InfoSecBulletin Cybersecurity for mankind
Google has updated the Chrome browser to fix a serious security issue in the V8 engine and 11 other flaws. The security flaw, called CVE-2026-85046, is a type confusion. Researcher Salvatore Gulizia, known as “Serotav,” told Google about it.
The update makes Chrome version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, in a slow release. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the advisory reads.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The company did not share any technical details about the flaw so that users and related projects have time to apply the fix. Type confusion flaws make software see one kind of object as another. This lets attackers mess with memory. V8 is the engine used by Chrome for JavaScript and WebAssembly. It turns code that websites use into an executable form.
CVE-2026-85046 might be activated by a specially made HTML page with harmful JavaScript, which could let remote code run in Chrome’s safe rendering process.
The update fixes nine other serious problems, like use-after-free and out-of-bounds memory issues in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia, and a race condition in V8.
CVE-2026-85046 is the sixth actively exploited bug Google has fixed in Chrome since the start of the year. Previous fixes include:
An out-of-bounds read and write vulnerability in Chrome’s V8 JavaScript engine (CVE-2026-11645), exploited in the wild and patched in June.
An iterator invalidation vulnerability (CVE-2026-2441) in CSSFontFeatureValuesMap, Chrome’s implementation of CSS font feature values, fixed in mid-February.
Two additional Chrome zero-days exploited in March attacks: an out-of-bounds write flaw in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation issue in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).
A use-after-free vulnerability in Dawn (CVE-2026-5281), the cross-platform implementation of the WebGPU standard used by Chromium, was patched in April.
Chrome users should update as soon as they can. They can do this by going to Settings > About Chrome and waiting for the update to download and install.
