Google Patches Sixth Exploited Chrome Zero-Day of 2026 (CVE-2026-85046)

An actively exploited high-severity vulnerability in Google Chrome’s V8 JavaScript engine has prompted an out-of-band security update for desktop users across Windows, macOS, and Linux. Tracked as CVE-2026-85046, the Google Chrome vulnerability stems from a type confusion flaw within the V8 engine and represents the sixth Chrome zero-day addressed in 2026. Google confirmed in its advisory that an exploit for CVE-2026-85046 exists in the wild, placing immediate urgency on organization-wide patch deployment.

The flaw was reported by security researcher Salvatore Gulizia, who received a $1,000 bug bounty reward for the discovery. To address the issue, Google rolled out Chrome version 152.0.7977.82/.83 for Windows and macOS, alongside version 152.0.7977.82 for Linux. The update resolves a total of 12 security defects in Chrome 152, including nine additional high-severity issues—ranging from out-of-bounds memory accesses and use-after-free flaws to race conditions—and two medium-severity vulnerabilities.

Understanding V8 Type Confusion Flaws

The V8 engine is the open-source JavaScript and WebAssembly engine that powers Chrome and other Chromium-based browsers. To achieve high execution speeds, V8 utilizes Just-In-Time (JIT) compilation, dynamically optimizing JavaScript code at runtime based on the assumed types of variables and objects.

A type confusion vulnerability occurs when the engine processes an object or variable using code compiled for a different object type. When an optimization pass incorrectly assumes an object has a specific memory layout (such as a specific sequence of fields or pointers) but the application runtime modifies that object into a different type, a mismatch arises. If the engine subsequently attempts to access or write to that memory location based on the flawed type assumption, it operates outside the intended bounds of the variable’s true data structure.

In web browsers, type confusion in V8 allows attacker-controlled JavaScript to corrupt internal engine pointers. By carefully constructing dynamic JavaScript code, an attacker can turn a type confusion bug into arbitrary read and write primitives within the browser process memory space.

Exploitation Mechanics and Blast Radius

Exploitation of CVE-2026-85046 typically occurs when a user navigates to a malicious or compromised web page containing specially crafted HTML, CSS, and JavaScript. Because the payload executes within the browser’s context during standard web rendering, no interactive user authorization beyond loading the page is required to trigger the memory corruption condition.

Once successfully triggered, an attacker achieves remote code execution (RCE) within Chrome’s sandboxed renderer process. The immediate blast radius includes:

• Session Compromise: Arbitrary code execution inside the renderer process allows access to the Document Object Model (DOM), active browser cookies, session tokens, and cached web data associated with open tabs.
• Privilege Escalation via Sandbox Escape: While Chrome’s renderer sandbox isolates web content from the host operating system, threat actors frequently chain V8 RCE zero-days with sandbox escape vulnerabilities or operating system kernel flaws to execute arbitrary code with local user or system privileges.
• Internal Network Exposure: An attacker running code inside an enterprise user’s browser session can use the browser’s authenticated network context to probe, attack, or exfiltrate data from internal web applications and corporate intranet services.

This incident follows five other Chrome zero-days patched earlier in 2026: CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. The continued targeting of V8 highlights the persistent effort by advanced threat actors to exploit browser engine memory safety issues for initial access.

Remediation and Mitigation

Organizations should immediately force browser updates across all managed endpoints to ensure Chrome is running version 152.0.7977.82/.83 on Windows and macOS, or version 152.0.7977.82 on Linux.

• Enterprise Policy Configuration: Administrative teams managing Chrome via Google Cloud Management, Group Policy (GPO), or mobile device management (MDM) solutions should enforce automatic updates and prompt users to relaunch their browsers. Enabling the RelaunchNotification policy set to required ensures users restart pending updates promptly.
• Chromium Derivatives: Security teams running non-Google Chromium-based browsers (such as Microsoft Edge, Brave, or Opera) should monitor vendor-specific advisories for corresponding upstream V8 patch integrations.
• Endpoint Monitoring: Monitor endpoint detection and response (EDR) telemetry for anomalous child processes spawned by chrome.exe (or host platform browser processes), such as command shells or scripting tools (cmd.exe, powershell.exe, bash), which indicate a successful browser sandbox escape attempt.