Overview
- Google released Chrome Stable updates on Friday to fix 12 vulnerabilities, including the high‑severity V8 zero‑day tracked as CVE-2026-85046.
- CVE-2026-85046 is a type‑confusion bug in Chrome’s V8 JavaScript and WebAssembly engine that CVE.org says could let an attacker run code inside the browser sandbox via a crafted HTML page.
- Security researcher Salvatore Gulizia reported the flaw in August and was awarded a $1,000 bug bounty after describing how the compiler bug can be turned into arbitrary read/write on the JS heap.
- Google said an exploit for the bug exists in the wild but did not publish technical details or name an attacker, and it is urging users to update to Chrome 152.0.7977.82/.83 as the fixes roll out.
- This is the sixth Chrome zero‑day patched in 2026 and the update also fixes nine other high‑severity issues such as out‑of‑bounds and use‑after‑free bugs, a pattern that increases urgency for users and other Chromium browser vendors to deploy patches quickly.