Google Chrome has a new personal record, and it's not one you throw a party for: six actively exploited zero-days patched in 2026 alone. The latest, discovered by a researcher who earned a modest $1,000 bug bounty for finding a bug that could've been worth a lot more to the wrong buyer, is now living rent-free in attackers' toolkits.
A Type Confusion Bug With Big Ambitions
Tracked as CVE-2026-85046, the flaw is a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. It lets a remote attacker execute arbitrary code inside the browser sandbox just by getting a victim to load a crafted HTML page — no downloads, no "are you sure?" dialog, just a bad webpage doing bad things. Google rated it 8.8 out of 10 on the CVSS scale and confirmed exploitation is already happening in the wild.
Researcher Salvatore Gulizia reported it responsibly back on August 4, and Google shipped the fix on September 3 in Chrome 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux. As usual, Google is keeping technical details under wraps until most users have updated — which, translated from corporate-speak, means "please stop reading this and go update your browser."
Six Zero-Days Deep and It's Only September
Type confusion bugs keep showing up in V8 because JavaScript engines are basically playing 4D chess with memory types at runtime, and every so often the pieces don't land where they're supposed to. Attackers know this, which is why V8 has become one of the most reliably profitable targets in the browser world.
The part most people skim past: this isn't a "some hacker somewhere" problem. It's a "every employee with a browser open is a potential entry point" problem. One unpatched machine clicking one bad link is all it takes to turn a marketing team's laptop into a foothold on your network.
Auto-update exists for a reason — this is that reason. Restart your browser like your company's security posture depends on it, because this week, it does.
James and the team at Web Technology Kitchen keep an eye on exactly this kind of threat landscape when we harden and maintain client websites — get in touch if you want someone else losing sleep over your patch schedule for a change.
Source: The Hacker News