Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
Summary: Google released security updates patching 12 vulnerabilities in Chrome, including CVE-2026-85046, a high-severity (CVSS 8.8) type confusion bug in the V8 JavaScript and WebAssembly engine that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026, and was awarded a $1,000 bug bounty; Google confirmed an exploit exists in the wild, marking its sixth actively exploited Chrome zero-day since the start of the year.
What you should know: CISA added CVE-2026-85046 to its KEV catalog on September 4, 2026, requiring Federal Civilian Executive Branch agencies to patch by September 18, 2026 - and Google has now disclosed six actively exploited Chrome zero-days this year alone.