In short: Google released an emergency Chrome update on September 4, 2026, patching CVE-2026-85046 — the sixth actively exploited zero-day in the browser this year. A type confusion flaw in Chrome's V8 JavaScript engine let a remote attacker execute arbitrary code inside the browser sandbox simply by directing a victim to a crafted HTML page. The patch is live in the stable channel; make sure Chrome has updated to version 152.0.7977.82 or later.
What happened: Chrome's sixth zero-day of 2026
On September 4, 2026, Google released Chrome 152.0.7977.82 for Windows, macOS, and Linux — an out-of-band update whose sole purpose is closing CVE-2026-85046. This is the sixth actively exploited zero-day Google has patched in Chrome during 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-3545, and CVE-2026-11645.
Security researcher Salvatore Gulizia (alias Serotav) reported the vulnerability to Google on August 4, 2026 — a full month before the patch shipped. Google rated it CVSS 8.8 (High) and paid the researcher a $1,000 bug bounty. Google confirmed active in-the-wild exploitation before the patch was available but has not disclosed details about specific attack campaigns — standard practice to limit copycat exploitation while users update.
The technical flaw: V8 type confusion explained
V8 is the JavaScript and WebAssembly engine embedded in Chrome — it executes all JavaScript code on every page you visit. Type confusion is a class of bugs where a program misidentifies the type of an object in memory and processes it as a different type, leading to dangerous and unintended memory operations.
For CVE-2026-85046, Gulizia's analysis identified a bug in V8's compilers: an array holding mixed-type elements (PACKED_ELEMENTS) could be assigned the descriptor for an integer-only type (PACKED_SMI_ELEMENTS). That mismatch opened a path to arbitrary read and write on the JavaScript heap. In practice, this let a remote attacker execute arbitrary code within the browser's sandbox process — typically the first step in a full device compromise chain.
Crucially, exploitation requires no user action beyond opening a crafted HTML page. Just following a link is enough for attacker code to run. There is no "don't click suspicious things" safety net against this class of vulnerability.
Who is affected and what to do right now
All Chrome versions earlier than 152.0.7977.82 on Windows, macOS, Linux, and Android are affected. The patched versions are 152.0.7977.82 (Linux, Android) and 152.0.7977.82 / 152.0.7977.83 (Windows, macOS).
How to verify and update Chrome:
- Open Chrome and click the three-dot menu (⋮) in the top-right corner.
- Go to Help → About Google Chrome.
- Chrome will automatically check for and begin downloading any available update.
- Click "Relaunch" when prompted — the patch only takes effect after a restart.
On Android, update via the Google Play Store. Enterprise environments with locked auto-updates should escalate immediately: the threat is active now.
For network-level protection, LiMP VPN encrypts traffic between your device and the internet. This does not replace a browser update, but it does protect against DNS spoofing (being redirected to a fake site), ISP-level traffic monitoring, and interception on public networks — complementary layers that address different parts of the threat model.
Six zero-days in eight months: reading the trend
Six actively exploited zero-days in less than nine months is a significant rate. The browser has become the primary attack surface not by accident: it is the single application through which virtually all user activity flows — banking, email, corporate systems, web-based messaging. Attackers and exploit brokers target it accordingly.
The month-long gap between Gulizia's August 4 report and the September 4 patch is a concrete reminder of what zero-day windows mean in practice: during that month, attacks were already happening. Auto-updates are not optional. For environments where automatic updates are unavailable, the risk grows proportionally — and layered defenses matter more.
For a broader look at how browser and application vulnerabilities affect everyday privacy, see the LiMP VPN blog.