Google Patches Actively Exploited V8 Zero-Day Vulnerability in Chrome

Google has released emergency updates to address an actively exploited Google Chrome zero-day vulnerability in the browser’s JavaScript engine. Tracked as CVE-2026-85046, the high-severity security bug allows remote attackers to execute arbitrary code within Chrome’s renderer sandbox using a specially crafted HTML page. Google acknowledged active exploitation in the wild alongside the release of patched browser builds across desktop platforms.

Technical Mechanics: V8 Compiler Type Confusion

The vulnerability stems from a type confusion bug (CWE-843) located in V8, the open-source JavaScript and WebAssembly engine that powers Chrome and other Chromium-based browsers. Security researcher Salvatore Gulizia (Serotav), who reported the issue on August 4, 2026, identified that the bug manifests within V8’s optimizing compilers.

Specifically, the flaw causes an array designed to hold standard object pointers (PACKED_ELEMENTS) to be incorrectly assigned the PACKED_SMI_ELEMENTS map—a internal layout representation optimized strictly for Small Integers (Smis). In JavaScript engines, object maps (or hidden classes) tell the runtime engine how data within an object is structured in memory.

When V8’s Just-In-Time (JIT) compiler treats standard heap object references as raw integers due to this map mismatch, type safety checks are bypassed. An attacker can leverage this condition to corrupt internal memory structures, creating arbitrary read and write primitives across the JavaScript heap. These memory primitives allow an attacker to write shellcode into executable memory regions, achieving remote code execution inside the browser renderer process.

CVSS Vector Analysis and Risk Assessment

CVE-2026-85046 carries a CVSS v3.1 score of 8.8. Analyzing the full vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) provides key insight into how the flaw is exploited in practice:

• Attack Vector: Network (AV:N): The issue is exploitable over standard web traffic. A user only needs to connect to an untrusted web server hosting the malicious HTML payload.
• Attack Complexity: Low (AC:L): Once the exploit payload is crafted, triggering the type confusion condition does not require complex race conditions or specific target environmental configurations.
• Privileges Required: None (PR:N): Unauthenticated remote attackers can deliver the payload.
• User Interaction: Required (UI:R): The attack requires the target user to navigate to a malicious website or view a compromised page carrying an embedded malicious iframe or advertisement.
• Scope & Impact (S:U, C:H/I:H/A:H): The exploitation impact on Confidentiality, Integrity, and Availability within the sandbox context is total.

While the exploit executes inside Chrome’s renderer sandbox, renderer compromises represent the critical first stage of modern browser attack chains. Threat actors typically pair a renderer RCE zero-day with a sandbox escape or kernel-level privilege escalation vulnerability to gain full control of the underlying operating system. Even without a sandbox escape, an attacker occupying the renderer process can extract sensitive DOM data, session tokens, input data, and cross-site application state across open browser tabs.

This release marks the sixth Chrome zero-day patched under active exploitation since the beginning of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

Downstream Impact and Blast Radius

Because V8 is a core component of the open-source Chromium codebase, the blast radius extends beyond desktop Google Chrome users:

1. Chromium Browsers: Downstream browsers using the Chromium architecture—including Microsoft Edge, Brave, Opera, and Vivaldi—are vulnerable until their respective engineering teams ingest the upstream patch.
2. Embedded Frameworks: Applications built on Electron or embedded Chromium views that execute untrusted remote web content share the same memory corruption risks in their rendering threads.

Remediation and Immediate Actions

Organizations should ensure Chrome installations are updated immediately across all desktop environments.

• Fixed Versions: Upgrade to Google Chrome version 152.0.7977.82/.83 for Windows and macOS, or version 152.0.7977.82 for Linux.
• Manual Update Procedure: Users can manually trigger the update in Chrome by opening the main menu and selecting Help > About Google Chrome (or navigating directly to chrome://settings/help), allowing the installer to download the update, and clicking Relaunch.
• Enterprise Management: System administrators using enterprise policy management should enforce browser restarts to ensure pending background updates take effect on client endpoints. Administrators managing Microsoft Edge, Brave, or Vivaldi should audit their fleet patch management systems for updates containing Chromium source alignment with release 152.0.7977.82.