CVE-2026-85046: Actively Exploited Chrome V8 Zero-Day Enables Code Execution

Google has released an emergency Chrome security update addressing a high-severity zero-day vulnerability that is already being exploited in the wild. Tracked as CVE-2026-85046 and rated 8.8 on the CVSS scale, the flaw is a type confusion issue in V8, the JavaScript and WebAssembly engine used by Google Chrome.

Successful exploitation can allow a remote attacker to execute arbitrary code inside Chrome’s sandbox after a victim visits a specially crafted HTML page. Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out.

CVE-2026-85046 affects Chrome versions earlier than 152.0.7977.82. Google has released Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, with the security update being distributed progressively to users.

The vulnerability is the sixth Chrome zero-day Google has addressed in 2026 after previously exploited flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

CVE-2026-85046 analysis

The vulnerability is categorized as CWE-843: Access of Resource Using Incompatible Type, commonly referred to as type confusion. This class of memory-safety weakness occurs when software incorrectly treats an object as a different data type than the one actually stored in memory.

In JavaScript engines such as V8, incorrect assumptions about object types can become particularly dangerous because highly optimized compiler paths depend on accurate information about how arrays and objects are represented in memory.

Security researcher Salvatore Gulizia, also known as Serotav, explained that the flaw involves V8 compiler behavior where an array containing PACKED_ELEMENTS can incorrectly receive a PACKED_SMI_ELEMENTS map. That mismatch can ultimately be transformed into arbitrary read and write access within the JavaScript heap.

The most important details for CVE-2026-85046 are that exploitation is remotely reachable, requires no existing privileges, and can be delivered through malicious web content. The published CVSS vector indicates that user interaction is required, meaning the victim must load attacker-controlled content, such as by visiting a malicious or compromised page.

A typical exploitation scenario could begin when a user follows a phishing link, encounters a malicious advertisement, or visits a legitimate website that has been compromised. Crafted JavaScript or HTML content could then trigger the V8 type confusion and corrupt the assumptions Chrome uses when accessing objects in memory.

The resulting primitive can enable arbitrary code execution inside the Chrome sandbox. This distinction is important: CVE-2026-85046 alone does not necessarily provide complete control over the underlying operating system. A threat actor seeking full host compromise would normally need to combine browser code execution with an additional sandbox escape or privilege-escalation vulnerability.

Google has deliberately restricted access to the Chromium bug report while most users receive the patch. This is standard practice for actively exploited Chrome vulnerabilities because publishing complete technical details too quickly could make it easier for additional attackers to reverse-engineer and weaponize the flaw.

The vulnerability was reported to Google by Salvatore Gulizia on August 4, 2026. Google awarded the researcher a $1,000 bug bounty, and the flaw was publicly patched as part of the September 3 Stable Channel update.

The update fixes 12 security vulnerabilities in total. Besides the exploited V8 issue, Google addressed high-severity weaknesses involving CrashReporting, Network, Compositing, another V8 race condition, WebGL, CacheStorage, DevTools, and Skia, as well as two medium-severity issues.

Google has confirmed active exploitation but has not released a public CVE-2026-85046 PoC. Access to the underlying Chromium issue also remains restricted, limiting the technical information currently available for reproducing the exploit.

There are likewise no campaign-specific CVE-2026-85046 IOCs published by Google. The company has not identified malicious domains, IP addresses, payload hashes, or specific exploitation infrastructure associated with the observed attacks.

The absence of public indicators makes vulnerability exposure and behavioral telemetry more important than static threat intelligence. Organizations should assume that any endpoint running an affected browser version can remain exposed when users browse attacker-controlled content.

Contact Sales

CVE-2026-85046 Mitigation

Google recommends upgrading Chrome immediately to:

• 152.0.7977.82/.83 or later on Windows
• 152.0.7977.82/.83 or later on macOS
• 152.0.7977.82 or later on Linux

Users can verify the installed version by opening Chrome → Help → About Google Chrome. The browser will check for updates automatically, but Chrome must be relaunched after installation for the new version and security fixes to become active.

Enterprise administrators should verify deployment rather than relying exclusively on Chrome’s gradual automatic rollout. Managed endpoints that have not restarted after receiving the update may continue running the vulnerable browser process until users relaunch Chrome.

CVE-2026-85046 detection should begin with endpoint inventory. Security teams should identify systems running Chrome releases earlier than 152.0.7977.82 and prioritize endpoints exposed to external browsing, email links, web advertising, and other untrusted web content.

To Detect CVE-2026-85046 exploitation or suspicious browser activity, defenders should look for combinations of:

• Chrome renderer crashes followed by unusual process activity
• Unexpected processes launched from the Chrome process tree
• Browser exploitation alerts generated by EDR or endpoint protection tools
• Suspicious memory-corruption behavior involving Chrome or V8
• Visits to newly registered, compromised, or known malicious websites immediately before anomalous activity
• Unexpected executable or script activity following a browser session
• Attempts to exploit a second vulnerability after Chrome renderer compromise
• New persistence or privilege-escalation activity occurring immediately after suspicious browser behavior

These signals are hunting leads rather than exploit-specific signatures because Google has not disclosed the in-the-wild exploitation technique.

Organizations should also review web proxy, DNS, EDR, and email-security telemetry around suspicious Chrome events. Since exploitation requires loading crafted web content, correlating browser crashes or unusual child-process activity with recently visited domains can help identify possible attack chains.

Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi also rely on Chromium components, including V8. Users of these products should install vendor updates containing the corresponding Chromium security fix as soon as those releases become available.

Because exploitation was already underway before public disclosure, CVE-2026-85046 mitigation should include both rapid patching and retrospective investigation of suspicious browser activity on systems that remained vulnerable before September 3.