Summary
Google has patched CVE-2026-85046, a High-severity type confusion vulnerability in Chrome’s V8 JavaScript and WebAssembly engine that is being actively exploited in the wild, with the fix shipped in Stable 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux on September 3, 2026. Rated CVSS 8.8, the flaw allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page, with the researcher attributing the root cause to a compiler bug affecting both Maglev and TurboFan that yields an arbitrary read/write primitive on the JavaScript heap. Google has withheld attack details pending broad patch adoption, and no threat actor or targeting has been attributed. Organizations should update Chrome immediately and track fixes for other Chromium-based browsers, which share the vulnerable V8 code.
Vulnerability Details
Finding #1
Google has confirmed that a V8 vulnerability in Chrome is under active exploitation and has shipped a fix in Stable 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, released September 3, 2026. Tracked as CVE-2026-85046 and rated High, the flaw is a type confusion bug in V8, the JavaScript and WebAssembly engine shared by Chrome and all Chromium-based browsers, and is one of 12 security issues resolved in this build.
Finding #2
The CVE record assigns a CVSS score of 8.8 and describes the bug as allowing a remote attacker to execute arbitrary code inside the sandbox by luring a victim to a crafted HTML page. In a separate blog post, the researcher attributes the root cause to a compiler bug in which an array holding PACKED_ELEMENTS is assigned the PACKED_SMI_ELEMENTS map, yielding an arbitrary read/write primitive on the JavaScript heap, and notes the bug was present in both the Maglev and TurboFan compilers. This is researcher-reported and not yet confirmed by Google, whose bug tracker entry remains restricted.
Finding #3
Google has withheld attack details pending broad patch adoption, and no threat actor, malware, or targeting has been attributed in the available reporting. This is reported to be the sixth actively exploited Chrome zero-day patched in 2026. Organizations should update Chrome immediately and track other Chromium-based browsers, which share the vulnerable V8 code and will ship fixes on their own schedules. Industry patch guidance likewise flags this release for priority deployment ahead of next week’s scheduled Patch Tuesday cycle.
Vulnerability & CPE Reference
| CVE ID | Affected Products | Affected CPE | CWE ID |
|---|---|---|---|
CVE-2026-85046 | Google Chrome (Before 152.0.7977.82 Linux; Before 152.0.7977.82/.83 Windows, macOS) | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | CWE-843 |
Recommendations
Upgrade all Chrome installations to 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux. Users can force the update via More > Help > About Google Chrome and then Relaunch; enterprises should push the build through their management tooling.
Microsoft Edge, Brave, Opera, and Vivaldi share the vulnerable V8 code. Track each vendor’s release channel and apply the corresponding update as soon as it is published; HKCERT has already issued a parallel Microsoft Edge bulletin.
Because Google has confirmed in-the-wild exploitation but not published attack details, review browser process telemetry for anomalous renderer crashes, unexpected child processes spawned by chrome.exe, and outbound connections following visits to low-reputation domains from at least August 4, 2026 onward.
Where immediate patching is not possible, restrict browsing to allow-listed destinations, enable Enhanced Safe Browsing, and consider temporarily disabling JavaScript for untrusted zones.
Configure Chrome enterprise policies to disallow update deferral and to relaunch within a defined window after an update is staged, so that future zero-days are closed automatically.
MITRE ATT&CK TTPs
References & Patch Links
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
- https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260904
- https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)