Google Patches Actively Exploited 0-Day in Chrome's V8 Engine

On Thursday, Google shipped a security update for the Chrome browser, patching 12 vulnerabilities at once. One of them, as the company itself acknowledged, is already being used in real-world attacks.

The vulnerability

The flaw has been assigned the identifier CVE-2026-85046 and a CVSS score of 8.8 (high severity). It is a type confusion bug in V8 — the Chrome engine responsible for executing JavaScript and WebAssembly. According to the description on CVE.org, in all browser versions prior to 152.0.7977.82 a remote attacker could achieve arbitrary code execution inside the sandbox by means of a specially crafted HTML page.

The vulnerability was discovered and reported on August 4, 2026 by researcher Salvatore Gulizia, known under the handle Serotav. In his account, the bug arises during the operation of the V8 compilers: an array with elements of type PACKED_ELEMENTS receives a PACKED_SMI_ELEMENTS map, which ultimately allows arbitrary reads and writes in the JavaScript heap. The researcher was awarded a $1,000 bounty for the responsible disclosure.

Attack details withheld

As has become customary, Google confirmed that “an exploit for CVE-2026-85046 exists in the wild,” but declined to disclose details of the attacks — in order to give the majority of users time to install the fix and to avoid provoking new exploitation attempts.

This is already the sixth actively exploited 0-day in Chrome patched since the start of the year. Earlier, the company addressed the vulnerabilities CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645.

What users should do

Google recommends updating the browser to versions 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux as soon as possible. You can check for updates via the menu “More” → “Help” → “About Google Chrome,” after which all that remains is to restart the program.

Other Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi — are also at risk. Their users should install the corresponding fixes as soon as they become available.

Source: The Hacker News