported the flaw on August 4, 2026. Google awarded him a $1,000 bug bounty for responsible disclosure. The issue stems from a bug in V8’s compilers that causes an array containing PACKED_ELEMENTS to incorrectly receive the map PACKED_SMI_ELEMENTS. Furthermore, this error can be turned into arbitrary read and write operations on the JavaScript heap.

Google did not disclose technical details about the active exploitation. The company typically withholds specifics to ensure users have time to update before attackers develop additional exploits. With this patch, Google has now fixed six actively exploited Chrome zero-days in 2026.

Technical Details of the CVE-2026-85046 Vulnerability

CVE-2026-85046 is a type confusion vulnerability with a CVSS score of 8.8. Type confusion occurs when a program processes data using an incorrect type assumption, leading to memory corruption and code execution.

The vulnerability exists in V8’s Just-In-Time (JIT) compilation pipeline. When V8 compiles JavaScript code, it generates optimized machine code based on type assumptions about objects. If those assumptions are violated at runtime, the generated code may access memory incorrectly.

In this case, the bug causes an array with PACKED_ELEMENTS to be treated as PACKED_SMI_ELEMENTS. SMI stands for Small Integer, a compact representation used by V8. When the engine treats a general array as an integer-only array, memory corruption occurs. Consequently, attackers can leverage this corruption to achieve arbitrary read and write primitives on the JavaScript heap.

From there, attackers can escape the V8 sandbox and execute arbitrary code within the Chrome renderer process. While Chrome’s multi-process architecture provides isolation, successful exploitation at this level can lead to further privilege escalation or data theft.

Attack Requirements

• The target must visit a malicious web page or interact with compromised content.
• No user authentication is required for exploitation.
• The attacker must craft JavaScript that triggers the specific type confusion condition.

Business and Operational Impact

Browser zero-days are among the most dangerous vulnerabilities for enterprise security. Chrome is the dominant browser worldwide, with billions of users across consumer and corporate environments.

The impact of CVE-2026-85046 includes:

• Remote code execution: Attackers can execute code inside Chrome’s sandbox without user consent.
• Data theft: Compromised renderer processes can access sensitive session data, cookies, and tokens.
• Lateral movement: Exploitation can serve as an initial access vector for broader network compromise.
• Supply chain risk: Malicious ads, compromised websites, and phishing pages can deliver the exploit.

Moreover, organizations relying on Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi face similar risks. These browsers typically inherit Chrome’s security fixes, but patching timelines vary by vendor.

Mitigation and Recommendations

Organizations and individual users should apply the Chrome update immediately. The patched versions are:

• Windows and macOS: 152.0.7977.82 or .83
• Linux: 152.0.7977.82

Immediate Actions for Defenders

1. Update Chrome immediately. Navigate to Settings > Help > About Google Chrome and relaunch the browser after the update installs.
2. Audit Chromium-based browsers. Ensure Microsoft Edge, Brave, Opera, and Vivaldi are updated to versions incorporating the CVE-2026-85046 fix.
3. Enable automatic updates. Configure Chrome and other browsers to update automatically to reduce exposure windows.
4. Monitor for suspicious browser activity. Look for unexpected renderer crashes, unusual outbound connections, or anomalous JavaScript execution.
5. Review web filtering policies. Block known malicious domains and restrict untrusted content where possible.

Enterprise-Specific Guidance

For organizations using Google Chrome Enterprise, deploy the update through your management console. Additionally, consider enforcing update policies that prevent users from running outdated browser versions. Security teams should also review endpoint detection and response (EDR) alerts for indicators of browser-based exploitation.

Bottom line: CVE-2026-85046 is an actively exploited zero-day in the world’s most popular browser. Every day of delay increases the risk of compromise. Update Chrome now, and audit all Chromium-based browsers in your environment.

Incident Summary

CVE ID / Incident:	CVE-2026-85046
Affected Systems:	Google Chrome prior to 152.0.7977.82 (Windows, macOS, Linux); all Chromium-based browsers pending vendor updates
Severity:	High (CVSS 8.8)
Disclosure Date:	September 3, 2026
Discovery:	Salvatore Gulizia (Serotav), reported August 4, 2026
Patch Status:	Fixed in Chrome 152.0.7977.82+
Exploitation:	Actively exploited in the wild (confirmed by Google)

References

1. The Hacker News, “Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day,” September 4, 2026, https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html.
2. Google Chrome Releases, “Stable Channel Update for Desktop,” September 3, 2026, https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html.
3. CVE.org, “CVE-2026-85046 Detail,” accessed September 4, 2026, https://www.cve.org/CVERecord?id=CVE-2026-85046.
4. Serotav (Salvatore Gulizia), “When Sorting Leads to Confusion: V8 Type Confusion Writeup,” August 2026, https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/.