CVE-2026-85046 (CVSS 8.8): Google Chrome V8 Zero-Day Actively Exploited — Update to 152.0.7977.82 Now

Your Chrome browser may be running a version right now that lets a remote attacker execute arbitrary code inside your browser sandbox — just by visiting a webpage. That is not a hypothetical: CVE-2026-85046 is under active exploitation in the wild, Google has rushed out an emergency patch, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog with a mandatory federal patch deadline of September 18, 2026. If your endpoint fleet includes even one unpatched Chromium-based browser — and it almost certainly does — you have a critical exposure gap that attackers are actively probing right now.

What Is CVE-2026-85046? The V8 Type Confusion Explained

Google Chrome’s V8 engine is the high-performance JavaScript and WebAssembly runtime that powers virtually every web application you use daily. V8 aggressively optimises JavaScript execution through two JIT (Just-In-Time) compiler tiers — Maglev and TurboFan — both of which are affected by this vulnerability.

The flaw is classified as CWE-843: Access of Resource Using Incompatible Type (Type Confusion). Security researcher Salvatore Gulizia (handle: Serotav), who discovered and reported the bug on August 4, 2026, described it precisely:

“A V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS. This can be turned into arbitrary read/write on the JavaScript heap.”

In plain language: V8 can be tricked into treating an array as if it contains a different type of data than it actually does. Once an attacker achieves this type confusion, they can read and write arbitrary memory locations on Chrome’s JavaScript heap — a powerful primitive for building a full exploit chain.

Attack Chain: From a Webpage Visit to Code Execution

Exploitation requires only that a victim loads attacker-controlled web content. A successful attack chain looks like this:

1. Delivery: Victim clicks a phishing link, visits a compromised legitimate site, or loads a malicious advertisement
2. Trigger: The malicious page delivers crafted JavaScript/HTML that triggers the V8 type confusion in Maglev or TurboFan
3. Memory corruption: Object type mismatch corrupts Chrome’s memory access assumptions, granting heap read/write primitives
4. Sandbox execution: Arbitrary code executes inside Chrome’s renderer sandbox
5. Escalation (optional): For full system compromise, a second vulnerability (sandbox escape or privilege escalation) would be required — Google has not confirmed whether such a chain is active

The attack requires no authentication and no special privileges. It is remotely reachable over the network. User interaction — specifically, visiting the malicious page — is the only prerequisite.

Scope: Every Chromium-Based Browser Is Affected

The V8 engine is shared across the entire Chromium ecosystem. This means the vulnerability is not limited to Google Chrome. Every browser built on the Chromium codebase inherits the flaw and requires its own vendor patch on its own timeline:

Browser	Status	Action
Google Chrome	Patched	Upgrade to 152.0.7977.82 or later
Microsoft Edge	Patch expected	Apply Edge security update when available; check Edge release notes
Brave	Patch expected	Update via Brave’s own release channel
Opera	Patch expected	Update Opera to latest stable
Vivaldi	Patch expected	Update Vivaldi to latest stable

In enterprise environments — particularly in India — Microsoft Edge is often the mandated corporate browser. Do not assume a Chrome patch is sufficient: Edge must be patched independently.

Context: Chrome’s Worst Year for Zero-Days

CVE-2026-85046 is the sixth actively-exploited Chrome zero-day patched in 2026, continuing a troubling trend. With three-plus months still remaining in the year, 2026 is on track to surpass 2024’s record of ten exploited Chrome zero-days. This frequency reflects both the growing sophistication of browser-focused threat actors and the enormous attack surface that Chrome presents as the world’s dominant browser platform.

This also underscores a systemic problem: auto-update alone is insufficient for enterprise risk management. When patches are rolling out across millions of endpoints over hours or days, and attackers are actively exploiting the bug, the window between patch availability and actual endpoint remediation represents real business risk. India’s large IT and BPO sectors, where browser-based workflows dominate, are particularly exposed.

For context on how browser-based attack chains combine with credential theft at the network layer, see our earlier coverage of BigBear 2.0 — the MFA-bypassing phishing platform that hit 258 Microsoft 365 organisations with India as ground zero.

What You Should Do Right Now

From 30 years of hands-on network and endpoint security practice, here is the prioritised response I recommend for IT leaders and security teams:

Immediate (within 24 hours)

• Force-update Chrome across all managed endpoints to version 152.0.7977.82 or later. Do not wait for auto-update rollout. Push via GPO, Intune MDM, or your endpoint management platform immediately.
• Verify, do not assume. Run a browser version inventory query now. In most MDM/EDR consoles you can query for chrome.exe product version. Any endpoint below 152.0.7977.82 is actively vulnerable.
• Apply updates to all Chromium-based browsers — Edge, Brave, Opera, Vivaldi — as vendor patches become available. Track vendor security advisories for each.
• Alert your SOC and helpdesk teams about this vulnerability. Suspicious post-browser activity (unexpected process spawns, new persistence mechanisms, EDR alerts) on endpoints that were running unpatched Chrome should be treated as potential exploitation events.

