Google released a Chrome security update on September 3, 2026, patching 12 vulnerabilities, including CVE-2026-85046, a V8 flaw already under active exploitation, according to Google’s advisory.
What to Know?
- Google patched CVE-2026-85046, a high-severity type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine, rated CVSS 8.8.
- The flaw is the sixth actively exploited Chrome zero-day Google has patched since the start of 2026, all rated the same 8.8 severity score.
- Researcher Salvatore Gulizia, reported the bug on August 4, 2026, and received a $1,000 bug bounty.
- Google confirmed an exploit for CVE-2026-85046 exists in the wild but withheld attack details to slow further abuse.
- The fix landed in Chrome Stable version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux.
Chrome’s V8 engine has become a recurring target this year. Microsoft Edge, Brave, Opera, and Vivaldi all ship Chromium-based browsers on the same V8 engine, so a confirmed in-the-wild exploit is grounds for an out-of-cycle release.
How the Flaw Was Exploited?
A type confusion in V8 in Chrome versions before 152.0.7977.82 let a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page, a ccording to the CVE.org description of the flaw. In a separate blog post, Gulizia described the issue as a V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS receiving the map PACKED_SMI_ELEMENTS, which can be turned into arbitrary read/write on the JavaScript heap.
Gulizia wrote that the bug was present in both maglev and turbofan, Security Affairs reported, the two compiler tiers V8 uses to optimize JavaScript execution. That detail matters: both of Chrome’s JIT compilers carried the same logic error, not just one code path.
Google is aware that an exploit for CVE-2026-85046 exists in the wild. As is standard practice, Google did not disclose technical details about the attacks or attribute them to a specific threat actor, a step meant to limit copycat exploitation while the patch rolls out.
A Pattern, Not a One-Off
Google has now addressed six actively exploited Chrome zero-days in 2026: CVE-2026-2441 in February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April, CVE-2026-11645 in June, and CVE-2026-85046 in September. Every one of those flaws also carried a CVSS score of 8.8, and three of the six trace to the V8 JavaScript engine specifically, alongside bugs in CSS, the Skia 2D graphics library, and the Dawn WebGPU component.
That concentration in V8 tracks the same trend documented in our Cybersecurity Attacks Statistics, where complex, performance-critical engines keep generating the memory safety bug classes attackers weaponize fastest. V8’s compiler pipeline is a frequent target because it sits at the intersection of untrusted web content and native code execution. A single logic error in how it tracks array element types can collapse the browser’s sandbox protections.
What’s Next?
Six in-the-wild zero-days in nine months is a faster cadence than Chrome saw in prior years, and it puts pressure on enterprise patch-management teams that batch browser updates on a weekly or monthly cycle rather than pushing them immediately. Chromium-based browsers built on the same engine, including Microsoft Edge, Brave, Opera, and Vivaldi, need matching fixes as their vendors ship them. Until then, those browsers carry the same exposure. IT teams should treat any unpatched Chromium browser on the network as a live risk, not a routine backlog item, given Google has already confirmed active exploitation.
SQ Magazine’s Takeaway
This update is a routine fix for a specific bug, but the count behind it is the real story. Six actively exploited zero-days in a single browser engine, all landing on the same severity band, points to attackers who have found a reliable seam in V8’s compiler internals and keep coming back to it rather than a string of unrelated coincidences. Naming the exact mechanism, a type confusion between packed element maps that turns into heap read/write, matters because it tells defenders what class of bug to watch for in future advisories, not just which CVE number to patch.
