Chrome Patches Exploited V8 Zero-Day: Update Now

Google shipped Chrome 152.0.7977.82 on Thursday to fix 12 security vulnerabilities, including one already under active attack. If you run Chrome, this is a patch-first-ask-questions-later situation.

The exploited flaw is CVE-2026-85046, a type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine. CVSS score is 8.8 (High). A remote attacker can exploit it to execute arbitrary code inside the browser sandbox using a crafted HTML page, meaning a visit to a malicious site is all it takes.

Security researcher Salvatore Gulizia (also known as Serotav) reported the bug to Google on August 4, 2026, and received a $1,000 bug bounty. Google confirmed active exploitation but held back attack details pending widespread adoption of the patch.

What to do

Update Chrome to 152.0.7977.82 or later now. On Windows and macOS the patched versions are 152.0.7977.82 and 152.0.7977.83; on Linux it is 152.0.7977.82. To update: click the three-dot menu, go to Help > About Google Chrome, let the update download, then relaunch.

Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi pull from the same V8 codebase. Each vendor will need to ship its own build; apply those updates as soon as they land.

Context

This is Chrome’s sixth actively exploited zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

V8 type confusion bugs are a reliable attacker target. The bug class lets a crafted script cause V8 to treat a JavaScript object as the wrong type, which an attacker can turn into controlled memory access. Microsoft Edge’s CVSS 8.8 type confusion patch last week was a different flaw but the same underlying bug class.

The $1,000 bounty Google paid Gulizia is on the low end of V8 payouts; that suggests the exploitation complexity was moderate rather than trivial, though clearly not prohibitive given that someone found a working path before disclosure.