Short-Term (within 1 week)

• Review proxy and DNS logs for the period before September 4, 2026 (when the patch was released). Look for visits to newly registered domains, unusual redirect chains, or drive-by download patterns from employees running vulnerable Chrome versions.
• Enable Chrome browser management in Google Workspace or Intune if you have not already. Enforce minimum browser version policies and block major version downgrades.
• Federate your vulnerability management tool with browser version data. CVE-2026-85046 should appear in your scanner’s findings for all unpatched Chromium-based browsers within days of signature updates.
• Test your patch compliance SLA. The 14-day window between patch release (Sept 4) and CISA’s federal deadline (Sept 18) is the new industry benchmark for critical browser vulnerabilities. Can your organisation actually meet it?

Longer-Term Strategic Actions

• Establish a browser hardening baseline: disable unused extensions, enforce Safe Browsing (Enhanced protection), restrict installation of third-party extensions via policy.
• Consider browser isolation for high-risk user populations (finance, HR, executives) who regularly browse external sites.
• Invest in endpoint detection capability for browser exploitation indicators — renderer crash analysis, child process anomaly detection, and post-exploitation persistence monitoring.

These same disciplines that protect against CVE-2026-85046 are exactly the kind of layered controls we help organisations build. We recently covered how the Microsoft September 2026 Patch Tuesday also contained two actively exploited Windows zero-days — combining endpoint hygiene for browsers and OS together is the only defensible posture.

CISA KEV: Why Government Timelines Now Apply to You

CISA’s Known Exploited Vulnerabilities catalog has evolved from a compliance checklist for federal agencies into the de facto global standard for critical patch prioritisation. When CISA adds a vulnerability to KEV, it is because exploitation is confirmed and widespread enough to represent clear, present danger.

CVE-2026-85046 was added on September 4, 2026, with a September 18 remediation deadline for FCEB agencies. For private organisations, especially those with government contracts, regulated data, or critical infrastructure connections, this timeline should be adopted as your own. CISA’s KEV catalog is free to monitor and should be part of every organisation’s vulnerability prioritisation workflow.

Frequently Asked Questions

Is my organisation affected if we use Microsoft Edge instead of Chrome?

Yes. Microsoft Edge is built on the Chromium engine and shares the same V8 JavaScript runtime. Edge has its own patch timeline and Microsoft will release a security update addressing CVE-2026-85046. Monitor the Microsoft Edge security release notes and apply updates as soon as they are available.

Can antivirus or EDR solutions detect exploitation of CVE-2026-85046?

Modern EDR solutions can detect post-exploitation activity — unexpected child processes spawned from the Chrome renderer, anomalous memory writes, new persistence mechanisms, or privilege escalation attempts. However, the in-sandbox exploit itself may evade signature-based detection. The primary defence is patching. Use EDR telemetry as a secondary detection layer, not a substitute for the patch.

Google confirmed exploitation but hasn’t named the threat actor — should I be concerned regardless?

Absolutely. Google’s policy of withholding attribution details while patches roll out is standard practice to protect ongoing investigations. The lack of named attribution does not mean the threat is limited or low-volume. Active exploitation of a CVSS 8.8 browser zero-day typically indicates access-as-a-service or targeted campaigns by well-resourced threat actors. Treat the risk as high regardless of attribution.

We have 10,000 endpoints across multiple India office locations. How do we manage this at scale?

Centralised browser management is the answer. For Google Chrome: use Chrome Browser Cloud Management or deploy Chrome policies via Active Directory/Intune that enforce minimum version requirements. For Edge: use Microsoft Intune or SCCM to push updates and set minimum version policies. For compliance tracking: query your endpoint management or vulnerability management platform for current browser versions. If you lack this visibility today, consider it a priority gap to close before the next zero-day — which, in 2026, will likely come within weeks.

Sources and Further Reading

• The Hacker News — Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
• Security Affairs — CISA Adds Google Chromium V8 Flaw to KEV Catalog
• SOC Prime — CVE-2026-85046 Technical Analysis
• CISA Known Exploited Vulnerabilities Catalog
• SOCRadar CVE Radar — CVE-2026-85046

---