Talk Around Town: Chrome's Sixth 2026 Zero-Day Is a V8 Type Confusion Bug Already Loose in the Wild

What Folks Are Sayin': The Buzz on CVE-2026-85046

Well, butter my biscuit, Chrome done got itself a fresh hole — and this one's already been shot through like a screen door in a hurricane. Word around the security community is that CVE-2026-85046, a type confusion vulnerability sitting inside Chrome's V8 JavaScript and WebAssembly engine, carries a CVSS score of 8.8 and lets a remote attacker run arbitrary code inside the Chrome sandbox by lobbing a crafted HTML page at a victim, according to The Hacker News and Help Net Security. That's the kind of thing that'll make a sysadmin's sweet tea go sour real fast.

The chatter got louder when Google itself confirmed in a Thursday security advisory, as reported by Help Net Security, that a working exploit for this particular nastiness is already floating around in the wild. Nobody's naming names or showing receipts on the full attack chain just yet — Google's keeping that barn door shut — but the fact that it's confirmed exploited is enough to make anybody worth their salt reach for the update button.

What We Actually Know: The Confirmed Facts

Here's what multiple independent, high-quality sources have pinned down tighter than a tick on a hound dog. The vulnerability sits in Chrome versions below 152.0.7977.82, and Google shipped the remedy as part of a 12-fix Stable Channel update rolled out on September 3 and 4, 2026, according to Help Net Security and The Hacker News. The patched builds are version 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux, per Help Net Security and SOC Prime — anything below those numbers is still sitting out in the thunderstorm.

Security researcher Salvatore Gulizia, who goes by the handle Serotav, spotted this critter first and reported it to Google on August 4, 2026, walking away with a $1,000 bug bounty for his trouble, according to The Hacker News and Help Net Security. CISA piled on September 4, 2026, adding the bug to its Known Exploited Vulnerabilities catalog and — per AiCybr — setting a September 18, 2026 remediation deadline for covered federal systems, though the DEV Community post cites September 16 instead; readers are advised to check the official CISA KEV catalog for the authoritative date.

This is also, per The Hacker News and Time News, the sixth actively exploited Chrome zero-day Google has had to cork this calendar year. Three of those six, including this one, have taken aim specifically at V8 — which, bless its heart, is starting to look like the front porch screen that keeps getting kicked in. SOC Prime and Time News also note that Google has locked down the Chromium bug tracker entry while the patch finishes rolling out, which analysts describe as the company's standard playbook for actively exploited flaws.

What Nobody's Proved Yet: The Unverified Parts

Now hold your horses, because some details are murkier than a catfish pond in August. Google has not publicly disclosed what real-world attacks using CVE-2026-85046 actually looked like — specifically, nobody knows yet whether adversaries chained this bug together with a separate sandbox escape to claw their way all the way out to the host machine. That matters a whole heap, because the confirmed technical scope, per SOC Prime, AiCybr, and Time News, is code execution inside the Chrome sandbox only — not a full escape. Getting from inside the sandbox to full host compromise would require bolting on another vulnerability entirely, like needing a second key to open the second deadbolt.

Additionally, not all Chromium-based browser vendors — Microsoft Edge, Brave, Opera, and Vivaldi among them — had publicly confirmed they'd shipped builds incorporating the corresponding V8 fix at the time of publication, according to SOC Prime and Time News. Those browsers share the underlying Chromium components and are therefore exposed until their own updates land, but the timing of those releases remained unconfirmed.

Analysis: V8 Is Starting to Look Like a Recurring Problem

Now this here is analysis, not settled reporting, so saddle up accordingly. Three V8 zero-days in a single calendar year is the kind of pattern that ought to make Google's engine team feel about as comfortable as a long-tailed cat in a room full of rocking chairs. V8 is extraordinarily complex — it has to be, running the JavaScript that powers the whole modern web — but complexity is exactly the kind of thick brush where type confusion bugs like to hide and breed.

The fact that the attacker entry point is just a crafted HTML page is also worth chewing on. No phishing attachment, no drive-by download prompt — just a webpage that a user visits and suddenly there's arbitrary code running inside their browser sandbox. For an attacker who already has a sandbox escape in their back pocket, that's a dangerously short distance to full host access. The remediation story here is, blessedly, simple: update Chrome and do it fast, because the exploit already exists and somebody out there is apparently using it.