Chrome zero-day CVE-2026-85046 is an actively exploited, high-severity type confusion bug in V8, Chrome's JavaScript and WebAssembly engine, and it is the sixth Chrome zero-day exploited in the wild in 2026. Google patched it on September 3, 2026 as one of 12 fixes in the release, and confirmed that "an exploit for CVE-2026-85046 exists in the wild" without detailing the attacks. The flaw carries a CVSS score of 8.8, and a crafted HTML page can trigger it to execute arbitrary code inside the browser sandbox on versions before 152.0.7977.82.

The bug was reported on August 4, 2026 by security researcher Salvatore Gulizia (aka Serotav), who described it as a V8 compiler flaw where an array holding PACKED_ELEMENTS receives the PACKED_SMI_ELEMENTS map, turning into an arbitrary read and write on the JavaScript heap. That primitive is the classic foundation for a full browser exploit chain. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026, giving federal agencies until September 18 to patch.

Users should update Chrome to 152.0.7977.82 or .83 on Windows and macOS, and 152.0.7977.82 on Linux, by going to More, Help, About Google Chrome, and selecting Relaunch. Anyone running a Chromium-based browser such as Microsoft Edge, Brave, Opera, or Vivaldi should apply their vendor's matching update as soon as it ships, because they share the vulnerable V8 engine.

What is a V8 type confusion vulnerability?

Type confusion happens when code treats a block of memory as one data type when it is really another, so the engine reads or writes fields that do not exist as the programmer expected. In V8, that lets an attacker forge object internals and gain an arbitrary read and write over the JavaScript heap, which is the building block for escaping the interpreter and running native code. It is one of the most common and most powerful browser bug classes, which is why V8 flaws show up so often in the zero-day count.

How many Chrome zero-days have been exploited in 2026?

Six, as of this fix. CVE-2026-85046 joins CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645 as actively exploited Chrome zero-days patched since the start of the year. The steady cadence underlines that the browser is a front-line attack surface, and that a single unpatched engine reachable by a malicious web page is enough to compromise an endpoint.

Our read

An actively exploited browser zero-day with a public technical write-up is a patch-today item, and its modest 8.8 score should not slow anyone down: the exploit already exists, and inclusion in CISA KEV is the signal that matters far more than EPSS here. The recurring pattern of V8 type confusion bugs is a reminder that the browser is effectively part of the attack surface of every employee, not a low-risk consumer app. The defensible posture is fast, verified patch rollout for browsers, then confirming that the update actually landed on endpoints rather than assuming auto-update did its job.

Reporting by The Hacker News; CVSS and description per CVE.org; exploitation and KEV status per CISA. Sources linked above.

Related: What is a zero-day? and What is CISA KEV?.