Cybersecurity
Google patches Chrome zero-day exploited in the wild
Google released Chrome updates to fix 12 vulnerabilities, including CVE-2026-85046, which had been used in attacks, and it told users to install the latest browser builds.
- Google released Chrome security updates on Thursday for 12 vulnerabilities.
- One of the patched issues, CVE-2026-85046, was described as a type-confusion bug in V8.
- CVE.org said the flaw could let a remote attacker run code inside Chrome's sandbox through a crafted HTML page in versions before 152.0.7977.82.
- Google said the vulnerability was being exploited and did not identify the attackers or describe the campaign.
- Google credited Salvatore Gulizia, also known as Serotav, with finding and reporting the issue on 4 August 2026 and said it paid him a $1,000 bounty.
Google released Chrome security updates on Thursday for 12 flaws. One of them was CVE-2026-85046, a type-confusion issue in V8, the browser's JavaScript and WebAssembly engine.
CVE.org said the bug in Chrome before version 152.0.7977.82 could allow a remote attacker to run code inside the browser sandbox through a crafted HTML page. Google said an exploit for the issue existed and did not say who was using it or how.
Salvatore Gulizia, also known as Serotav, said he found and reported the flaw on 4 August 2026. Google said it awarded him $1,000 for responsible disclosure.
Gulizia's separate write-up said the compiler bug could be turned into arbitrary read and write access on the JavaScript heap. Google said it had now fixed six actively exploited Chrome zero-days since the start of the year.
The company told users to update Chrome to 152.0.7977.82/.83 on Windows and macOS, or 152.0.7977.82 on Linux. It also said people using Microsoft Edge, Brave, Opera and Vivaldi should install fixes when they were released.
Named in this story
People
- Salvatore Gulizia (aka Serotav)
- was credited with finding and reporting the flaw
Companies
- released the Chrome security updates and acknowledged active exploitation
Organisations
- CVE.org
- published the flaw description
Products and systems
- Chrome
- received updates for 12 vulnerabilities
- CVE-2026-85046
- was the patched zero-day vulnerability
- V8
- contained the type-confusion bug
- Microsoft Edge
- was told to apply the fix when available
- Brave
- was told to apply the fix when available
- Opera
- was told to apply the fix when available
- Vivaldi
- was told to apply the fix when available
How the source tells it
The source read like a routine security advisory, with mild urgency from the active-exploitation warning and the explicit update instructions.
- urgency the disclosure of active exploitation alongside version-specific install instructions
- threat the high-severity rating and the note that attackers were already using the flaw