Google shipped an emergency Chrome update on September 4, 2026, to close a zero-day vulnerability that attackers are already using against real targets. If you use Chrome — and roughly 69% of the web does — you need to update right now.

What Is CVE-2026-85046?

CVE-2026-85046 is a type confusion vulnerability in V8, Chrome’s JavaScript and WebAssembly engine. It carries a CVSS score of 8.8, which is “High” on the severity scale, but the real story is that it’s being exploited in the wild. Google confirmed this directly: “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”

The bug was reported by security researcher Salvatore Gulizia (Serotav) on August 4, 2026, who earned a $1,000 bug bounty for the find. In his technical write-up, Gulizia explained the root cause: a compiler bug in V8 causes an array containing PACKED_ELEMENTS to incorrectly receive the map PACKED_SMI_ELEMENTS, which an attacker can turn into arbitrary read/write access on the JavaScript heap. From there, it’s a straight path to arbitrary code execution — inside Chrome’s sandbox, but that sandbox has been bypassed before.

Who Is Affected?

Everyone running Chrome on Windows, macOS, or Linux. The fixed versions are Chrome 152.0.7977.82/.83 for desktop. If your browser hasn’t auto-updated yet, you’re vulnerable. Chromium-based browsers like Microsoft Edge, Brave, and Opera may also be affected depending on how quickly they ship the V8 fix downstream.

Firefox and Safari users are not affected — Firefox uses SpiderMonkey and Safari uses WebKit, neither of which shares Chrome’s V8 codebase.

CISA Added It to the KEV Catalog Immediately

The same day Google published the patch, CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch agencies have until September 18, 2026 to patch — a 14-day window that reflects how CISA scores real-world exploitation over theoretical severity. Private organizations aren’t legally bound by CISA’s directive, but smart security teams treat any KEV addition as an immediate priority. If attackers are already exploiting it, the window between patch release and mass exploitation is measured in days, not weeks.

The 2026 Chrome Zero-Day Trend

CVE-2026-85046 is the sixth actively exploited Chrome zero-day Google has patched in 2026. That’s roughly one every six weeks. The previous five were CVE-2026-2441 (February), CVE-2026-3909 and CVE-2026-3910 (March), CVE-2026-5281 (April), and CVE-2026-11645 (June). That cadence tells you something important: browser security is a continuous patching problem, not a periodic one. If you’re not treating Chrome updates as urgent every time they land, you’re falling behind.

How the Attack Works

The attack vector is a crafted HTML page. An attacker hosts or tricks you into visiting a webpage containing malicious JavaScript that triggers the type confusion bug in V8. Once the type confusion is exploited, the attacker gains arbitrary read/write on the JavaScript heap, which can be leveraged to execute code outside the normal browser restrictions. While the exploit runs inside Chrome’s sandbox, researchers have repeatedly demonstrated sandbox escape techniques that chain with V8 exploits to achieve full system compromise.

Notably, the Exploit Prediction Scoring System (EPSS) gave this vulnerability only a 0.5% probability of exploitation within 30 days as of September 4 — despite Google already confirming in-the-wild use. This is a good reminder that automated scoring systems are useful tools, but they’re not a substitute for treating confirmed zero-days as emergencies.

What You Need to Do

• Update Chrome immediately. Go to Settings > About Chrome and let it check for updates. Restart the browser. Verify your version is 152.0.7977.82 or newer.
• Restart your browser. Chrome downloads updates in the background but doesn’t apply them until you restart. A quick “Update and restart” is all it takes.
• Check your organization’s browsers. If you manage endpoints, verify Chrome is updated across all systems. Don’t assume auto-update has fired for everyone.
• Watch for Edge and Brave updates. Chromium-based browsers typically lag Google’s release by a few days. Check for updates on those as well.
• Treat every KEV addition seriously. CISA’s catalog exists for a reason. When a vulnerability lands on it, the timeline for exploitation is already running.

The takeaway is straightforward: this is a real, active threat against the world’s most widely used browser. The fix exists. The only question is whether you’ve applied it. Go check your Chrome version right now.