# Chrome patches a V8 zero-day already being exploited in the wild

Chrome 152.0.7977.82/.83 fixes CVE-2026-85046, a high-severity V8 type-confusion vulnerability that Google says already has an exploit in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day.

This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.

- Status: Active
- Published: 2026-09-07T15:05:00+12:00
- Updated: 2026-09-07T15:05:00+12:00
- Categories: Web Development, Browsers & Web Standards
- Tags: browser security, Chrome, CVE-2026-85046, cybersecurity, V8
- Canonical HTML: https://beyondthe.news/dossiers/chrome-cve-2026-85046-v8-zero-day-exploited

## What changed

Google’s September 3 Chrome stable-channel update fixes CVE-2026-85046, a high-severity type-confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome. Google says an exploit for the vulnerability exists in the wild. The fixed desktop versions are 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux. Public vulnerability records describe crafted HTML as the delivery path for executing arbitrary code inside the browser sandbox. CISA added CVE-2026-85046 to the Known Exploited Vulnerabilities catalog on September 4.

## Why it matters

A browser zero-day is also a development and operations dependency when Chrome is used for testing, automation, managed workstations and browser-based administrative tooling. Confirmed exploitation changes the patch decision from normal release hygiene to an immediate version-verification problem. The important boundary is equally clear: Google has not described this vulnerability itself as a sandbox escape, so BTN should not turn 'code execution inside the browser sandbox' into a broader host-compromise claim without evidence.

## The vulnerable component is V8

CVE-2026-85046 is a type-confusion flaw in Chrome’s V8 JavaScript and WebAssembly engine. Public vulnerability data says a remote attacker can reach it through crafted HTML and execute arbitrary code inside the sandbox.

## Google confirms active exploitation

Google’s security advisory says an exploit exists in the wild. That moves the issue beyond a theoretical high-severity CVE and justifies accelerated patching and fleet verification.

## The fixed-build boundary is explicit

Windows and macOS users need Chrome 152.0.7977.82/.83 or later; Linux users need 152.0.7977.82 or later. Managed environments should verify deployed versions rather than assume an update policy has already reached every machine.

## Do not overstate what the advisory proves

The available public evidence establishes code execution inside Chrome’s sandbox. It does not, by itself, establish a sandbox escape, server-side V8 exploitability, or compromise of every Chromium-derived runtime. Those broader questions require product-specific advisories.

## Key details

- CVE-2026-85046 is a high-severity type-confusion vulnerability in V8.
- Google says an exploit exists in the wild.
- The Chrome fix shipped September 3, 2026.
- Fixed desktop versions are 152.0.7977.82/.83 for Windows/macOS and 152.0.7977.82 for Linux.
- Public vulnerability records describe crafted HTML as a route to arbitrary code execution inside the browser sandbox.
- CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026.

## Builder takeaways

- Verify the actual Chrome build on developer and administrative workstations rather than relying only on automatic-update assumptions.
- Prioritize managed browser fleets and machines used to access production consoles, credentials or sensitive internal applications.
- Update pinned browser images used in end-to-end testing and automation where Chrome itself is part of the maintained runtime.
- Do not assume Chromium-based products are patched on Chrome’s schedule; check their own release/advisory status before making claims.
- Avoid treating this CVE as a confirmed sandbox escape unless later evidence establishes that chain.

## What to watch

- Any public exploitation details released after patch adoption rises.
- Whether browser vendors or Chromium-derived products publish their own affected/fixed-version guidance.
- CISA or other agencies updating remediation deadlines or campaign details.
- Any evidence that the exploit is being chained with a sandbox escape or privilege-escalation flaw.

## Uncertainties

- Google has withheld technical exploit details while users update.
- Public reporting does not identify the attackers, targets or campaign scope.
- The Chrome advisory alone does not establish impact on every V8 or Chromium embedding.

## Sources

- [Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html) — Google Chrome Releases · primary security release · 2026-09-03T00:00:00+12:00. Primary fixed versions and Google's in-the-wild exploitation statement.
- [CISA adds one known exploited vulnerability to catalog](https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog) — CISA · government advisory · 2026-09-04T00:00:00+12:00. Confirms KEV addition based on evidence of active exploitation.
- [CVE-2026-85046 advisory](https://github.com/advisories/ghsa-84qv-4wj5-wwmm) — GitHub Advisory Database · vulnerability record · 2026-09-03T00:00:00+12:00. Summarizes affected Chrome versions and arbitrary-code-execution-inside-sandbox description.