Emerging Threats

Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Analyst 207||Source: TheHackerNews
Laptop screen on a clean desk displays a blurred, colorful pattern.

"Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page," reads a description of the flaw in CVE.org.

CVE-2026-85046: a V8 type confusion bug and its technical footprint

Google released security updates to address CVE-2026-85046, a high-severity (CVSS 8.8) type confusion vulnerability in V8, Chrome’s JavaScript and WebAssembly engine. The vulnerability has been characterized as a bug that can be turned into arbitrary read/write on the JavaScript heap: security researcher Salvatore Gulizia (aka Serotav) described it as "a V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arbitrary read/write on the JavaScript heap."

Gulizia is credited with discovering and reporting the flaw on August 4, 2026, and was awarded a bug bounty of $1,000 for the responsible disclosure.

Google’s patching action and where users should update

Google’s September update patched 12 vulnerabilities in total, with CVE-2026-85046 singled out as actively exploited. For optimal protection, users are advised to update Chrome to versions 152.0.7977.82/.83 for Windows and Apple macOS, and 152.0.7977.82 for Linux. To confirm the update is installed, users can follow More > Help > About Google Chrome in the browser and select Relaunch.

Exploit observed in the wild and Google’s disclosure posture

Google acknowledged that an "exploit for CVE-2026-85046 exists in the wild" but did not publish technical details of the attacks. According to the public notice, Google withheld such specifics to increase the likelihood that "a majority of the users are updated with a fix and to prevent further exploitation." The company’s decision follows the common practice of balancing transparency against the risk of enabling broader abuse before patches are widely applied.

Six actively exploited Chrome zero-days addressed in 2026

With the inclusion of CVE-2026-85046, Google has patched a total of six Chrome zero-days that were confirmed to be actively exploited since the start of the year. The other five identifiers named in the public advisory are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. The September release therefore represents the latest in a series of emergency updates addressing live threats to Chrome users.

What this means for technologists, end users, and Chromium-based browser vendors

  • Technologists and security teams: Prioritize deploying Chrome 152.0.7977.82/.83 in enterprise fleets and ensure endpoints are restarted to complete the relaunch step noted in Chrome’s About page. The advisory explicitly frames the patch as addressing an actively exploited vulnerability.
  • End users and the general public: Update Chrome via More > Help > About Google Chrome and select Relaunch to ensure the fix is applied. The announcement warns that details of the exploit have not been released so updating is the primary mitigation available.
  • Other Chromium-based browser vendors and their users: Browsers including Microsoft Edge, Brave, Opera, and Vivaldi are specifically called out; users of those products are advised to apply equivalent fixes "as and when they become available."

Chrome’s September update is a reminder that modern browsers remain a primary target for attackers and that patching cycles can become urgent when exploits are observed in the wild. Google’s public acknowledgment that an exploit exists, coupled with the company’s choice to limit technical disclosure, leaves one operationally concrete step: install the specified Chrome versions and relaunch. The open question the advisory leaves behind is timing — how quickly other Chromium-based vendors will roll equivalent fixes and how rapidly users and administrators will apply them.

Original story

Browser SecurityEmerging ThreatsExploitGoogle ChromeZero-DayArbitrary Code ExecutionV8CVE-2026-85046Type ConfusionJavascript Engine
Related Intelligence

Continue Reading

Network equipment rack with a VPN device in a data center.

Attackers Exploit Zero-Days in SonicWall SMA 1000 Appliances

SonicWall's SMA 1000 appliances are under attack, thanks to two newly disclosed zero-day vulnerabilities - CVE-2026-83548 and CVE-2026-83549 - that can be chained together for a complete network compromise. Attackers are already exploiting these flaws in the wild, prompting urgent patching advice from the vendor and cybersecurity authorities.

Analyst 207
Cramped electrical room with industrial control systems and computers.

AI-Powered Attacks Target Latin America With Advanced Proxy Networks

Latin America's transportation, government, and water utility sectors are under siege by sophisticated AI-powered attacks that leverage advanced proxy networks and living-off-the-land techniques to infiltrate and exfiltrate sensitive data. These multi-stage intrusions have already compromised key organizations in Mexico and Ecuador.

Analyst 207
Blurred laptop screen and coffee-stained papers on a conference room table in front of a large, blank display screen.

Cyber Attacks Exploit Legitimate Tools for Rogue Access

Cyber attackers are sneaking into systems through the front door - by exploiting legitimate tools and services to gain rogue access, with a recent dark-web claim boasting of 153 million stolen U.S. and Canadian driver's licenses. Attackers are finding clever ways to impersonate trusted sources, like IT personnel, to get inside and take control.

Analyst 207
Hospital corridor with staff, patient rooms, and a bed with laptop and medical equipment.

Healthcare Breaches Surge, Raising Patient Safety Concerns

Healthcare breaches are skyrocketing, sparking urgent concerns about patient safety and data protection, with a recent string of incidents exposing millions to potential harm. In just one alarming example, Aesto Health's December 2025 breach went undetected for five months, ultimately affecting 9.5 million people and compromising highly sensitive information.

Analyst 207