Google fixes actively exploited Chrome V8 zero-day vulnerability

Google has released a Chrome security update addressing 12 vulnerabilities, including a high-severity V8 flaw that is being actively exploited in attacks.

The fixes are included in Chrome 152.0.7977.82/.83 for Windows and macOS and version 152.0.7977.82 for Linux, with deployment taking place gradually.

The actively exploited vulnerability is tracked as CVE-2026-85046 and is described as a type confusion issue in V8, Chrome's JavaScript and WebAssembly engine. Security researcher Salvatore Gulizia (aka Serotav) reported it to Google on August 4.

Google disclosed the fixes in a September 3 Chrome Stable Channel bulletin. The company did not share technical details about the attacks or indicate who is exploiting the vulnerability, saying only that it is aware of an exploit for CVE-2026-85046 being used in the wild.

Google Chrome is one of the world's most widely used web browsers and is built on the Chromium open-source project, which also forms the foundation of browsers including Microsoft Edge, Brave, and Opera.

Type confusion vulnerabilities occur when software handles an object as though it were a different type than it actually is. In a JavaScript engine such as V8, this can cause incorrect memory access and potentially provide an attacker with a primitive for reading or modifying memory.

In practice, exploitation could potentially begin when a victim visits a malicious or compromised webpage containing specially crafted JavaScript. Depending on the exact nature of the flaw and the browser's security boundaries, an attacker could attempt to corrupt memory and achieve code execution inside Chrome's renderer process. Google has not disclosed whether CVE-2026-85046 has been chained with other flaws in observed attacks.

The update also fixes nine other high-severity vulnerabilities affecting components including CrashReporting, Network, Compositing, WebGL, CacheStorage, DevTools, and Skia. These include several use-after-free and out-of-bounds memory flaws, as well as another V8 issue involving a race condition. Two medium-severity vulnerabilities were also corrected.

Google is temporarily restricting access to detailed bug reports for some vulnerabilities until most Chrome users have received the update, a standard measure intended to reduce the information available to attackers while systems remain exposed.

Chrome users should install the update promptly by opening Settings → About Chrome, allowing the browser to check for and download the latest release, and then restarting Chrome to activate the fixes.