Google patches sixth Chrome zero-day of 2026 exploited in wild
TL;DR
- CVE-2026-85046 is a V8 compiler type confusion bug that enables arbitrary JavaScript heap read/write and code execution inside the Chrome sandbox.
- Researcher Salvatore Gulizia discovered the flaw and received a $1,000 bounty, thin compensation for a critical zero-day confirmed under active exploitation.
- Edge, Brave, Opera, and Vivaldi all inherit the flaw through Chromium and require the same 152.0.7977.82 build to be patched.
Google shipped Chrome 152.0.7977.82/.83 to patch CVE-2026-85046, a type-confusion vulnerability in the V8 JavaScript and WebAssembly engine that is being exploited in the wild. BleepingComputer reported it is the sixth Chrome zero-day Google has fixed in 2026.
The advisory quotes Google saying: "Google is aware that an exploit for CVE-2026-85046 exists in the wild." Type-confusion bugs cause software to misinterpret one object type as another, potentially corrupting memory; in V8, that path can lead to remote code execution inside Chrome's sandboxed renderer when a user opens a page carrying crafted JavaScript.
The flaw was reported by researcher Salvatore Gulizia, who was awarded a $1,000 bug bounty. The same release patches nine other high-severity issues across Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools and Skia, plus a race condition in V8. Google did not name who is running the exploit or how many users have been hit. It joins 252 cybersecurity items in our last 90 days of tracking.
What others are reporting
-
The Hacker News Read →
Includes technical breakdown from discoverer Salvatore Gulizia: array type confusion in V8 compiler leads to arbitrary heap read/write primitive.
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
-
Help Net Security Read →
Carries Google's direct advisory language and notes the $1,000 bounty paid to Gulizia, grounding the patch in official sourcing.
Google is aware that an exploit for CVE-2026-85046 exists in the wild.
-
The Next Web Read →
Ties the patch timeline directly to CRA Article 14 enforcement on September 11 and flags that Edge, Brave, Opera, and Vivaldi all need the same update.
Every Chromium browser inherits the flaw, so Edge, Brave, Opera and Vivaldi need the same update.
-
Cybersecurity News Read →
Details Google's deliberate patch-first disclosure policy and notes the release includes 12 total security fixes, with CVE-2026-85046 the sole confirmed in-the-wild exploit.
An attacker may be able to create specially crafted JavaScript or web content that causes Chrome to handle memory unexpectedly.
Originally reported by bleepingcomputer.com
Read the original article →Original headline: Google Patches Chrome V8 Zero-Day CVE-2026-85046 Under Active Exploitation, Sixth of 2026