InfoSecBulletin Cybersecurity for mankind
Google has updated the Chrome browser to fix a serious security issue in the V8 engine and 11 other flaws. The security flaw, called CVE-2026-85046, is a type confusion. Researcher Salvatore Gulizia, known as “Serotav,” told Google about it.
The update makes Chrome version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, in a slow release. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the advisory reads.
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548
Gartner
70% of SOCs Will Pilot AI Agents: Only 15% Will See Results
CVE-2026-62911
Nearly 22,000 Microsoft Exchange Servers are vulnerable to attack
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
The company did not share any technical details about the flaw so that users and related projects have time to apply the fix. Type confusion flaws make software see one kind of object as another. This lets attackers mess with memory. V8 is the engine used by Chrome for JavaScript and WebAssembly. It turns code that websites use into an executable form.
CVE-2026-85046 might be activated by a specially made HTML page with harmful JavaScript, which could let remote code run in Chrome’s safe rendering process.
The update fixes nine other serious problems, like use-after-free and out-of-bounds memory issues in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia, and a race condition in V8.
CVE-2026-85046 is the sixth actively exploited bug Google has fixed in Chrome since the start of the year. Previous fixes include:
An out-of-bounds read and write vulnerability in Chrome’s V8 JavaScript engine (CVE-2026-11645), exploited in the wild and patched in June.
An iterator invalidation vulnerability (CVE-2026-2441) in CSSFontFeatureValuesMap, Chrome’s implementation of CSS font feature values, fixed in mid-February.
Two additional Chrome zero-days exploited in March attacks: an out-of-bounds write flaw in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation issue in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).
A use-after-free vulnerability in Dawn (CVE-2026-5281), the cross-platform implementation of the WebGPU standard used by Chromium, was patched in April.
Chrome users should update as soon as they can. They can do this by going to Settings > About Chrome and waiting for the update to download and install.
