Google has shipped an emergency Chrome update fixing CVE-2026-85046, a high-severity (CVSS 8.8) type confusion bug in the V8 JavaScript and WebAssembly engine that Google confirms is already being exploited in the wild. A malicious HTML page can trigger the flaw to gain arbitrary read/write access on the JavaScript heap, opening the door to code execution inside the browser's sandbox.
The bug was reported on August 4, 2026 by researcher Salvatore Gulizia (Serotav), who earned a $1,000 bounty for the find. Google withheld technical exploit details to give users time to update before attackers can widely weaponize the flaw. Fixed versions are Chrome 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux.
This is the sixth Chrome zero-day Google has patched so far in 2026. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, giving US federal agencies until September 18 to patch. Everyone else should update immediately via chrome://settings/help.