Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026), Actively Exploited V8 Type Confusion

Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026) (TL-2026-2326) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-09-04 and last reviewed 2026-09-05. It has no confirmed attribution, affects Google Chrome (Windows), references 1 CVE (CVE-2026-85046), maps to 14 MITRE ATT&CK techniques (T1059.007, T1068, T1189), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-2326

Threat ID
TL-2026-2326
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-04
Last reviewed
2026-09-05
Attribution confidence
LOW
Motivation
UNKNOWN
Target regions
Global
Detection rules
9
Indicators of compromise
31
Updates
2026-09-05 · 2 updates · revalidated 2× · latest source

Malware and tooling in Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

Malware and tooling: Chrome Compositing component, Chrome DevTools component, Chrome Mobile component (Android), Chrome Skia component, Chrome Transactions Platform component (iOS), Chrome WebGL component (Android), Maglev (V8 mid-tier JIT compiler), TurboFan (V8 optimizing JIT compiler), V8 (JavaScript and WebAssembly engine)

Google patched CVE-2026-85046, a high-severity (CVSS 8.8) type confusion vulnerability in Chrome's V8 JavaScript/WebAssembly engine, confirming an exploit exists in the wild. It is the sixth Chrome zero-day patched in 2026, fixed in Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) alongside 11 other bugs in the same release.

How Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026) works

CVE-2026-85046 is a type confusion (CWE-843) vulnerability in V8, the JavaScript and WebAssembly engine shared by Chrome and other Chromium-based browsers. Per the discovering researcher, Salvatore Gulizia (handle Serotav), the root cause is a bug in V8's Maglev and TurboFan JIT compilers: an array holding the PACKED_ELEMENTS elements-kind is incorrectly given the PACKED_SMI_ELEMENTS map, an elements-kind confusion that can be turned into an arbitrary read/write primitive on the JavaScript heap. Because the flaw sits in the compiler's type-assumption logic rather than a single API, it is triggerable purely through specially crafted JavaScript embedded in an HTML page — no plugin or native code is required.

Google's advisory states only that "an exploit for CVE-2026-85046 exists in the wild," without disclosing the threat actor, targeting, or whether the bug was chained with a sandbox-escape or renderer-to-kernel flaw for full compromise; the description scopes impact to arbitrary code execution "inside the sandbox," and GBHackers explicitly notes Google "has not revealed whether this vulnerability was chained with other flaws in observed attacks." CyberInsider's coverage is more conservative than most outlets on the delivery question, quoting Google directly: "it is not yet known who is exploiting the vulnerability, which users or organizations are being targeted, or how the exploit is reaching victims." Separately, CyberSecurityNews describes the pathways typical of this exploit class rather than confirmed-for-this-CVE vectors: "A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites" — consistent with how prior 2026 Chrome V8/Skia/Dawn zero-days were weaponized, but not independently confirmed as the actual vector used against CVE-2026-85046 victims. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms remote, low-complexity, unauthenticated exploitation that requires user interaction (e.g., visiting a page or following a link).

Gulizia reported the bug on 2026-08-04 via the Chrome Vulnerability Reward Program (tracked as Chromium issue 542403045, access-restricted pending the fix rollout) and received a $1,000 bounty. Google shipped the fix in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, announced via the Stable Channel Update blog post on 2026-09-01, with the CVE record published in NVD on 2026-09-03. The same release fixed 11 other bugs, individually tracked as CVE-2026-85042 through CVE-2026-85053 (excluding 85045/85046): CVE-2026-85042 (use-after-free in DevTools, high severity, reported capable of code execution *outside* the sandbox — a materially more severe class of bug than CVE-2026-85046 itself); CVE-2026-85043 (incomplete cleanup in Network, high, bypass of system access restrictions via crafted network traffic); CVE-2026-85044 (use of released resource in Mobile/Android, medium, requires social engineering to bypass the web origin policy); CVE-2026-85047 (improper input validation in the iOS Transactions Platform component); CVE-2026-85048 (use-after-free in Compositing, high, also reported capable of code execution outside the sandbox, but requiring an attacker who has already compromised the renderer process); CVE-2026-85049 (use-after-free in Skia, high, inside the sandbox); CVE-2026-85050 (out-of-bounds write in WebGL on Android, high); CVE-2026-85051 (type confusion in Compositing, high, inside the sandbox); CVE-2026-85052 (out-of-bounds read in CrashReporting, allows reading memory outside the sandbox given an already-compromised renderer); and CVE-2026-85053 (improper resource exposure in CacheStorage, high, inside the sandbox). SecurityWeek characterizes the release as 9 additional high-severity fixes plus 2 medium-severity fixes (improper input validation, use-after-free) beyond the CVE-2026-85046 zero-day, with 3 of the 12 total fixes credited to external researchers. None of these 11 sibling bugs is confirmed by Google or reporters to have been actively exploited or chained with CVE-2026-85046; they are documented here for release-scope/patch-verification completeness, not as confirmed components of the observed CVE-2026-85046 attack.

