cyber.hendryadrian.com
Vulnerability & Exploit · helpnetsecurity.com

Google patches actively exploited Chrome zero-day CVE-2026-85046

· Original article ↗

Summary

Google patched 12 Chrome vulnerabilities, including actively exploited CVE-2026-85046, a high-severity V8 type confusion flaw. Chrome updates are rolling out for Windows, macOS and Linux.

Key points

  • Google confirmed an exploit for CVE-2026-85046 is being used in the wild.
  • The high-severity flaw is a type confusion bug in Chrome’s V8 JavaScript and WebAssembly engine.
  • A crafted HTML page could allow remote code execution inside Chrome’s sandbox.
  • Google shipped fixes in Chrome 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux; rollout will continue over the coming days and weeks.
  • Google provided no further details about the zero-day or its exploitation.
  • The article says this is the sixth Chrome zero-day Google has patched in 2026.

Article Details

Vulnerability Types
  • Type confusion
Severity
High (CVSS 8.8)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionThe vulnerability in Chrome's V8 engine could be exploited through a crafted HTML page to execute arbitrary code inside the sandbox.

CVE

CVE-2026-85046Google has patched 12 Chrome vulnerabilities, including CVE-2026-85046, a zero-day that was already being exploited in the wild.

People

Salvatore GuliziaResearcher who reported CVE-2026-85046; the article identifies Serotav as his alias.

Vendors

GoogleGoogle has patched 12 Chrome vulnerabilities, including CVE-2026-85046, a zero-day that was already being exploited in the wild.

Products

Google ChromeGoogle has patched 12 Chrome vulnerabilities, including CVE-2026-85046, a zero-day that was already being exploited in the wild.V8The flaw is a high-severity type confusion bug in Chrome’s V8 engine that could let a remote attacker run arbitrary code through a crafted HTML page.

Related Articles