Google Patches Sixth Chrome Zero-Day of 2026

On Thursday, Google released Chrome 152 security updates that fix a V8 JavaScript and WebAssembly engine type confusion vulnerability tracked as CVE-2026-85046. The company says the flaw is being exploited in the wild.

The fixes are included in Chrome versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. Users should update their browsers to those 152.x builds to receive the patches.

The vulnerability was reported by researcher Salvatore Gulizia, who received a $1,000 bug bounty for the report. Google’s advisory states, “Google is aware that an exploit for CVE-2026-85046 exists in the wild.” The company has not published technical details about the defect.

Type confusion is a memory-corruption error that can lead to crashes and, in some cases, allow attackers to read or write memory or execute code when a user visits a specially crafted web page. In Chrome, such flaws can affect the V8 engine that runs JavaScript and WebAssembly.

The update resolves 12 security issues in total. Alongside the exploited zero-day, Google fixed nine other high-severity bugs, including out-of-bounds read/write, incomplete cleanup, use-after-free, race condition, improper resource exposure and additional type confusion issues. Three of those high-severity problems were reported by external researchers. The release also addresses two medium-severity flaws related to improper input validation and use-after-free.

CVE-2026-85046 is the sixth Chrome zero-day patched this year; earlier patched zero-days include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645.

Google has not published exploit code or indicators of compromise for CVE-2026-85046. The company typically withholds technical specifics for a short period to limit the chance attackers copy an exploit before users install the update.