Chrome V8 zero-day CVE-2026-85046 exploited in the wild; Google ships emergency 152 fix
Google emergency-released Chrome 152.0.7977.82 to fix V8 type-confusion zero-day CVE-2026-85046, CVSS 8.8, exploited in the wild. CISA added it to KEV on September 4. Sixth in-the-wild Chrome zero-day of 2026.
On September 3 Google shipped Chrome 152.0.7977.82/.83 (Windows, macOS) and 152.0.7977.82 (Linux) stable, fixing CVE-2026-85046—a type-confusion zero-day in the V8 JavaScript engine already exploited in the wild. CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog on September 4, with a September 18 due date for federal agencies. This is the sixth in-the-wild Chrome zero-day patched in 2026.
Incident overview
CVE-2026-85046 was reported by researcher Salvatore Gulizia (Serotav) on August 4. CVSS 8.8. Google's release notes state exploit code is known to exist in the wild; they did not disclose campaign details, scale, or victim scope. The same update also fixes nine other high-severity bugs in Network, WebGL, DevTools, and Skia.
Technical details
Type confusion is the most common memory-safety defect class in V8: a crafted HTML page induces V8 to treat a value as the wrong type, then corrupts memory in the sandboxed renderer and obtains code execution. CISA's KEV record states a remote attacker can execute arbitrary code inside the browser sandbox via a malicious HTML page. Chrome, Microsoft Edge, Opera, and other Chromium browsers may be affected. The bug's boundary is inside the sandbox; public sources have not confirmed a standalone sandbox escape. Control of the renderer is already enough for large-scale phishing, infosteal, and follow-on payload delivery.
Impact assessment
In-the-wild browser zero-days mean visiting a malicious or watering-hole page is enough. The attack surface is every unpatched user; no cooperation beyond that visit is required. Google withholding exploit details means attackers still benefit from information asymmetry. CISA KEV listing plus a hard remediation deadline further confirms the threat. Chromium forks (Edge, Brave, Opera) typically lag Chrome by days to weeks; that residual population is higher risk.
Remediation
- Upgrade Chrome immediately to 152.0.7977.82 or later (Linux: 152.0.7977.82+). Trigger via Settings → About Chrome and fully restart the browser.
- Downloaded ≠ applied: VDI, long-lived terminals, and shared workstations must each verify the running browser version.
- Enterprises: push via the standard distribution channel and verify coverage on the management plane.
- Chromium-family users must follow each vendor's own security advisory. Chrome version numbers do not apply to Edge or Opera.
- Detection: watch for anomalous page delivery targeting unpatched versions; periodically check KEV catalog updates.
References
- Canadian Centre for Cyber Security: Google security advisory AV26-883
- CVE-2026-85046 details page
- CyberRecaps: daily security news, September 4, 2026