GOOGLE has issued a Chrome security update addressing 12 flaws, including CVE-2026-85046, a actively exploited Type Confusion flaw in the V8 JavaScript and WebAssembly engine. The vulnerability could allow a remote attacker to execute arbitrary code inside the browser sandbox via a specially crafted HTML page. Google notes that an exploit for CVE-2026-85046 exists in the wild, and as with previous disclosures, has not released technical details about the attacks or attributed them to a particular threat actor.
CVE-2026-85046 is identified as the sixth actively exploited Chrome zero-day of 2026. The update follows a sequence of other zero-days addressed this year: CVE-2026-2441 (February, use-after-free in CSS), CVE-2026-3909 and CVE-2026-3910 (March, out-of-bounds write in Skia and a flaw in the V8 engine), CVE-2026-5281 (April, use-after-free in Dawn’s WebGPU component), and CVE-2026-11645 (June, out-of-bounds memory access in V8).
Google has rolled out Chrome Stable updates to version 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux, with the deployment staged over coming days and weeks. The vulnerability was reported by security researcher Salvatore Gulizia, known as Serotav, on 4 August 2026, who received a $1,000 bounty.