Google Patches Actively Exploited Chrome Zero-Day Vulnerability (CVE-2026-85046)
Google has released an emergency security update for Chrome to address a critical zero-day vulnerability, CVE-2026-85046, which is already being exploited in real-world attacks. The flaw affects the V8 JavaScript and WebAssembly engine, a core component of Chrome responsible for processing web content.
The vulnerability is classified as a high-severity type confusion bug, where the browser incorrectly interprets data types, potentially leading to memory corruption. If exploited, attackers could craft malicious JavaScript or web content to trigger browser crashes, data exposure, or arbitrary code execution within the browser process. Exploitation requires minimal user interaction victims may only need to visit a compromised or malicious website, or click on a phishing link delivered via email, ads, or social media.
Google confirmed awareness of active exploitation but did not disclose details about the threat actors, targets, or attack methods. The vulnerability was reported by security researcher Salvatore Gulizia (Serotav) on August 4, 2026, earning a $1,000 bug bounty.
The update, Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux), includes 12 security fixes, with several rated high severity. Other patched issues involve WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting, including race conditions, out-of-bounds writes, and use-after-free flaws. Google is restricting access to some vulnerability details to prevent attackers from reverse-engineering exploits before users patch.
The update rolls out gradually over the coming days and weeks. Users should manually check for updates via Chrome Menu > Help > About Google Chrome and relaunch the browser to apply fixes. Enterprise administrators are advised to ensure managed endpoints are updated to the latest version.
Given the active exploitation of CVE-2026-85046, delaying the update leaves systems vulnerable to known attack vectors. Security teams are encouraged to monitor for suspicious browser activity, particularly phishing campaigns leveraging newly registered domains or fake update prompts.
Source: https://cybersecuritynews.com/chrome-0-day-flaw-exploited-wild/
Google cybersecurity rating report: https://www.rankiteo.com/company/google
"id": "GOO1788503029",
"linkid": "google",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'All Chrome users',
'industry': 'Technology',
'location': 'Global',
'name': 'Google Chrome',
'type': 'Software'}],
'attack_vector': ['Malicious website',
'Phishing link',
'Email',
'Ads',
'Social media'],
'customer_advisories': 'Users advised to update Chrome immediately to '
'mitigate risks.',
'date_detected': '2026-08-04',
'description': 'Google has released an emergency security update for Chrome '
'to address a critical zero-day vulnerability, CVE-2026-85046, '
'which is already being exploited in real-world attacks. The '
'flaw affects the V8 JavaScript and WebAssembly engine, a core '
'component of Chrome responsible for processing web content. '
'The vulnerability is classified as a high-severity type '
'confusion bug, where the browser incorrectly interprets data '
'types, potentially leading to memory corruption. If '
'exploited, attackers could craft malicious JavaScript or web '
'content to trigger browser crashes, data exposure, or '
'arbitrary code execution within the browser process. '
'Exploitation requires minimal user interaction—victims may '
'only need to visit a compromised or malicious website or '
'click on a phishing link delivered via email, ads, or social '
'media.',
'impact': {'data_compromised': 'Potential data exposure',
'operational_impact': 'Browser crashes, arbitrary code execution',
'systems_affected': 'Google Chrome (Windows, macOS, Linux)'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'corrective_actions': 'Patch deployment, '
'restricted access to '
'vulnerability details to '
'prevent reverse-engineering',
'root_causes': 'Type confusion bug in V8 '
'JavaScript and WebAssembly engine'},
'recommendations': 'Users should manually check for updates via Chrome Menu > '
'Help > About Google Chrome and relaunch the browser to '
'apply fixes. Enterprise administrators should ensure '
'managed endpoints are updated. Security teams should '
'monitor for suspicious browser activity, particularly '
'phishing campaigns leveraging newly registered domains or '
'fake update prompts.',
'references': [{'source': 'Security researcher Salvatore Gulizia (Serotav)'}],
'response': {'communication_strategy': 'Public disclosure of vulnerability, '
'restricted access to exploit details',
'containment_measures': 'Emergency security update (Chrome '
'152.0.7977.82/.83)',
'enhanced_monitoring': 'Monitoring for suspicious browser '
'activity, phishing campaigns',
'recovery_measures': 'Relaunch browser to apply fixes',
'remediation_measures': 'Patch deployment, manual update checks'},
'title': 'Google Patches Actively Exploited Chrome Zero-Day Vulnerability '
'(CVE-2026-85046)',
'type': 'Zero-Day Vulnerability',
'vulnerability_exploited': 'CVE-2026-85046 (Type confusion bug in V8 '
'JavaScript and WebAssembly engine)'}