# Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026), Actively Exploited V8 Type Confusion

> Google patched CVE-2026-85046, a high-severity (CVSS 8.8) type confusion vulnerability in Chrome's V8 JavaScript/WebAssembly engine, confirming an exploit exists in the wild. It is the sixth Chrome zero-day patched in 2026, fixed in Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) alongside 11 other bugs in the same release.

- **Published:** 2026-09-04T00:00:00Z
- **Last reviewed:** 2026-09-05T03:06:22.594Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2326
- **ID:** TL-2026-2326
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85046, CVE-2026-85042, CVE-2026-85043

## Description

CVE-2026-85046 is a type confusion (CWE-843) vulnerability in V8, the JavaScript and WebAssembly engine shared by Chrome and other Chromium-based browsers. Per the discovering researcher, Salvatore Gulizia (handle Serotav), the root cause is a bug in V8's Maglev and TurboFan JIT compilers: an array holding the PACKED_ELEMENTS elements-kind is incorrectly given the PACKED_SMI_ELEMENTS map, an elements-kind confusion that can be turned into an arbitrary read/write primitive on the JavaScript heap. Because the flaw sits in the compiler's type-assumption logic rather than a single API, it is triggerable purely through specially crafted JavaScript embedded in an HTML page — no plugin or native code is required.

Google's advisory states only that "an exploit for CVE-2026-85046 exists in the wild," without disclosing the threat actor, targeting, or whether the bug was chained with a sandbox-escape or renderer-to-kernel flaw for full compromise; the description scopes impact to arbitrary code execution "inside the sandbox," and GBHackers explicitly notes Google "has not revealed whether this vulnerability was chained with other flaws in observed attacks." CyberInsider's coverage is more conservative than most outlets on the delivery question, quoting Google directly: "it is not yet known who is exploiting the vulnerability, which users or organizations are being targeted, or how the exploit is reaching victims." Separately, CyberSecurityNews describes the pathways typical of this exploit class rather than confirmed-for-this-CVE vectors: "A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites" — consistent with how prior 2026 Chrome V8/Skia/Dawn zero-days were weaponized, but not independently confirmed as the actual vector used against CVE-2026-85046 victims. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms remote, low-complexity, unauthenticated exploitation that requires user interaction (e.g., visiting a page or following a link).

Gulizia reported the bug on 2026-08-04 via the Chrome Vulnerability Reward Program (tracked as Chromium issue 542403045, access-restricted pending the fix rollout) and received a $1,000 bounty. Google shipped the fix in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, announced via the Stable Channel Update blog post on 2026-09-01, with the CVE record published in NVD on 2026-09-03. The same release fixed 11 other bugs, individually tracked as CVE-2026-85042 through CVE-2026-85053 (excluding 85045/85046): CVE-2026-85042 (use-after-free in DevTools, high severity, reported capable of code execution *outside* the sandbox — a materially more severe class of bug than CVE-2026-85046 itself); CVE-2026-85043 (incomplete cleanup in Network, high, bypass of system access restrictions via crafted network traffic); CVE-2026-85044 (use of released resource in Mobile/Android, medium, requires social engineering to bypass the web origin policy); CVE-2026-85047 (improper input validation in the iOS Transactions Platform component); CVE-2026-85048 (use-after-free in Compositing, high, also reported capable of code execution outside the sandbox, but requiring an attacker who has already compromised the renderer process); CVE-2026-85049 (use-after-free in Skia, high, inside the sandbox); CVE-2026-85050 (out-of-bounds write in WebGL on Android, high); CVE-2026-85051 (type confusion in Compositing, high, inside the sandbox); CVE-2026-85052 (out-of-bounds read in CrashReporting, allows reading memory outside the sandbox given an already-compromised renderer); and CVE-2026-85053 (improper resource exposure in CacheStorage, high, inside the sandbox). SecurityWeek characterizes the release as 9 additional high-severity fixes plus 2 medium-severity fixes (improper input validation, use-after-free) beyond the CVE-2026-85046 zero-day, with 3 of the 12 total fixes credited to external researchers. None of these 11 sibling bugs is confirmed by Google or reporters to have been actively exploited or chained with CVE-2026-85046; they are documented here for release-scope/patch-verification completeness, not as confirmed components of the observed CVE-2026-85046 attack.

This is the sixth actively-exploited Chrome zero-day patched in 2026, following CVE-2026-2441 (Feb, CSSFontFeatureValuesMap/CSS memory corruption), CVE-2026-3909 and CVE-2026-3910 (Mar, Skia out-of-bounds write / V8 inappropriate implementation), CVE-2026-5281 (patched 2026-04-01, use-after-free in Dawn/WebGPU requiring an already-compromised renderer process, fixed in Chrome 146.0.7680.177/178, later added to the CISA KEV catalog), and CVE-2026-11645 (Jun, V8 out-of-bounds read/write) — continuing a pattern of sustained real-world targeting of Chrome's V8 JIT compilers and rendering-adjacent components. As of this record's publication, no attribution to a specific threat actor, campaign, or commercial spyware vendor has been reported for CVE-2026-85046, and it has not yet appeared in the CISA Known Exploited Vulnerabilities catalog (the four prior 2026 Chrome V8/Skia/Dawn zero-days — CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 — are already KEV-listed).

## MITRE ATT&CK

- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1583.008 Malvertising
- T1584 Compromise Infrastructure
- T1608.004 Drive-by Target
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1587.004 Develop Capabilities
- T1189 Drive-by Compromise
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion

## Sources

- [Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html)
- [CVE-2026-85046 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-85046)
- [Chromium Issue 542403045 (V8 type confusion root-cause bug, access-restricted)](https://issues.chromium.org/issues/542403045)
- [Google Patches 6th Chrome Zero-Day of 2026](https://www.securityweek.com/google-patches-6th-chrome-zero-day-of-2026/)
- [Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day](https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html)
- [Google fixes the sixth actively exploited Chrome zero-day of 2026](https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html)
- [Google Chrome V8 Flaw Actively Exploited in the Wild, Update Released](https://gbhackers.com/google-chrome-v8-flaw/)
- [Google patches actively exploited Chrome vulnerability](https://www.techzine.eu/news/security/144060/google-patches-actively-exploited-chrome-vulnerability/)
- [Google fixes actively exploited Chrome V8 zero-day vulnerability](https://cyberinsider.com/google-fixes-actively-exploited-chrome-v8-zero-day-vulnerability/)
- [Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild](https://cybersecuritynews.com/chrome-0-day-flaw-exploited-wild/)
- [CVE-2026-85042: Use after free in Google Chrome - Live Threat Intelligence](https://radar.offseq.com/threat/cve-2026-85042-use-after-free-in-google-chrome-fd0c159242069b7b)
- [CVE-2026-85043: Incomplete cleanup in Google Chrome - Live Threat Intelligence](https://radar.offseq.com/threat/cve-2026-85043-incomplete-cleanup-in-google-chrome-8ac22b54177feab1)
- [Google Patches First Actively Exploited Chrome Zero-Day of 2026 (CVE-2026-2441)](https://www.securityweek.com/google-patches-first-actively-exploited-chrome-zero-day-of-2026/)
- [Google Fixes Two Chrome Zero-Days Exploited in the Wild (CVE-2026-3909, CVE-2026-3910)](https://thehackernews.com/2026/03/google-fixes-two-chrome-zero-days.html)
- [New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation](https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2326