Google fixes actively exploited V8 flaw in Chrome 152

Google has issued Chrome security updates for 12 vulnerabilities, including CVE-2026-85046, a high-severity V8 zero-day that is being actively exploited. The flaw has a CVSS score of 8.8 and is fixed in Chrome 152.0.7977.82/.83 for Windows and Apple macOS, and Chrome 152.0.7977.82 for Linux.

CVE-2026-85046 is a type-confusion vulnerability in V8, Chrome’s JavaScript and WebAssembly engine. Google said that an exploit exists in the wild, but it did not disclose attack details while the update is rolling out.

Crafted web page could execute code in the sandbox

The CVE description states that versions of Chrome before 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page. That makes timely browser updates especially important for organisations whose staff routinely open external websites, documents and web applications.

Security researcher Salvatore Gulizia, also known as Serotav, discovered and reported the issue on August 4, 2026. Google awarded a $1,000 bug bounty for the responsible disclosure.

Gulizia’s technical write-up described a compiler issue in V8 in which an array containing PACKED_ELEMENTS can receive the PACKED_SMI_ELEMENTS map. The researcher said this condition can be turned into arbitrary read and write access on the JavaScript heap.

Six Chrome zero-days exploited this year

This patch brings Google’s count of actively exploited Chrome zero-days addressed since the start of 2026 to six. The other vulnerabilities are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645.

The scale of Chrome’s patching activity is also visible in Google Chrome patching and wider attack activity, which documents 370 Chrome flaws closed alongside attacks affecting SonicWall, SaaS and DNS services.

Google advises users to open More, Help and About Google Chrome, then select Relaunch to ensure the latest version is running. Users of Chromium-based browsers, including Microsoft Edge, Brave, Opera and Vivaldi, should apply equivalent fixes when their vendors release them. For businesses, the immediate implication is to verify browser versions across managed endpoints, prompt relaunches where required, and follow up on updates for all Chromium-based browsers in use.