Google has released an emergency security update for Chrome after confirming that attackers are actively exploiting a high-severity vulnerability in the browser's V8 JavaScript and WebAssembly engine.
Tracked as CVE-2026-85046, the flaw is a type confusion vulnerability that can allow a remote attacker to execute arbitrary code inside Chrome's sandbox through a specially crafted HTML page.
The vulnerability has now also been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog, making rapid patching particularly important for organizations.
What Is CVE-2026-85046?
CVE-2026-85046 affects V8, the engine responsible for processing JavaScript and WebAssembly inside Chrome.
Google describes the issue as a type confusion vulnerability.
In simple terms, type confusion occurs when software incorrectly treats a piece of data as a different type than the one it was actually created to represent.
In a complex engine such as V8, this can potentially result in memory corruption.
An attacker who successfully exploits the flaw can potentially turn that memory corruption into the ability to execute arbitrary code within Chrome's security sandbox.
Google's advisory describes the vulnerable versions as Chrome releases before 152.0.7977.82, with the security update released for Windows, macOS and Linux.
The Vulnerability Is Already Being Exploited
The biggest concern is not simply the technical severity of the vulnerability.
It is the fact that Google has confirmed an exploit exists in the wild.
Google's security advisory explicitly states that an exploit for CVE-2026-85046 has been observed outside laboratory conditions.
However, Google has not publicly disclosed who is behind the attacks, how widespread exploitation is, or which organizations have been targeted.
That information is being withheld while users have time to install the security update.
This is standard practice for actively exploited browser vulnerabilities because detailed technical information can make exploitation easier for additional attackers.
How Could an Attack Work?
The vulnerability can be triggered through crafted HTML content.
A simplified attack scenario could look like this:
- An attacker prepares a malicious webpage.
- The page contains JavaScript designed to trigger the V8 vulnerability.
- A victim visits the page using a vulnerable Chrome version.
- The malicious code triggers the type confusion condition.
- The attacker gains the ability to execute code within Chrome's sandbox.
The victim does not necessarily need to download a traditional executable.
That is what makes browser vulnerabilities particularly dangerous.
A malicious website, compromised legitimate website, malicious advertisement or phishing link can potentially become the delivery mechanism.
The vulnerability does require user interaction, according to the published CVSS vector, meaning an attacker cannot simply exploit the flaw remotely against every Chrome installation without some form of victim interaction.
What Does "Inside the Sandbox" Mean?
Chrome uses a security architecture known as a sandbox to isolate browser processes from the underlying operating system.
The idea is straightforward:
Even if malicious content compromises the browser renderer, the attacker should still face additional restrictions before being able to interact freely with the operating system.
CVE-2026-85046 is described as allowing arbitrary code execution inside the Chrome sandbox.
That distinction is important.
It does not mean that this vulnerability by itself has been publicly confirmed as a complete sandbox escape or unrestricted operating-system compromise.
A successful attacker may need additional vulnerabilities or techniques to move beyond the sandbox.
Nevertheless, arbitrary code execution within a browser process is serious and can represent an important stage in a larger attack chain.
Why V8 Vulnerabilities Are Valuable to Attackers
V8 is an extremely complex and highly optimized component.
It translates and executes JavaScript at very high speed and uses sophisticated optimization techniques to improve browser performance.
That complexity creates opportunities for subtle memory-safety vulnerabilities.
A successful V8 exploit can provide an attacker with a foothold inside the browser process.
Historically, browser exploitation chains have combined renderer vulnerabilities with additional bugs to escape security boundaries and ultimately execute code on the host system.
Google has not disclosed whether CVE-2026-85046 is being used as part of a larger exploit chain.
That remains unknown.
Google Released Chrome 152.0.7977.82/.83
Google's September 3 security release addresses 12 vulnerabilities in Chrome.
The affected versions should be updated to:
Windows: Chrome 152.0.7977.82 or .83
macOS: Chrome 152.0.7977.82 or .83
Linux: Chrome 152.0.7977.82
Google notes that the update is rolling out over the following days and weeks.
