InfoSecBulletin Cybersecurity for mankind
Google has updated the Chrome browser to fix a serious security issue in the V8 engine and 11 other flaws. The security flaw, called CVE-2026-85046, is a type confusion. Researcher Salvatore Gulizia, known as “Serotav,” told Google about it.
The update makes Chrome version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, in a slow release. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the advisory reads.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
The company did not share any technical details about the flaw so that users and related projects have time to apply the fix. Type confusion flaws make software see one kind of object as another. This lets attackers mess with memory. V8 is the engine used by Chrome for JavaScript and WebAssembly. It turns code that websites use into an executable form.
CVE-2026-85046 might be activated by a specially made HTML page with harmful JavaScript, which could let remote code run in Chrome’s safe rendering process.
The update fixes nine other serious problems, like use-after-free and out-of-bounds memory issues in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia, and a race condition in V8.
CVE-2026-85046 is the sixth actively exploited bug Google has fixed in Chrome since the start of the year. Previous fixes include:
An out-of-bounds read and write vulnerability in Chrome’s V8 JavaScript engine (CVE-2026-11645), exploited in the wild and patched in June.
An iterator invalidation vulnerability (CVE-2026-2441) in CSSFontFeatureValuesMap, Chrome’s implementation of CSS font feature values, fixed in mid-February.
Two additional Chrome zero-days exploited in March attacks: an out-of-bounds write flaw in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation issue in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).
A use-after-free vulnerability in Dawn (CVE-2026-5281), the cross-platform implementation of the WebGPU standard used by Chromium, was patched in April.
Chrome users should update as soon as they can. They can do this by going to Settings > About Chrome and waiting for the update to download and install.
