Beyond the News
Sign in
Web DevelopmentBrowsers & Web Standards Active dossier

Chrome patches a V8 zero-day already being exploited in the wild

Chrome 152.0.7977.82/.83 fixes CVE-2026-85046, a high-severity V8 type-confusion vulnerability that Google says already has an exploit in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day.

Reviewed and published by Lars Jansen Updated 4 min read
Comment
First published

Key details

  1. CVE-2026-85046 is a high-severity type-confusion vulnerability in V8.
  2. Google says an exploit exists in the wild.
  3. The Chrome fix shipped September 3, 2026.
  4. Fixed desktop versions are 152.0.7977.82/.83 for Windows/macOS and 152.0.7977.82 for Linux.
  5. Public vulnerability records describe crafted HTML as a route to arbitrary code execution inside the browser sandbox.
  6. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026.

What builders should take away

  1. Verify the actual Chrome build on developer and administrative workstations rather than relying only on automatic-update assumptions.
  2. Prioritize managed browser fleets and machines used to access production consoles, credentials or sensitive internal applications.
  3. Update pinned browser images used in end-to-end testing and automation where Chrome itself is part of the maintained runtime.
  4. Do not assume Chromium-based products are patched on Chrome’s schedule; check their own release/advisory status before making claims.
  5. Avoid treating this CVE as a confirmed sandbox escape unless later evidence establishes that chain.

What changed

Google’s September 3 Chrome stable-channel update fixes CVE-2026-85046, a high-severity type-confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome. Google says an exploit for the vulnerability exists in the wild. The fixed desktop versions are 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux. Public vulnerability records describe crafted HTML as the delivery path for executing arbitrary code inside the browser sandbox. CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog on September 4.

Why it matters

A browser zero-day is also a development and operations dependency when Chrome is used for testing, automation, managed workstations and browser-based administrative tooling. Confirmed exploitation changes the patch decision from normal release hygiene to an immediate version-verification problem. The important boundary is equally clear: Google has not described this vulnerability itself as a sandbox escape, so BTN should not turn 'code execution inside the browser sandbox' into a broader host-compromise claim without evidence.

The vulnerable component is V8

CVE-2026-85046 is a type-confusion flaw in Chrome’s V8 JavaScript and WebAssembly engine. Public vulnerability data says a remote attacker can reach it through crafted HTML and execute arbitrary code inside the sandbox.

Google confirms active exploitation

Google’s security advisory says an exploit exists in the wild. That moves the issue beyond a theoretical high-severity CVE and justifies accelerated patching and fleet verification.

The fixed-build boundary is explicit

Windows and macOS users need Chrome 152.0.7977.82/.83 or later; Linux users need 152.0.7977.82 or later. Managed environments should verify deployed versions rather than assume an update policy has already reached every machine.

Do not overstate what the advisory proves

The available public evidence establishes code execution inside Chrome’s sandbox. It does not, by itself, establish a sandbox escape, server-side V8 exploitability, or compromise of every Chromium-derived runtime. Those broader questions require product-specific advisories.

What to watch next

  • Any public exploitation details released after patch adoption rises.
  • Whether browser vendors or Chromium-derived products publish their own affected/fixed-version guidance.
  • CISA or other agencies updating remediation deadlines or campaign details.
  • Any evidence that the exploit is being chained with a sandbox escape or privilege-escalation flaw.

Still unclear

  • Google has withheld technical exploit details while users update.
  • Public reporting does not identify the attackers, targets or campaign scope.
  • The Chrome advisory alone does not establish impact on every V8 or Chromium embedding.

Sources

Direct reading behind this dossier.

3 sources
Stable Channel Update for Desktop
Google Chrome Releases primary security release

Primary fixed versions and Google's in-the-wild exploitation statement.

CVE-2026-85046 advisory
GitHub Advisory Database vulnerability record

Summarizes affected Chrome versions and arbitrary-code-execution-inside-sandbox description.

Discussion

Discussion is reader-contributed. Comments are not part of the BTN dossier or its editorial evidence.

0 visible comments

Join the discussion

Keep comments useful and relevant. Reader contributions may be moderated and are not BTN editorial evidence.

Sign in to comment
Continue reading
Web Development

Chrome 152 lets websites put the browser behind a network allowlist

Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.