Hackers are exploiting another Chrome zero-day – Google rolls out urgent patch
Chrome users are advised to check that they're running the patched release.
Image by Matthias Balk/Getty Images
- Google patched 12 Chrome vulnerabilities, including CVE-2026-85046, a high-severity zero-day already exploited.
- The flaw affects V8 and can let a remote attacker run code through a crafted HTML page.
- Google has not said who is exploiting the bug, who is targeted, or how widely it has been used.
- Users should update Chrome and relaunch the browser to install version 152.0.7977.82 or later.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Google released a fresh security update on Thursday for 12 Chrome vulnerabilities, including a high-severity zero-day that is already being exploited in the wild.
The vulnerability, tracked as CVE-2026-85046 with a severity rating of 8.8, was reported by researcher Salvatore Gulizia on August 4th. He earned a $1,000 bug bounty for the disclosure.
It’s a type confusion vulnerability in V8, Google's open-source JavaScript and WebAssembly engine. A type confusion flaw is a software bug that can allow attackers to execute malicious code, crash the system, or steal sensitive data.
The company said it’s aware that an exploit for CVE-2026-85046 exists in the wild. However, it didn’t specify who is exploiting it, who is being targeted, or how widely it has been used.
“Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page,” says the CVE record for CVE-2026-85046.
In a blog post, Gulizia describes it as “a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS”. In simple terms, the bug causes V8 to incorrectly interpret the type of data stored in an array, allowing an attacker to manipulate parts of the browser's memory.
The update is available as Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, with other users expected to receive it in the coming days or weeks. Chrome 152.0.7977.82 is also rolling out to Android users.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
This is the sixth Chrome zero-day Google has patched in 2026. Previous vulnerabilities included CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.
Chrome users are advised to check that they're running the patched release. You can go to More > Help > About Google Chrome and select Relaunch to ensure you’ve got the latest version.
Google has faced other security issues recently. Researchers at New York University (NYU) and Radboud University built a modular detection system, dubbed AdLens, that analyzed 188,000 ad creatives using open-weight AI models, including Google’s Gemma, and identified hundreds of deceptive software ads.
