- Published on
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
- Authors
- Name
- DeepHorus
Google has released critical security updates for its Chrome browser, addressing a high-severity zero-day vulnerability that is being actively exploited in the wild. The flaw, identified as CVE-2026-85046, carries a CVSS score of 8.8 and involves a type confusion bug within the V8 JavaScript engine. This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox by luring a user to a specially crafted HTML page. The urgent patch is part of a broader update fixing a total of 12 security issues.
The vulnerability was discovered and responsibly reported by security researcher Salvatore Gulizia on August 4, 2026. Gulizia, who received a $1,000 bug bounty, described the issue as a compiler bug that can corrupt array element types, leading to potential arbitrary read/write access on the JavaScript heap. Google confirmed that an exploit for this flaw exists in active attacks, though it withheld specific details to allow users time to update and to prevent further malicious use.
This latest update marks the sixth actively exploited Chrome zero-day Google has patched since the beginning of 2026. It follows previously disclosed vulnerabilities including CVE-2026-2441, CVE-2026-3909, and CVE-2026-5281. The recurring pattern of critical zero-days underscores persistent security challenges within the V8 engine, which is foundational to the performance of modern web applications. Users are strongly advised to update immediately to version 152.0.7977.82 or later for optimal protection.
The implications of this vulnerability are significant, as it could compromise user systems through routine web browsing. While no specific attack campaigns have been publicly detailed, the active exploitation confirms it is a tangible threat. Google's decision to withhold technical details is a standard precaution to maximize the patching window before attackers can reverse-engineer a fix. This approach prioritizes widespread user security over immediate transparency.
Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also at potential risk and should apply corresponding security updates as soon as they become available. The update is available for Windows, Apple macOS, and Linux platforms. To install it, users must navigate to the "About Google Chrome" section in their browser settings and relaunch the application.
Looking ahead, the continued discovery and exploitation of V8 vulnerabilities suggest that Google's security teams face an ongoing battle. The company will likely accelerate its security review processes for the V8 engine to mitigate future risks. This incident serves as a stark reminder for all internet users to enable automatic updates and maintain vigilant browsing habits to defend against rapidly evolving web-based threats.
