Google Patches Chrome Zero-Day CVE-2026-85046
Google Patches Sixth Actively Exploited Chrome Zero-Day in 2026
CVE Identifiers
Full Report(when first published)
Executive Summary
On September 4, 2026, Google released an emergency security update for its Chrome web browser to address a high-severity zero-day vulnerability, CVE-2026-85046. This flaw, a type confusion bug in the V8 JavaScript engine, is being actively exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal agencies to patch by September 18, 2026. This marks the sixth Chrome zero-day addressed this year, highlighting a persistent trend of browser-based attacks. All users are urged to update their browsers immediately.
Vulnerability Details
The vulnerability, CVE-2026-85046, has a CVSS score of 8.8 and is classified as a type confusion weakness in V8, Google's open-source JavaScript and WebAssembly engine. Type confusion vulnerabilities arise when a program allocates or initializes a resource using one type but later accesses that resource using a different, incompatible type. In this case, an attacker can craft a malicious HTML page that, when visited by a victim, causes V8 to misinterpret the type of a JavaScript object. This leads to memory corruption, which can be leveraged by an attacker to gain arbitrary read/write access within the browser's renderer process heap, ultimately leading to arbitrary code execution.
Affected Systems
The vulnerability affects the following products:
- Google Chrome versions prior to
152.0.7977.82/.83for Windows and macOS. - Google Chrome versions prior to
152.0.7977.82for Linux. - Other Chromium-based browsers such as Microsoft Edge, Brave, and Opera are also impacted. Users of these browsers should apply updates as they are released by their respective vendors.
Exploitation Status
Google has confirmed that an exploit for CVE-2026-85046 exists in the wild. However, to prevent further abuse and allow time for users to patch, the company has restricted access to bug details and links. The threat actors behind the exploitation campaigns have not been disclosed. The vulnerability was responsibly disclosed by security researcher Salvatore Gulizia on August 4, 2026. The active exploitation in the wild prompted CISA to add it to the KEV catalog.
Impact Assessment
Successful exploitation allows a remote attacker to execute arbitrary code on a target system by tricking a user into visiting a malicious website. While the code execution occurs within the context of Chrome's sandboxed renderer process, attackers often chain such vulnerabilities with a separate sandbox escape exploit to gain full control over the underlying operating system. The widespread use of Chrome makes this a significant threat, potentially impacting millions of users and organizations globally. The primary risk is the silent installation of malware, spyware, or ransomware.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems: Security teams can hunt for signs of browser exploitation by monitoring for anomalous process behavior. This includes:
- Browser renderer processes (
chrome.exewith--type=rendererflag) spawning unexpected child processes likecmd.exe,powershell.exe, orwscript.exe. - Unusual network connections originating from browser processes to unknown or suspicious IP addresses.
- Monitoring for crashes in the V8 engine, which could indicate failed exploitation attempts.
chrome.exechrome.exe as a parent process for suspicious command-line tools.Detection Methods
- Vulnerability Scanning: Use vulnerability management tools to scan for and identify outdated Chrome installations across the enterprise. Ensure scanner plugins are updated to detect versions prior to
152.0.7977.82. - Endpoint Detection and Response (EDR): Configure EDR solutions to detect and alert on suspicious process chains originating from Chrome. A rule such as
ParentProcess: chrome.exeANDChildProcess: (cmd.exe OR powershell.exe)can be highly effective. This is a form of Process Analysis (D3-PA). - Network Traffic Analysis: Analyze web proxy and DNS logs for connections to newly registered or known malicious domains, which may host exploit kits targeting this vulnerability. This corresponds to Network Traffic Analysis (D3-NTA).
Remediation Steps
- Immediate Patching: The primary remediation is to update Google Chrome to the latest version immediately. Chrome's auto-update feature should handle this, but users can manually trigger an update by navigating to
Help > About Google Chrome. - Patch Third-Party Browsers: Users of other Chromium-based browsers must monitor for and apply updates from their respective vendors.
- User Awareness: Advise users to be cautious about clicking links from untrusted sources, although this is a limited defense against a zero-day exploit.
- Principle of Least Privilege: Ensure users do not operate with administrative privileges for daily tasks, which can limit the post-exploitation impact of a successful sandbox escape. This is a form of User Account Permissions (D3-UAP).
Timeline of Events
Article Updates
September 10, 2026
State-backed APTs, including Chinese groups, are using the 'BlueMoon' exploit kit to chain CVE-2026-85046 with two other zero-days for full system compromise.
MITRE ATT&CK Mitigations
Update Software
Applying the latest security patches from Google is the most effective way to mitigate this vulnerability.
Mapped D3FEND Techniques:
Exploit Protection
Employing browser security features like sandboxing and site isolation helps contain the impact of exploitation.
Mapped D3FEND Techniques:
Chrome's built-in sandbox is a critical defense layer that limits an attacker's ability to impact the underlying system, even after successful code execution in the renderer process.
D3FEND Defensive Countermeasures
Organizations must prioritize the immediate deployment of Google Chrome version 152.0.7977.82/.83 or newer. This is the most critical action to prevent exploitation of CVE-2026-85046. Utilize enterprise patch management systems like Microsoft SCCM, Intune, or Jamf to enforce the update across all managed Windows, macOS, and Linux endpoints. For unmanaged devices, communicate the urgency to users and provide clear instructions for manual updates. Establish a compliance dashboard to track the update's deployment progress, aiming for 100% compliance within 72 hours due to the active exploitation. Verify the patch by checking browser versions through asset inventory systems. This directly remediates the known attack vector.
To detect potential exploitation of this Chrome vulnerability, security teams should implement robust process monitoring on endpoints. Configure EDR or Sysmon to log all process creation events (Event ID 4688 on Windows, Sysmon Event ID 1). Create high-fidelity alerts for any instance where a Chrome renderer process (chrome.exe) spawns a command-line interpreter (cmd.exe, powershell.exe) or scripting engine (cscript.exe, wscript.exe). Establish a baseline of normal browser behavior to minimize false positives. This technique is crucial for detecting post-exploitation activity, as attackers will almost certainly attempt to launch further tools after achieving initial code execution within the browser's sandbox. It serves as a vital secondary control if patching is delayed or fails.
Timeline of Events
Security researcher Salvatore Gulizia discovers and reports the vulnerability to Google.
Google releases security updates to patch CVE-2026-85046.
CISA adds CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalog.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.