Google pushed out an emergency Chrome update on September 4, 2026 after learning that a security flaw in the browser was already being used in real attacks. The vulnerability, tracked as CVE-2026-85046, sits inside V8, the open-source engine that handles JavaScript and WebAssembly code for Chrome and many other browsers built on Chromium.
The bug is what security researchers call a type confusion flaw. In plain terms, this happens when a program treats a piece of data as one type of object when it is actually a different type, which can let an attacker trick the browser into running commands it should never allow. According to Google’s own security bulletin, cited by BleepingComputer reporter Bill Toulas, “Google is aware that an exploit for CVE-2026-85046 exists in the wild.” The company did not name the attacker or say how many people had been targeted.
An attacker exploiting this flaw would typically need a victim to visit a web page containing specially crafted HTML and JavaScript. If successful, the code could run inside Chrome’s sandboxed renderer process, the part of the browser meant to isolate untrusted web content from the rest of the operating system. Escaping that sandbox usually requires chaining the bug with additional exploits, though Google’s advisory did not detail whether that had happened in this case.
The flaw was reported by a researcher using the handle “Serotav,” identified in Google’s credits as Salvatore Gulizia. Google fixed the issue along with nine other high-severity bugs, including several use-after-free and out-of-bounds memory errors, in Chrome version 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. This is the sixth actively exploited Chrome zero-day Google has patched since the start of 2026, a pace that shows how often browser engines remain a favored target for attackers looking for a foothold on a target’s device.
Chrome updates itself automatically in most cases, but the update only takes effect after the browser is restarted. Users can also trigger it manually by opening Chrome’s menu, going to Help, then About Google Chrome, which prompts the browser to check for and install the latest version. People running Chromium-based browsers such as Microsoft Edge, Brave, or Opera should also watch for updates from those vendors, since they often rely on the same V8 engine and have needed matching patches during previous Chrome zero-day incidents.
This is not the first time Chrome’s V8 engine has been targeted by attackers before a patch was available. Cybersecurity Weekly covered a similar case back in January 2024, when Chrome shipped a fix for an actively exploited zero-day while other Chromium-based browsers remained vulnerable for a period afterward.
Source: BleepingComputer, Bill Toulas