This is the sixth actively-exploited Chrome zero-day patched in 2026, following CVE-2026-2441 (Feb, CSSFontFeatureValuesMap/CSS memory corruption), CVE-2026-3909 and CVE-2026-3910 (Mar, Skia out-of-bounds write / V8 inappropriate implementation), CVE-2026-5281 (patched 2026-04-01, use-after-free in Dawn/WebGPU requiring an already-compromised renderer process, fixed in Chrome 146.0.7680.177/178, later added to the CISA KEV catalog), and CVE-2026-11645 (Jun, V8 out-of-bounds read/write) — continuing a pattern of sustained real-world targeting of Chrome's V8 JIT compilers and rendering-adjacent components. As of this record's publication, no attribution to a specific threat actor, campaign, or commercial spyware vendor has been reported for CVE-2026-85046, and it has not yet appeared in the CISA Known Exploited Vulnerabilities catalog (the four prior 2026 Chrome V8/Skia/Dawn zero-days — CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 — are already KEV-listed).

MITRE ATT&CK techniques used in TL-2026-2326

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1189 Drive-by Compromise; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service

Defense Evasion

T1211 Exploitation for Defense Evasion

Resource Development

T1583.008 Malvertising; T1584 Compromise Infrastructure; T1587.004 Develop Capabilities; T1588.005 Exploits; T1588.006 Vulnerabilities; T1608.004 Drive-by Target

Affected products and versions in Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

  • Google — Chrome (Windows)
    Vulnerable versions: < 152.0.7977.82
    Fixed in: 152.0.7977.82; 152.0.7977.83
  • Google — Chrome (macOS)
    Vulnerable versions: < 152.0.7977.83
    Fixed in: 152.0.7977.82; 152.0.7977.83
  • Google — Chrome (Linux)
    Vulnerable versions: < 152.0.7977.82
    Fixed in: 152.0.7977.82
  • Google — V8 JavaScript/WebAssembly engine (Chromium open-source project)
    Vulnerable versions: Chromium builds prior to the M152 stable merge
    Fixed in: Chromium M152 stable

Remediation for Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

Patches

  • Chrome 152.0.7977.82/.83 (Windows/macOS)
  • Chrome 152.0.7977.82 (Linux)

Immediate actions

  • Update Google Chrome to 152.0.7977.82/.83 (Windows/macOS) or 152.0.7977.82 (Linux) immediately via chrome://settings/help or the built-in auto-updater
  • Restart the browser after updating — Chrome downloads the patch in the background but does not activate it until relaunch
  • Push the update fleet-wide via enterprise management (Google Admin console / Chrome Browser Cloud Management, GPO, or Jamf) given Google's confirmation of in-the-wild exploitation
  • Verify Chrome on Android and iOS is also updated to 152.0.7977.82-equivalent builds, since this release also fixes mobile-specific bugs (CVE-2026-85044 Android, CVE-2026-85047 iOS, CVE-2026-85050 Android)