Because the vulnerability is already being exploited, organizations should not rely on the assumption that Chrome will eventually update itself without verification.
Security teams should confirm the actual browser version installed on managed endpoints.
CISA Adds CVE-2026-85046 to KEV
CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026.
The catalog specifically identifies the vulnerability as a Google Chromium V8 Type Confusion Vulnerability.
For U.S. federal civilian agencies covered by the relevant CISA requirements, the remediation deadline is September 18, 2026.
For other organizations, KEV inclusion is still an important risk signal.
A vulnerability that is both remotely exploitable and confirmed to be used in real-world attacks should generally move toward the top of an organization's patching priority list.
This Is Chrome's Sixth Actively Exploited Zero-Day of 2026
CVE-2026-85046 is the sixth Chrome zero-day that Google has patched after confirming active exploitation this year.
The previously reported vulnerabilities include:
- CVE-2026-2441
- CVE-2026-3909
- CVE-2026-3910
- CVE-2026-5281
- CVE-2026-11645
- CVE-2026-85046
Security researchers have increasingly focused on browser vulnerabilities because browsers are exposed to untrusted content every day.
A successful exploit may only require a user to visit a specially prepared webpage.
Who Is Affected?
The primary affected product is Google Chrome for desktop running versions before the patched release.
Organizations should pay particular attention to:
- Windows workstations
- macOS devices
- Linux desktops
- remote workers
- privileged administrator workstations
- systems used to access sensitive corporate applications
Chrome-based browsers from other vendors use the Chromium project and may incorporate related components, but organizations should not assume that Google's Chrome patch automatically fixes another Chromium-based browser.
Administrators should check for security updates from each browser vendor.
What Organizations Should Do Now
✅ Patch Chrome Immediately
Deploy the latest Chrome security update across managed endpoints.
Because exploitation is already confirmed, this should be treated as a priority rather than a routine browser update.
✅ Verify the Installed Version
Do not simply assume that an endpoint has updated.
Chrome users can open:
Settings → About Chrome
and verify that the browser is running the patched release.
Enterprise administrators should ideally verify versions centrally through their endpoint-management or browser-management platform.
✅ Prioritize High-Risk Users
If immediate organization-wide deployment is difficult, prioritize:
- administrators
- executives
- developers
- finance teams
- security teams
- users with access to production systems
- users handling sensitive data
These accounts can present greater downstream risk if compromised.
✅ Be Careful With Unknown Links
Until patching is complete, users should be particularly cautious about links received through:
- messaging platforms
- social media
- advertisements
- collaboration tools
- unexpected documents or websites
A malicious webpage can be enough to trigger browser vulnerabilities.
✅ Monitor for Suspicious Browser Activity
Security teams should watch for unusual processes or network activity originating from Chrome.
Depending on the organization's tooling, useful indicators may include:
- unexpected child processes
- suspicious command-line execution
- unusual outbound connections
- browser processes spawning system utilities
- abnormal access to sensitive files
- security-tool alerts involving Chrome renderer processes
What We Still Don't Know
Several important details remain unavailable.
Google has not publicly identified:
- the attackers
- the targets
- the number of attacks
- the exploitation campaign
- the exploit chain
- whether the vulnerability is being combined with another zero-day
- whether successful attacks resulted in full device compromise
Google is also keeping the underlying Chromium issue restricted while the update reaches more users.
Therefore, claims about a specific threat actor or campaign should be treated cautiously unless supported by additional research.
Final Thoughts
CVE-2026-85046 is serious for three reasons: it affects a widely deployed browser, it can be triggered through crafted web content, and Google has confirmed that exploitation is already occurring in the wild.
The vulnerability is rated CVSS 8.8 High, not 9.8, and Google has not publicly disclosed the attackers or the full details of the exploitation campaign.
With CISA now listing the vulnerability in its KEV catalog, organizations should treat the update as a high-priority security task.
When a browser zero-day is actively exploited, waiting for the normal patch cycle can leave an unnecessary window of exposure. Verify Chrome versions, prioritize vulnerable endpoints, and deploy the security update as quickly as practical.
