Chrome V8 Zero-Day CVE-2026-85046 Is Under Attack: Patch Now

Google shipped the fix for CVE-2026-85046 on September 3, and if you haven't restarted Chrome since, you're still running the vulnerable build. The flaw sits in V8, the engine that runs every script your browser touches, and Google has confirmed attackers were already using it before the patch existed. That's what "zero-day" means here: not a theoretical risk, an active one. CVSS score: 8.8. Restart your browser today, then come back and read how bad this actually is.

• CVE-2026-85046 is a high-severity (CVSS 8.8) type confusion bug in V8, Chrome's JavaScript and WebAssembly engine, patched in the Stable Channel on September 3, 2026.
• Google confirmed an exploit already existed in the wild at the time of patching, making this a genuine zero-day rather than a preemptive fix.
• CISA added it to the Known Exploited Vulnerabilities catalog on September 4, with a September 16 remediation deadline for U.S. federal agencies.
• It's the sixth Chrome zero-day patched in 2026, all rooted in memory-safety failures inside V8's JIT compiler.

What is CVE-2026-85046, in plain terms?

Security researcher Salvatore Gulizia reported the bug to Google on August 4, 2026. Google spent about a month fixing it quietly, which is the usual pattern for something this serious, and pushed the fix through the Stable Channel on September 3. The fixed builds are Chrome 152.0.7977.82 and .83 for Windows and macOS, and 152.0.7977.82 for Linux. Google's advisory on the Chrome Releases blog confirmed something worth sitting with for a second: an exploit for this bug already existed in the wild when the patch went out. That's not Google being cautious. That's Google saying someone used this against real users before a fix was available to stop them.

RelatedMetabase Zero-Day Let Attackers Grab Admin, No Login

What is a type confusion bug, actually?

V8 keeps track of what kind of object every piece of memory represents: a string, an array, a number, a function. Its JIT compiler speeds things up by making assumptions about those types ahead of time, then generating optimized machine code around those assumptions instead of checking types the slow way on every operation. A type confusion bug tricks V8 into believing a piece of memory is one type when it's actually another. Once that assumption breaks, the engine reads or writes memory using the wrong object's layout, and an attacker who controls the JavaScript or HTML that triggered the mix-up can use that gap to manipulate memory the page was never supposed to touch. That's the read/write primitive researchers keep mentioning: the ability to read and write memory inside the browser process that you shouldn't have access to, which, chained with the right follow-up bug, can turn into full code execution.

Am I affected, and how do I check?

Chrome has more than 3 billion users worldwide, and anyone running a version older than 152.0.7977.82 (or .83 on Windows and macOS) was exposed before the patch landed. Chromium-based browsers, Edge, Brave, Opera, Vivaldi and others, typically pull the same V8 fixes within a few days of Google's release, so don't assume you're clear just because you don't technically run Chrome. To check your own version, open chrome://settings/help. That page also triggers an update check and, on most systems, a one-click relaunch button that finally applies whatever fix has been sitting downloaded and unused.

Why does V8 keep producing these bugs?

This is the sixth Chrome zero-day patched in 2026. Five other V8 zero-days were already fixed earlier this year before CVE-2026-85046 showed up. That's not a run of bad luck, it's a structural feature of how JIT compilers work. V8's speed comes from making aggressive assumptions about types and compiling optimized code around them, skipping the safety checks a plain interpreter would run every single time. Every new optimization path is a new place where an assumption can turn out wrong, and wrong type assumptions in a JIT are exactly what type confusion bugs exploit. Browser vendors have spent years hardening V8 against this class of vulnerability, and they keep finding more of them anyway, because a compiler that rewrites its own logic based on runtime behavior is a huge, constantly shifting attack surface, especially as new JavaScript features keep getting added on top of it.

RelatedA 9.8 Oracle E-Business Suite Flaw Is Under Active Attack

What's the real difference between "patched" and "safe"?

Chrome doesn't apply a security update the moment Google ships it. The new binary downloads quietly in the background, but the vulnerable code stays loaded and running in memory until you actually close and reopen the browser. Anyone who leaves a pile of tabs open for days, which is most people, is running a browser that already downloaded its own fix and simply isn't using it yet. For a bug Google says was already being exploited, that gap matters more than it usually does. The CISA deadline makes the same point from the other direction: federal agencies have until September 16 to remediate under the KEV listing, but that's a compliance date, not a technical one. The actual fix has been sitting on their machines since September 3.

1. Earlier in 2026The pattern starts Five other V8 zero-days already patched this year, each traced back to memory-safety bugs in the JIT compiler.
2. Aug 4, 2026Salvatore Gulizia reports CVE-2026-85046 Type confusion bug disclosed privately to Google's security team.
3. Sept 3, 2026Stable Channel patch ships Chrome 152.0.7977.82/.83 (Windows, macOS), 152.0.7977.82 (Linux). Google confirms in-the-wild exploitation.
4. Sept 4, 2026CISA adds it to the KEV catalog Formal confirmation of active exploitation for U.S. agencies.
5. Sept 16, 2026Federal remediation deadline U.S. federal agencies must patch under CISA's binding directive.
6. 2026 running totalSix V8 zero-days patched in 2026 CVE-2026-85046 is the sixth confirmed in-the-wild Chrome zero-day this year.

Our take: why did an actively exploited zero-day pay out just $1,000?

Gulizia's bounty for CVE-2026-85046 was $1,000. On the open exploit market, a Chromium bug with in-the-wild viability and sandbox-escape potential routinely sells for six figures, sometimes well beyond that, to brokers who resell to government buyers or surveillance vendors. That gap is arguably the real story here, not just the patch. A $1,000 payout is roughly what you'd expect for a moderate bug with no real-world impact, not for a type confusion flaw serious enough to land on CISA's KEV list with a federal deadline attached to it. Google's reward tables haven't scaled with what these bugs are actually worth to people who'd rather buy one quietly than report it. Every cycle where a critical, already-exploited zero-day earns a bounty two orders of magnitude below its black-market price is a cycle where the incentive to disclose responsibly gets a little weaker. Researchers with rent and mortgages to pay notice that math, even when, like Gulizia, they report anyway.

Original analysis by GenZTech, based on Help Net Security's reporting and Google's official advisory.