Chrome Just Patched Another Zero-Day. Attackers Were Already Using It
- The Mess: Google has released an emergency Chrome security update fixing a V8 zero-day that attackers were already exploiting in the wild.
- The Damage: A malicious webpage could potentially trigger arbitrary code execution inside Chrome’s sandbox.
- The Fix: Update Chrome to version 152.0.7977.82 or later immediately.
Google just pushed another emergency security update.
This time, the problem is CVE-2026-85046, a high-severity type confusion vulnerability in V8, Chrome’s JavaScript and WebAssembly engine.
And this one was already being used.
Google explicitly confirmed that it is aware of an exploit for CVE-2026-85046 existing in the wild.
That moves this out of the usual “researcher found a bug, vendor released a patch” category.
Someone already had an exploit.
Google patched it afterwards.
The vulnerability affects Chrome versions before 152.0.7977.82 and is a type confusion issue inside V8. According to the published vulnerability information, a remote attacker could use a crafted HTML page to execute arbitrary code inside Chrome’s sandbox.
No password is required.
No extension needs to be installed.
The victim only needs to interact with malicious web content.
Google has not released technical details about the real-world attacks.
That is deliberate.
The company routinely restricts vulnerability details while patches are rolling out to reduce the chance of additional attackers immediately reproducing the exploit.
The patch arrived on September 3.
Google updated Chrome Stable to 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux.
Chrome for Android also received version 152.0.7977.82 with the corresponding security fixes.
The update fixes 12 security vulnerabilities in total.
CVE-2026-85046 is the one administrators should care about first.
It carries Chrome’s High severity rating and has a reported CVSS score of 8.8.
The vulnerability was reported by security researcher Salvatore Gulizia, also known as Serotav, on August 4.
Google paid a $1,000 reward for the report.
Then, less than a month later, Google confirmed that attackers already had an exploit.
That is the uncomfortable lifecycle of browser vulnerabilities in 2026.
Research.
Patch.
Active exploitation.
Update everything.
Chrome is one of the most attractive targets in the world because browsers process untrusted content all day.
JavaScript.
WebAssembly.
Images.
Fonts.
WebGL.
HTML.
A browser is effectively a giant parser connected directly to the Internet.
One memory or type-handling mistake can turn a webpage into an attack surface.
V8 is particularly interesting because it handles performance-critical JavaScript execution.
Attackers who find ways to break assumptions inside the engine can potentially turn controlled web content into code execution.
In this case, the reported vulnerability is a type confusion.
Software believes one thing is one type of object.
Reality says otherwise.
Memory safety starts making bad decisions.
Attackers start paying attention.
The official Chrome advisory also confirms that another V8 issue, CVE-2026-85045, was patched in the same update.
That vulnerability is a race condition.
It has not been confirmed as actively exploited.
CVE-2026-85046 has.
That distinction matters.
Don’t turn every Chrome vulnerability into a zero-day.
But when Google explicitly says an exploit exists in the wild, administrators should stop treating the browser update as routine maintenance.
The browser is already part of the attack chain.
- The Damage: CVE-2026-85046 gives attackers a browser-level entry point through malicious web content, potentially allowing arbitrary code execution inside Chrome’s sandbox.
The sandbox is an important limitation.
This vulnerability alone does not automatically mean full operating-system compromise.
A successful attack may still require additional vulnerabilities to escape the browser sandbox and reach the wider system.
But that does not make the zero-day harmless.
Browser exploits are frequently one component of larger exploit chains.
The first vulnerability gets code execution inside the browser.
The next vulnerability breaks containment.
Together, the chain reaches the operating system.
That is why an actively exploited browser zero-day deserves more urgency than its CVSS number alone might suggest.
Attackers don’t need every victim.
They need the ones who haven’t updated yet.
- The Fix: Update Chrome immediately to version 152.0.7977.82 or later and make sure endpoints are actually restarting and receiving the new build.
For Windows and macOS, Google lists:
152.0.7977.82/.83
For Linux:
152.0.7977.82
Android is also receiving:
152.0.7977.82
In managed environments, don’t assume an update policy means every endpoint is already protected.
Check the deployed version.
Check devices that haven’t restarted.
Check systems that rarely close Chrome.
And remember that Chromium’s enormous ecosystem means browser engines and downstream products should also be monitored for vendor-specific security updates.
Bugstoday Opinion
The interesting part isn’t that Chrome had another bug.
Chrome always has bugs.
Every browser does.
The interesting part is how quickly “security update” can become “someone was already using it.”
Google patched 12 vulnerabilities.
One of them had already crossed the line from research into active exploitation.
That is the reality of browsers now.
The Internet sends untrusted code to billions of machines.
The browser processes it.
Optimizes it.
Compiles it.
Sandboxes it.
And hopes every assumption in millions of lines of code is correct.
Eventually, one isn’t.
Then someone finds it before you update.
Chrome didn’t just patch another bug. Google patched a bug while attackers were already using it.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Google Chrome Releases — Stable Channel Update for Desktop, September 3, 2026
CVE-2026-85046 — Type Confusion in V8
Google Chrome Security Fixes and Rewards
