The fix
Google pushed out Chrome 152.0.7977.82 and .83 for Windows and macOS, and 152.0.7977.82 for Linux, closing a batch of 12 vulnerabilities. One of them, tracked as CVE-2026-85046, was already being used in attacks when the patch shipped, making it the sixth Chrome zero-day Google has fixed in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. Google confirmed that an exploit for the bug exists in the wild but has released no further detail on who is using it or against whom, which is standard practice while a patch is still rolling out to users.
What the bug actually does
CVE-2026-85046 is a type confusion flaw, rated 8.8 out of 10 on the CVSS severity scale, in V8, the engine that runs JavaScript and WebAssembly inside Chrome. A type confusion bug happens when the browser treats a piece of memory as one kind of data structure when it is really another, and an attacker who can trigger that mismatch gets a foothold to manipulate memory in ways the code was never meant to allow.
Security researcher Salvatore Gulizia, who uses the handle Serotav, found and reported the flaw on August 4, 2026, and was paid a $1,000 bug bounty for it. Describing the underlying issue, Gulizia said: "a V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arbitrary read/write on the JavaScript heap." In practical terms, that read/write access is enough to run attacker-controlled code inside Chrome's sandbox simply by getting a victim to load a page containing the crafted HTML and JavaScript needed to trigger it.
A month passed between Gulizia's report on August 4 and the patch shipping on September 4, which is a normal cadence for a bug that was not yet known to be exploited at the time it was reported. Google's own account indicates the in-the-wild exploitation was identified later, prompting the accelerated fix.
Federal deadline attached
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog the same day Google shipped the patch, giving federal civilian agencies until September 18, 2026, to update. That kind of same-day listing signals that CISA considers the in-the-wild exploitation credible and current, not a theoretical risk.
A pattern worth noticing
All six of Chrome's actively exploited zero-days in 2026 carry the identical CVSS score of 8.8, according to a review of the advisories. That consistency suggests these aren't isolated one-off memory bugs but variations on a similar class of flaw in how V8 handles object shapes internally, the kind of bug hunters go looking for once they understand the pattern that works. Type confusion issues are attractive to attackers precisely because they turn a logic error into memory control: get the engine to treat one type of object as another, and read/write access to the JavaScript heap follows, which is most of what's needed to escape the immediate sandbox into a full exploit chain.
What it means for you
Chrome updates itself automatically in the background on most systems, so restarting the browser is normally all that's needed to pick up the fix; open chrome://settings/help to force a check and confirm the version number reads 152.0.7977.82 or later. Anyone running a Chromium-based browser other than Chrome itself, including Microsoft Edge, Brave, Opera, or Vivaldi, should check for and apply that browser's own update separately, since each vendor ships the underlying Chromium security fixes on its own schedule rather than automatically inheriting Google's release. Because the flaw triggers just by loading a malicious web page, there is no user action beyond updating that meaningfully reduces the risk; site permissions or browsing habits don't factor in the way they might for other attack types. Organizations that track CISA's Known Exploited Vulnerabilities catalog for patch prioritization should treat this one as time-boxed against the September 18 federal deadline even if they aren't a federal agency themselves, since it's a reasonable proxy for how seriously to prioritize the update internally. Developers who maintain Chromium embeds, Electron apps, or other software bundling a Chromium runtime should also check whether their vendor has shipped the equivalent V8 fix, since bundled runtimes don't inherit Chrome's own auto-update mechanism at all and require an explicit dependency bump.
Sources
This article is based on reporting from The Hacker News and Help Net Security, listed below.
