Google Patches Actively Exploited Chrome V8 Zero-Day

Google has released a new security update for Chrome addressing 12 vulnerabilities, including a high-severity zero-day flaw that attackers are actively exploiting. The company is urging users to install the latest browser version to reduce exposure to potential attacks.

Chrome Update Fixes High-Severity V8 Vulnerability

The actively exploited vulnerability is tracked as CVE-2026-85046 and carries a CVSS severity score of 8.8. It affects V8, the JavaScript and WebAssembly engine used by Google Chrome.

The flaw is classified as a type confusion vulnerability, a memory-related security issue that can occur when software incorrectly handles an object as a different data type.

According to the vulnerability description, the issue affects Google Chrome versions before 152.0.7977.82 and could allow a remote attacker to execute arbitrary code within the browser’s sandbox through a specially crafted HTML page.

Because malicious webpages could potentially trigger the vulnerability, successful exploitation may occur when a targeted user visits attacker-controlled or compromised web content.

Security Researcher Discovered Flaw in August

Security researcher Salvatore Gulizia, also known as Serotav, discovered and reported the vulnerability on August 4, 2026. Google awarded the researcher a $1,000 bug bounty for responsibly disclosing the security issue.

In a technical analysis, Gulizia described the vulnerability as a “V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arbitrary read/write on the JavaScript heap.”

The underlying type confusion can therefore create conditions that allow an attacker to manipulate memory within the JavaScript heap.

Google Confirms Exploit Is Being Used in the Wild

Google confirmed that an “exploit for CVE-2026-85046 exists in the wild,” indicating that attackers have already used the vulnerability in real-world incidents.

The company has not disclosed details about the attacks, including who may be exploiting the flaw, how widespread the activity is or which users have been targeted.

Google routinely restricts technical information about newly patched vulnerabilities until a substantial portion of Chrome users have received the security update. Limiting those details can make it more difficult for additional attackers to reproduce an exploit before users have patched their browsers.

Six Chrome Zero-Days Addressed in 2026

CVE-2026-85046 is the sixth actively exploited Chrome zero-day vulnerability addressed by Google since the beginning of 2026.

The previous vulnerabilities include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645.

Several of these security issues have involved components that play critical roles in Chrome, highlighting the importance of keeping browsers updated as soon as security patches become available.

Chrome Users Should Install Version 152.0.7977.82 or Later

Google is rolling out Chrome versions 152.0.7977.82/.83 for Windows and Apple macOS, while Linux users should update to version 152.0.7977.82.

Users can verify their Chrome version and trigger an available update by opening the browser menu and navigating to More > Help > About Google Chrome. Once the update has been installed, Chrome may require a relaunch to activate the security fixes.

Chrome typically updates automatically, but manually checking can help ensure that a device receives an urgent security patch without waiting for the normal update cycle.

Other Chromium Browsers May Also Require Updates

The vulnerability is particularly relevant beyond Chrome because several popular browsers rely on the Chromium codebase and its V8 engine.

Users of Microsoft Edge, Brave, Opera and Vivaldi should watch for security updates from their respective browser developers and install patched versions as they become available.

Keeping browsers current remains one of the simplest defenses against vulnerabilities already being exploited. With CVE-2026-85046 confirmed as an active threat, Chrome and other Chromium-based browser users should prioritize installing the latest security updates.

William Faulkner

William Faulkner writes for Social Post News, covering news, politics, business, technology, sport, entertainment, and lifestyle. He focuses on clear, reliable reporting and useful information, helping readers stay informed about current events, emerging trends, and stories that matter.