Google Chrome CVE-2026-85046 Zero-Day Patch Details
Google Patches Actively Exploited Chrome V8 Zero-Day Flaw
Related Entities(initial)
Organizations
Products & Tech
Other
CVE Identifiers
Full Report(when first published)
Executive Summary
On September 4, 2026, Google released an emergency security update for its Chrome web browser to address a critical zero-day vulnerability tracked as CVE-2026-85046. This high-severity flaw, with a CVSS score of 8.8, is a type confusion bug in the V8 JavaScript engine and is being actively exploited in the wild. Successful exploitation allows a remote attacker to execute arbitrary code by luring a user to a malicious website. This marks the sixth Chrome zero-day patched in 2026, underscoring the persistent threat to browser security. All users are strongly advised to update their Chrome instances to the latest version immediately.
Vulnerability Details
The vulnerability CVE-2026-85046 is a type confusion weakness within the V8 JavaScript and WebAssembly engine. According to the discoverer, security researcher Salvatore Gulizia, the bug occurs in the V8 compilers. It can cause an array with PACKED_ELEMENTS to incorrectly receive the PACKED_SMI_ELEMENTS map. This state confusion can be leveraged by a threat actor to achieve arbitrary read and write capabilities on the JavaScript heap, which is a powerful primitive for developing a reliable remote code execution (RCE) exploit. The attack vector requires tricking a victim into navigating to a specially crafted HTML page, after which the attacker could execute code within the context of the browser's sandboxed process.
Affected Systems
The vulnerability affects the following Google Chrome versions:
- Versions prior to 152.0.7977.82/.83 for Windows and macOS.
- Versions prior to 152.0.7977.82 for Linux.
Exploitation Status
Google has confirmed that an exploit for CVE-2026-85046 exists in the wild. This indicates that threat actors are actively using this vulnerability in attacks. As is standard procedure to prevent wider abuse, Google has restricted access to bug details and links. The flaw was responsibly disclosed by Salvatore Gulizia on August 4, 2026.
Impact Assessment
Given Chrome's vast user base, a publicly exploited zero-day vulnerability poses a significant global risk. Successful exploitation could lead to a full compromise of the browser process. While attacks are contained within the browser sandbox, they are often chained with a separate sandbox escape vulnerability to gain full control over the underlying operating system. Potential impacts include theft of sensitive data (cookies, passwords, browsing history), injection of malicious scripts, installation of persistent malware or spyware, and using the compromised machine as a pivot point for further network intrusions.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were provided in the source articles.
Cyber Observables — Hunting Hints
Security teams can hunt for potential exploitation activity by monitoring for the following patterns:
chrome.exe or msedge.exe spawning unexpected child processes like cmd.exe, powershell.exe, or wscript.exe.Detection & Response
Defenders should focus on both endpoint and network-level detection.
Endpoint Detection and Response (EDR):
- Monitor browser processes for anomalous behavior, such as writing executable files to disk or initiating suspicious child processes. This aligns with D3FEND techniques like
Process Analysis. - Implement rules to detect command-line parameters often associated with post-exploitation activities originating from a browser.
- Monitor browser processes for anomalous behavior, such as writing executable files to disk or initiating suspicious child processes. This aligns with D3FEND techniques like
Network Monitoring:
- Analyze web proxy and DNS logs for connections to known malicious or uncategorized domains. While specific IOCs are not public, traffic to non-standard ports or domains with low reputation originating from user workstations should be investigated.
- Utilize D3FEND's
Network Traffic Analysisto baseline normal browser traffic and alert on deviations.
Threat Hunting:
- Proactively hunt for evidence of exploitation using the cyber observables listed above. Search for patterns of V8 engine crashes across the environment that may correlate with visits to specific websites.
Mitigation
Immediate patching is the primary mitigation.
Patch Management:
- Prioritize the deployment of Chrome versions 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) to all systems. This is a direct application of the D3FEND countermeasure
Software Update. - Ensure auto-update features for Chrome and other browsers are enabled and functioning correctly across the enterprise.
- Prioritize the deployment of Chrome versions 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) to all systems. This is a direct application of the D3FEND countermeasure
Defense in Depth:
- Employ web filtering and email security gateways to block access to malicious websites and prevent users from receiving links to exploit pages. This relates to D3FEND's
Inbound Traffic Filtering. - Use endpoint security solutions with exploit protection and behavioral analysis capabilities to detect and block the execution of shellcode even if the vulnerability is triggered.
- Enforce the principle of least privilege for user accounts to limit the impact of a successful sandbox escape.
- Employ web filtering and email security gateways to block access to malicious websites and prevent users from receiving links to exploit pages. This relates to D3FEND's
Timeline of Events
Article Updates
September 5, 2026
Severity increasedCISA adds CVE-2026-85046 to KEV catalog, mandating federal agencies to patch by Sept 18. Other Chromium browsers also affected.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited Chrome V8 zero-day, CVE-2026-85046, to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion mandates federal agencies to apply the patch by September 18, 2026, significantly increasing the urgency and official recognition of the threat. Furthermore, the update clarifies that other Chromium-based browsers such as Microsoft Edge, Brave, and Opera are also impacted, requiring users of these browsers to apply updates from their respective vendors. The article also provides more detailed detection methods and remediation steps.
Update Sources:
Timeline of Events
Security researcher Salvatore Gulizia discovers and reports the vulnerability to Google.
Google releases emergency security updates for Chrome to patch CVE-2026-85046.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.