A single web page is now enough to run attacker-controlled code inside Chrome, and Google has confirmed people are already using it that way.
What CVE-2026-85046 actually does
The flaw sits in V8, the JavaScript and WebAssembly engine that powers every Chromium-based browser, not just Chrome itself. It is a type confusion bug: V8 treats a piece of memory as one data type when it is actually another, and a specially crafted HTML page can use that mismatch to break out of the interpreter’s own assumptions and execute arbitrary code inside the browser’s sandbox. CVSS scored it 8.8. Google’s own advisory states plainly that an exploit for this vulnerability exists in the wild.
It is the sixth Chrome zero-day patched in 2026, which tells you something about how consistently V8’s complexity keeps producing exploitable bugs, and how consistently attackers keep finding them before defenders do. Researcher Salvatore Gulizia reported the issue on August 4 and was awarded a $1,000 bounty, a reminder of how large the gap can be between what a bug is worth to a bounty programme and what it is worth to whoever weaponised it first.
The fix, and why “we’ll patch on the normal cycle” is the wrong call here
Google shipped the fix in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux on September 3, rolling it out progressively rather than to every user at once. That progressive rollout matters operationally: a fleet-wide Chrome version check the day after a security release can still show unpatched machines simply because the update has not reached them yet, not because anything failed.
CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, with public researchers already reporting seven proof-of-concept repositories, one of them assessed as weaponised. Chrome auto-updates by default, but plenty of European organisations run locked-down enterprise images, kiosk deployments, or Chromium-based Electron apps that do not update on the same schedule as a consumer install, and any of those is a live exposure until confirmed otherwise.
What to check this week
Confirm your fleet is actually on 152.0.7977.82 or later, not just that auto-update is theoretically enabled. That means checking managed endpoints, VDI images, CI runners that launch headless Chrome, and any Electron-based internal tool built on an older Chromium release, since those often lag months behind the browser itself. If your organisation has any regulatory obligation around known exploited vulnerabilities, this one is already on the list that matters.
If you need help auditing browser and Chromium-dependent application versions across your environment, or building a patch management process that catches the next actively exploited zero-day before it becomes an incident, contact Excello Digital. We help European teams close this kind of gap before it gets used against them.