Google has released an update for the Chrome browser to fix a high-severity zero-day vulnerability in the V8 engine, along with 11 other security issues.
The vulnerability, identified as CVE-2026-85046, is categorized as a type confusion flaw. Researcher Salvatore Gulizia, known online as “Serotav,” reported it to Google.
This update upgrades Chrome to version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, as part of a phased rollout.
According to Google, “an exploit for CVE-2026-85046 exists in the wild.”
The company has not disclosed specific technical details about the flaw to allow users and dependent projects time to implement the fix.
Type confusion flaws can lead to software misinterpreting one type of object as another, potentially allowing attackers to corrupt memory.
V8 is Chrome’s open-source JavaScript and WebAssembly engine that compiles and executes website code. CVE-2026-85046 could be triggered by a specially crafted HTML page with malicious JavaScript, possibly enabling remote code execution within Chrome's sandboxed renderer process.
The update also addresses nine other high-severity vulnerabilities, including use-after-free and out-of-bounds memory issues in various components such as Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia, and a race condition in V8.
CVE-2026-85046 marks the sixth actively exploited bug fixed in Chrome this year. Previous vulnerabilities addressed include:
- An out-of-bounds read and write issue in Chrome’s V8 JavaScript engine (CVE-2026-11645), patched in June.
- An iterator invalidation vulnerability (CVE-2026-2441) in CSSFontFeatureValuesMap, fixed in mid-February.
- Two zero-days exploited in March: an out-of-bounds write flaw in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation issue in V8 (CVE-2026-3910).
- A use-after-free vulnerability in Dawn (CVE-2026-5281), patched in April.
Chrome users are urged to install the update as soon as it becomes available by navigating to Settings > About Chrome and waiting for the update to download and install. A browser restart is necessary for the fixes to take effect.
Users of Chrome-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, should also take similar action, although it may take a few extra days for the updates to be implemented in those applications.
Read more...