Chrome Patches Its Sixth Zero-Day of 2026

Google patched a Chrome vulnerability Sept. 4 that attackers were already exploiting, the sixth actively exploited zero-day the company has fixed in the browser in 2026.

The flaw, tracked as CVE-2026-85046 and rated 8.8 out of 10 on the CVSS severity scale, is a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine, according to The Hacker News.

What CVE-2026-85046 lets an attacker do

A type confusion bug happens when software treats a piece of data as one type when it is actually another, letting an attacker corrupt memory in ways the program's own checks do not catch. Here, that lets a remote attacker run code inside Chrome's sandbox after a victim visits a single crafted HTML page, no download or install required. Google said only that "an exploit for CVE-2026-85046 exists in the wild," and declined to publish technical details while the update was still rolling out to users.

The patch: Chrome 152.0.7977.82

Google shipped the fix in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. The same V8 engine also ships inside Chromium-based browsers including Microsoft Edge, Brave, Opera and Vivaldi, which pull the fix on their own release schedules rather than automatically alongside Chrome's. Salvatore Gulizia, a researcher who goes by the handle Serotav, reported the bug to Google on Aug. 4 and was paid a $1,000 bounty for it.

Chrome's sixth zero-day of 2026

CVE-2026-85046 is the sixth zero-day Google has patched in Chrome in 2026, following CVE-2026-2441 in February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April and CVE-2026-11645 in June. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Sept. 4, which requires federal civilian agencies to patch by Sept. 18. The fix landed in the same week Adobe patched a separately exploited Commerce flaw rated a perfect 10 on the same scale, and days before Microsoft's Patch Tuesday fixed two more zero-days already under attack.

What Google hasn't disclosed

Google has not said which threat actors are using the exploit, which organizations have been targeted, or how attackers are getting victims to the crafted page in the first place, the same restraint it showed on each of the five Chrome zero-days patched earlier in 2026. The company's policy is to withhold specifics until most users have updated, on the theory that publishing an exploit's mechanics before then hands working code to whoever is still running the old version. Chrome users can confirm they are protected by checking that their version number is at least 152.0.7977.82 under the browser's About page; the update downloads in the background but needs a restart to take effect.

The published CVSS scoring for CVE-2026-85046 requires user interaction to exploit, meaning a victim has to load attacker-controlled content by following a phishing link, hitting a malicious advertisement or landing on a compromised site, according to an analysis from threat-intelligence firm SOC Prime. That single precondition is the difference between a bug that spreads through a clicked link and one that spreads through nothing at all, and it is also why Google's sandbox, the isolation layer meant to contain exactly this kind of memory-corruption bug, is doing real work here even though it did not stop the type confusion itself.