Google's sixth Chrome zero-day of 2026: an actively exploited V8 flaw that hits every Chromium browser

Google patched the sixth actively exploited Chrome zero-day of 2026 on Thursday, September 3, and the protection arrives unevenly. The flaw, tracked as CVE-2026-85046, is a type confusion bug in V8, the open-source engine that compiles and executes the JavaScript and WebAssembly running on the web's pages. Google fixed it in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, in a gradual rollout. Every other browser built on Chromium, including Microsoft Edge, Brave, Opera and Vivaldi, embeds the same vulnerable engine, and fixes on those may take a couple of extra days to arrive. 1 2

On exploitation, Google's advisory says one sentence: "Google is aware that an exploit for CVE-2026-85046 exists in the wild." The company has disclosed nothing else, holding back technical detail to give users and dependent projects time to patch, and it has not said when the attacks began. 3 1

The scale of who inherits the hole is the actual story. StatCounter's August 2026 figures put Chrome at 69.39% of worldwide browser usage, Edge at 5.36% and Opera at 1.94%; those three Chromium-based browsers sum to 76.69% of the market before counting Brave and Vivaldi, which do not appear in the top six. 4 When the bug sits in the shared engine rather than in Chrome's own code, roughly three of every four browsers in use carry it until each vendor's build catches up.

What a V8 type confusion actually buys an attacker

A type confusion means V8 misinterprets one kind of object as another, corrupting memory in the process. 1 SecurityWeek frames the practical shape: via a crafted HTML page, an attacker may coax the bug into remote read and write operations. 2 BleepingComputer adds the ceiling case, that a malicious page could potentially achieve code execution inside Chrome's sandboxed renderer process. 1

Two hedges matter. "Potentially" is real: Google has released no exploit detail, so what is public is the bug class, not a working attack chain. And the renderer sandbox is a genuine boundary for whatever code the bug yields. But the delivery vehicle for the vulnerability is plain: a web page carrying hostile JavaScript, nothing downloaded, nothing installed. 1

Six zero-days in 2026's first 246 days, three of them in V8

The year's six exploited Chrome flaws, in patch order 1, with CVE identifiers corroborated by SecurityWeek 2:

• Mid-February: CVE-2026-2441, an iterator invalidation in CSSFontFeatureValuesMap, Chrome's implementation of CSS font feature values
• March: CVE-2026-3909, an out-of-bounds write in Skia, the 2D graphics library
• March: CVE-2026-3910, an inappropriate implementation issue in V8
• April: CVE-2026-5281, a use-after-free in Dawn, the cross-platform implementation of the WebGPU standard used by Chromium
• June: CVE-2026-11645, an out-of-bounds read and write in V8
• September 3: CVE-2026-85046, a type confusion in V8

Count the calendar: January 1 through September 3 is 246 days of 2026, and six actively exploited bugs in that span works out to one every 41 days. Three of the six sat in V8 specifically, the one component that Chrome, Edge, Brave, Opera and Vivaldi all ship in common. 1

The reward line on an actively exploited bug reads $1,000

The release notes list all 12 fixes, and two rows shape the story. Researcher Salvatore Gulizia, known online as Serotav, reported the exploited V8 bug on August 4; the fix shipped 30 days later, on September 3, with no word on when exploitation began. 3 The bounty line on that bug reads $1,000, an amount SecurityWeek also reports, while rewards for three other fixes in the same batch are still marked TBD. 3 2 Eight of the 12 fixes are credited to Google's own teams; outside researchers, Serotav twice plus Ngoc Hieu and Brendan Dolan-Gavitt (XBOW), account for the other four. 3

The batch also carries a second V8 bug, a race condition reported on August 17 by Brendan Dolan-Gavitt (XBOW), with no in-the-wild notice attached. 3 And Google's own platform can trail its own patch: the most recent ChromeOS stable post, dated September 2, rolls out browser version 151.0.7922.222, which predates this week's 152 fix. 3

Chrome gets the fix first; Edge, Brave, Opera and Vivaldi follow

• Chrome desktop: update to 152.0.7977.82/.83 (Windows and macOS) or 152.0.7977.82 (Linux) through Settings, About Chrome, then restart; the rollout is gradual, so the build may not be offered immediately. 1 3
• Edge, Brave, Opera, Vivaldi: check each browser's update setting rather than waiting on the auto-update, since fixes may take a couple of extra days to arrive. 1
• ChromeOS: check the OS version; the stable channel was on browser 151 as of September 2. 3

One engine now carries most of the world's browsing, and the engine's owner patches its own browser first, on its own clock. This week, advice that says "update Chrome" covers the engine's maker and leaves everyone built on it waiting for their turn. 1