If Chrome zero-days were a punch card, Google would be handing out a free sandwich right about now. This is the sixth one patched in 2026, and like the others, it's not a "someday you should probably update" situation — it's a "someone is actively using this right now" situation.

A Type Confusion Bug With a Big Appetite

Google shipped an emergency fix for CVE-2026-85046, an actively exploited type confusion flaw in V8, Chrome's JavaScript and WebAssembly engine. The bug lets a crafted webpage trick V8 into treating one kind of array as another, which can be leveraged into arbitrary read/write access on the JavaScript heap — and from there, code execution inside Chrome's sandbox.

Researcher Salvatore Gulizia reported it privately on August 4 and picked up a $1,000 bounty for the find. Google patched it in Chrome 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux. CISA added it to the Known Exploited Vulnerabilities catalog on September 4, giving federal agencies until September 18 to patch.

Why "It's Just a Browser Update" Undersells It

All an attacker needs is for a victim to load one malicious page — no download, no click-through, no "are you sure?" dialog. That's the entire attack surface, and it's the same attack surface every visitor to every website you run walks through daily.

The part people skip past: this is exploit #6 for the year, and Google still isn't saying who's behind it or who's been hit. That silence isn't reassuring — it usually means the investigation is ongoing and the blast radius isn't fully known yet.

Chrome auto-updates for most people, but "most people" isn't the same as "everyone," and a stale browser is an open door with a welcome mat.

If your business's website security strategy is "we'll patch it when we remember," now's a good moment to change that — grab our free developer security checklist and tighten things up before the seventh zero-day of the year shows up.

Source: The Hacker News