Workarounds

  • No practical workaround exists short of disabling JavaScript or blocking untrusted web browsing entirely, which is not viable for most environments; immediate patching is the only effective mitigation

Longer-term hardening

  • Enable and monitor Chrome auto-update policy compliance across managed endpoints so future V8 zero-day patches roll out within hours, not days
  • Enable Site Isolation and Enhanced Safe Browsing to reduce the blast radius of a renderer-process compromise
  • Track the 2026 pattern of repeat V8/JIT-compiler zero-days (six so far) and apply the same urgency to other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) that inherit the V8 engine
  • Apply URL/ad-network filtering and phishing-resistant email/link protections given sourced delivery vectors (malicious ads, phishing links, social-media-delivered links, compromised legitimate sites)
  • Investigate any endpoints that accessed suspicious or unfamiliar links/websites in the window before the patch was applied, per Techzine's incident-response guidance for this release

CVEs associated with Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

CVE-2026-85046

Weaknesses (CWE) in Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

CWE-843

Timeline of Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

  • Google patches CVE-2026-2441, the first actively exploited Chrome zero-day of 2026 (memory corruption in CSSFontFeatureValuesMap), establishing the year's pattern of repeat browser 0-days.
  • Google patches CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 inappropriate implementation) as the second and third actively exploited Chrome zero-days of 2026; both were discovered internally on 2026-03-10.
  • Google patches CVE-2026-5281, a use-after-free in Dawn (WebGPU) exploitable by an attacker who has already compromised the renderer process, the fourth actively exploited Chrome zero-day of 2026, in Chrome 146.0.7680.177/178; later added to the CISA KEV catalog.
  • Google patches CVE-2026-11645, a V8 out-of-bounds read/write (CVSS 8.8), the fifth actively exploited Chrome zero-day of 2026, in Chrome 149.0.7827.102/.103.
  • Security researcher Salvatore Gulizia (Serotav) reports the V8 Maglev/TurboFan elements-kind type confusion bug (Chromium issue 542403045) to Google via the Chrome Vulnerability Reward Program.
  • Google publishes the Chrome Stable Channel Update blog post announcing Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux), fixing CVE-2026-85046 among 12 total security issues in the release, 3 of which were credited to external researchers.
  • NVD publishes individual CVE records for the remaining 11 bugs fixed alongside CVE-2026-85046 in Chrome 152.0.7977.82/.83 (CVE-2026-85042 through CVE-2026-85053), including two use-after-free bugs reported capable of code execution outside the sandbox (DevTools CVE-2026-85042, Compositing CVE-2026-85048) and Android/iOS-specific fixes (CVE-2026-85044, CVE-2026-85047, CVE-2026-85050); none is confirmed actively exploited or chained with CVE-2026-85046.
  • CVE-2026-85046 is published in the NVD with a CVSS 3.1 base score of 8.8 and CWE-843 (Type Confusion) classification.
  • CISA adds CVE-2026-85046 to the Known Exploited Vulnerabilities catalog, citing active exploitation and the risk type confusion bugs pose to the federal enterprise.
  • Salvatore Gulizia (Serotav) publishes a technical writeup ('When Sorting Leads to Confusion') detailing the Maglev TryReduceArrayPrototypeSort inline-sort map-check root cause, the fill()-driven map migration to PACKED_SMI_ELEMENTS, and the addrof/fakeobj exploitation primitives that yield arbitrary heap read/write.
  • Security media (SecurityWeek, The Hacker News, Security Affairs, GBHackers, Techzine, CyberInsider, CyberSecurityNews) report CVE-2026-85046 as the sixth actively exploited Chrome zero-day of 2026; Google withholds exploitation details and attribution to allow patch rollout to complete.
  • The NVD record for CVE-2026-85046 is last modified, and Google's advisory confirms an exploit for the flaw exists in the wild.
  • CISA BOD 26-04 remediation deadline for Federal Civilian Executive Branch agencies to patch CVE-2026-85046.

Update history for TL-2026-2326

Sources cited for Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026)

More in vulnerability

Detection coverage for TL-2026-2326

As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2326 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats