GOOGLE has issued a desktop Chrome security update to fix 12 vulnerabilities, including CVE-2026-85046, a high-severity type-confusion bug in the V8 engine that is already being exploited in the wild. The flaw could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. The detail of the issue notes that V8’s compilers can mishandle array maps, enabling read/write access on the JavaScript heap.
Security researchers credit Salvatore Gulizia (aka Serotav) with discovering and reporting the flaw on 4 August 2026, and the researcher received a $1,000 bug bounty for responsible disclosure. Google acknowledged exploit activity for CVE-2026-85046 but did not publish further technical details to avoid aiding threat actors; the goal is to push users to patch quickly.
The update also tallies six actively exploited Chrome zero-days since the start of the year and lists several related CVEs that have been seen abused previously (CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645). Patches are available in versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. Users are urged to update via More > Help > About Google Chrome and relaunch, with other Chromium-based browsers advised to apply fixes when available. The U.S.
Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog, obliging federal agencies to patch by 18 September 2026.