Update, Sept. 8: Five days later Google patched a seventh exploited Chrome zero-day, CVE-2026-87491, an out-of-bounds write in V8 fixed in Chrome 153.0.8010.36/.37, BleepingComputer reported.
Google shipped a Chrome update Thursday that fixes a V8 flaw attackers are already exploiting. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the company’s advisory says, according to SecurityWeek.
The high-severity bug is a type confusion issue in V8, Chrome’s JavaScript and WebAssembly engine, rated 8.8 on the CVSS scale. Its CVE.org description says it “allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page,” The Hacker News reported. Google hasn’t said who is exploiting it or against whom, which is standard practice until most users have the fix.
Security researcher Salvatore Gulizia, who goes by Serotav, reported the flaw on Aug. 4 and received a $1,000 bug bounty. In a blog post, he described it as a V8 compiler bug in which an array holding PACKED_ELEMENTS receives the PACKED_SMI_ELEMENTS map, a mismatch that can be turned into arbitrary read/write on the JavaScript heap.
Sixth this year
CVE-2026-85046 is the sixth actively exploited Chrome zero-day Google has patched in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. Two of the earlier five, CVE-2026-3910 and CVE-2026-11645, were also in V8.
The fix is in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. The same release addresses 12 vulnerabilities in total, including nine other high-severity bugs such as out-of-bounds read/write, use-after-free and race condition issues, SecurityWeek reported.
Users can confirm they have the patch under More > Help > About Google Chrome and then select Relaunch, since the update takes effect only after a restart. Microsoft Edge, Brave, Opera, Vivaldi and other Chromium-based browsers share the engine and need their own updates as those ship.
The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Sept. 4, giving federal civilian agencies until Sept. 18 to patch.
WebProNews is an iEntry Publication