Google has released a Stable-channel security update for Chrome after confirming that CVE-2026-85046, a high-severity type-confusion vulnerability in the V8 JavaScript and WebAssembly engine, has an exploit in the wild.
Successful exploitation may let a malicious website corrupt memory and potentially execute arbitrary code within Chrome’s process.
Chrome 152.0.7977.82/.83 is rolling out to Windows and macOS users, while Linux users receive version 152.0.7977.82.
Google Chrome V8 Flaw Exploited
Organizations should not wait for normal patch cycles: they should verify that managed endpoints receive the fixed build promptly and relaunch the browser to complete installation.
CVE-2026-85046 is a type-confusion flaw in V8, Chrome’s engine for processing JavaScript and WebAssembly. Type confusion occurs when software treats a memory object as if it were a different type than it is.
In memory-safe conditions, those expectations are validated. When they are not, an attacker may trigger a memory access, corrupt data, or build an exploit chain to achieve code execution.
For a browser-targeting operation, the initial interaction can be deceptively simple: a victim visits attacker-controlled web content, or content delivered through a compromised legitimate site.
The browser’s sandbox and modern exploit mitigations can limit the impact of a renderer compromise, but sophisticated attackers may pair a V8 vulnerability with a sandbox escape or local privilege-escalation bug.
The September 3 Stable update contains 12 security fixes. Besides CVE-2026-85046, Google listed high-severity issues affecting CrashReporting, Network, Compositing, WebGL, CacheStorage, DevTools, and Skia, as well as two medium-severity issues.
| CVE ID | Severity | Vulnerability type | Affected component |
|---|---|---|---|
| CVE-2026-85046 | High | Type confusion | V8 |
| CVE-2026-85052 | High | Out-of-bounds read | CrashReporting |
| CVE-2026-85043 | High | Incomplete cleanup | Network |
| CVE-2026-85048 | High | Use-after-free | Compositing |
| CVE-2026-85045 | High | Race condition | V8 |
| CVE-2026-85050 | High | Out-of-bounds write | WebGL |
| CVE-2026-85053 | High | Improper resource exposure | CacheStorage |
| CVE-2026-85042 | High | Use-after-free | DevTools |
| CVE-2026-85049 | High | Use-after-free | Skia |
| CVE-2026-85051 | High | Type confusion | Compositing |
| CVE-2026-85047 | Medium | Improper input validation | Transactions Platform |
| CVE-2026-85044 | Medium | Use of released resource | Mobile |
Details for flaws remain restricted until most users have updated, a policy intended to reduce the opportunity for attackers to reverse-engineer patches and weaponize vulnerabilities against unpatched systems.
The V8 issue was reported on August 4 by security researcher Salvatore Gulizia, also known as Serotav, and earned a $1,000 reward.
Google stated that it is aware of an in-the-wild exploit, placing the vulnerability in a different operational category from a routine, researcher-reported browser bug.
Mitigation
Security teams should force-update Chrome desktop installations to the latest available 152.0.7977.82/.83 release or newer, confirm version compliance via endpoint management telemetry, and ensure users restart Chrome.
Administrators should also review browser crash reports, unusual child processes spawned by Chrome, and endpoint detections associated with suspicious browsing sessions.
Because exploit details remain limited, defenders should avoid treating the absence of indicators as proof of safety. Prioritize systems used by administrators, developers, finance staff, and users with access to sensitive SaaS applications.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
