Chrome ships an emergency fix for an actively exploited V8 flaw (CVE-2026-85046)

Google released an emergency stable-channel Chrome update on 4 September 2026 to fix CVE-2026-85046, a type-confusion bug in the V8 JavaScript engine for which an exploit is already circulating. It is the sixth Chrome zero-day patched since the start of the year. For web teams, the alert does not stop at end-user browsers: the same engine sits inside a large share of the development toolchain.

#What the update fixes

The vulnerability is a type confusion inside V8, the JavaScript and WebAssembly engine shared by Chrome and every Chromium-based browser. It carries a CVSS score of 8.8. In practice, a booby-trapped HTML page can trick the compiler into treating an array as if it held a different value type, which opens an arbitrary read/write primitive on the JavaScript heap and then code execution inside the browser sandbox.

Google confirms active exploitation in its now-familiar wording: the vendor “is aware that an exploit for CVE-2026-85046 exists in the wild.” The flaw was reported on 4 August 2026 by researcher Salvatore Gulizia, who received a 1,000-dollar bounty.

#Which versions to install

The fix ships with the desktop stable channel. The minimum version numbers differ slightly by platform.

Google’s rollout spans several days. On a fleet, it is wise not to wait for the automatic update and to force a version check instead.

A type confusion in V8 turns into arbitrary read/write on the heap, then code execution inside the sandbox.

#Why this goes beyond end-user browsers

V8 and the Chromium core do not live in Chrome alone. Desktop apps built on Electron, components that render web content through an embedded webview, and third-party Chromium browsers — Microsoft Edge, Brave, Opera, Vivaldi — share the same attack surface. An Electron app is not patched because the machine updated Chrome: it bundles its own Chromium build and must be rebuilt and re-shipped.

On the build side the exposure is just as real. CI runners that drive a headless Chromium for end-to-end tests, screenshots or PDF generation execute untrusted code the moment they render an external page. Updating the base image and the Puppeteer or Playwright binaries belongs to the same job as updating the desktop. A server-side hardening baseline does not protect against this vector: the rendering engine itself is the weak point.

#Check and force the update

On a desktop, the chrome://settings/help page triggers the check and the download. From the command line the version number reads directly, which makes it easy to audit a fleet or a command-line tooling environment.

# Linux : version installée du binaire
google-chrome --version
# -> Google Chrome 152.0.7977.82

# macOS : idem via le bundle
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version

# CI : version du Chromium piloté par Playwright
npx playwright --version
npx playwright install chromium   # récupère le build corrigé

In a managed environment, the update is forced through policy: the TargetVersionPrefix key in Chrome policies (or the MDM equivalent) enforces a floor version and closes the exposure window, instead of letting each machine update at its own pace.

#The bottom line

CVE-2026-85046 is an actively exploited V8 flaw, fixed by Chrome 152.0.7977.82 and above. Updating the browser is the priority, but the inventory does not end there: Electron, webviews, third-party Chromium browsers and headless Chromium in CI all rely on the affected engine and are patched separately. Forcing a floor version across a fleet remains the most reliable way to close the gap.

Further reading: the official Chrome stable-channel bulletin (Chrome Releases) details the fixed version and the full list of security patches.