Google Patches Exploited Chrome V8 Zero-Day CVE-2026-85046

Google has issued urgent Chrome 152 updates to resolve an actively exploited Google Chrome zero-day vulnerability. Tracked as CVE-2026-85046, the high-severity flaw stems from a type confusion bug in Chrome’s V8 JavaScript and WebAssembly engine. Google acknowledged in its advisory that an exploit for CVE-2026-85046 exists in the wild, making immediate deployment of the patch a priority for enterprise endpoint administrators and end users alike.

The bug was reported by security researcher Salvatore Gulizia, who earned a $1,000 bug bounty reward for the discovery. The fix is delivered in Chrome versions 152.0.7977.82/.83 for Windows and macOS, and version 152.0.7977.82 for Linux.

Mechanics of the V8 Type Confusion Vulnerability

The V8 engine serves as Chrome’s high-performance execution runtime for JavaScript and WebAssembly, relying on Just-In-Time (JIT) compilation to dynamically optimize code at execution time. A Chrome V8 type confusion vulnerability occurs when the runtime engine misinterprets the memory allocation or pointer structure of an object—treating a variable or memory location allocated as one data type as if it belonged to an entirely different structure.

In practical terms, an attacker trigger this condition by luring a victim to a malicious HTML page hosting crafted JavaScript. When V8 performs aggressive speculative optimizations, it can lose track of the underlying object types. This type mismatch allows the attacker’s script to read from or write to memory offsets outside the original object boundaries.

By controlling what memory is read or overwritten inside the V8 heap, attackers achieve arbitrary read/write primitives within the renderer process. Once reliable memory manipulation is achieved, threat actors leverage these primitives to execute arbitrary code within the context of the browser’s sandboxed renderer process. While escaping the browser sandbox typically requires chaining a second vulnerability (such as a kernel exploit or an elevation-of-privilege bug in the host OS), renderer compromises alone allow attackers to access sensitive session tokens, cookie stores, DOM content, and web application data across active tabs.

Chrome’s 2026 Zero-Day Landscape

CVE-2026-85046 marks the sixth actively exploited Chrome zero-day patched in 2026. Browser engines remain prime targets for sophisticated threat actors because drive-by downloads and web-based exploitation require zero user interaction beyond navigating to a compromised or adversary-controlled web page.

The fix for CVE-2026-85046 arrives alongside a broader batch of security updates in Chrome 152, which resolves 12 vulnerabilities in total. Nine of these flaws carry a high-severity rating, addressing memory safety issues across multiple browser components:

• Out-of-bounds read and write weaknesses
• Use-after-free (UAF) memory corruption flaws
• Incomplete cleanup issues
• Race condition defects
• Improper resource exposure
• Additional type confusion vulnerabilities

Two medium-severity weaknesses involving improper input validation and use-after-free conditions were also addressed in this update release.

Enterprise Impact and Blast Radius

Because web browsers are the primary workspace for modern enterprise environments, zero-day vulnerabilities in Chromium present a broad exposure surface. An unpatched browser instance exposed to malicious advertising networks, compromised legitimate websites, or targeted phishing links can yield complete initial access to an endpoint.

Furthermore, the blast radius of Chromium-based zero-days extends beyond standard browser installations. The underlying V8 engine is shared across the wider Chromium ecosystem, including third-party web browsers and desktop application frameworks like Electron. Until downstream vendors incorporate Google’s upstream V8 commits into their respective codebases, applications embedding vulnerable Chromium components remain susceptible to similar memory manipulation techniques.

Remediation and Action Plan

System administrators should verify that automatic updates are enabled across all managed desktop endpoints and enforce application restarts to apply the updated binary.

To ensure protection against active exploitation of CVE-2026-85046, systems must be updated to the following versions or later:

• Windows & macOS: Chrome version 152.0.7977.82/.83
• Linux: Chrome version 152.0.7977.82

Organizations managing Chromium-based enterprise browsers or Electron applications should monitor downstream vendor update cycles and apply engine updates as soon as patched builds become available.