Google Chrome V8 Flaw Actively Exploited in the Wild, Update Released

Google has released an urgent update for Chrome Stable to address CVE-2026-85046, a high-severity type confusion vulnerability in the V8 JavaScript and WebAssembly engine that is actively being exploited.

This flaw can allow remote attackers to execute code within Chrome’s sandbox by convincing a victim to open a specially crafted HTML page.

The security update upgrades Chrome to version 152.0.7977.82/.83 for Windows and macOS users, while Linux users receive version 152.0.7977.82.

Google stated that the update will be distributed gradually over the coming days and weeks. However, both organizations and individual users are encouraged to check their installed version and force an immediate update.

Google Chrome V8 Flaw

Tracked as CVE-2026-85046, this issue is a type-confusion bug in V8, Chrome’s engine for processing JavaScript and WebAssembly. Type confusion occurs when software incorrectly treats a memory object as a different data type, potentially enabling unsafe memory access or allowing attacker-controlled behavior.

According to the CVE record, Chrome versions before 152.0.7977.82 are affected. A remote attacker could exploit a crafted HTML page to trigger the bug and execute arbitrary code within Chrome’s sandboxed renderer process. The vulnerability is rated as high severity, with a CVSS base score of 8.8.

Google has confirmed awareness of an exploit for CVE-2026-85046 in the wild; however, it has not disclosed details about the attackers, their targets, or the exploit chain used in the observed attacks. This approach aligns with Google’s policy of limiting access to bug reports until most users have applied the fix.

The flaw was reported by security researcher Salvatore Gulizia, known as Serotav, on August 4, 2026, and Google awarded him a $1,000 bug bounty for his discovery.

The Chrome 152.0.7977.82/.83 release includes 12 security fixes. In addition to the V8 bug, the update resolves several other high-severity issues affecting core browser components.

These fixes address an out-of-bounds read in CrashReporting, incomplete cleanup in Network, a use-after-free flaw in Compositing, a V8 race condition, an out-of-bounds write in WebGL, improper resource exposure in CacheStorage, and use-after-free vulnerabilities in DevTools and Skia. Google also patched a type confusion issue in Compositing.

Although Google has only confirmed in-the-wild exploitation for CVE-2026-85046, the number of high-severity fixes makes this a significant security release for enterprise environments.

Attackers can deliver browser exploits through malicious websites, compromised legitimate sites, phishing links, online advertisements, or social media messages. Since exploitation may begin as soon as a user loads attacker-controlled web content, browser updates should be treated as a priority rather than deferred maintenance.

To update Chrome, users should open the three-dot menu, select Help, and choose About Google Chrome. The browser will automatically download the latest release; users must then relaunch Chrome to complete the installation.

Administrators should verify endpoint versions via browser management platforms and ensure that Windows and macOS devices are running version 152.0.7977.82 or later. In contrast, Linux deployments should run version 152.0.7977.82 or later.

Additionally, organizations should investigate any systems that accessed suspicious links or websites before the patch was applied.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.