[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8_cL8Li2mO15Xk1PfPT0xND7HosiE6lOHC0HSLHzEe0":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"ac87bd45-ee66-4e87-9a8e-c83fff4a1837","Google warns of new Chrome zero-day flaw exploited in attacks","google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks-dc2f42","Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. [...]","Google has released an update for Chrome to fix a high-severity zero-day vulnerability, CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine that has been exploited in the wild. This is the sixth actively exploited bug Google has patched in Chrome this year, highlighting ongoing threats to browser security. Users are urged to update their browsers promptly.","Google Chrome addresses actively exploited zero-day flaw in V8 engine.","Google warns of new Chrome zero-day flaw exploited in attacks By Bill Toulas September 4, 2026 07:48 AM 0 Google has updated the Chrome browser to address an actively exploited high-severity zero-day flaw in the V8 engine and 11 other vulnerabilities. The exploited security issue, identified as CVE-2026-85046, is described as a type confusion. It was reported to Google by researcher Salvatore Gulizia, known online as “Serotav.” The update brings Chrome to version 152.0.7977.82\u002F.83 on Windows and macOS, and 152.0.7977.82 on Linux, as part of a gradual rollout.. “Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the advisory reads. The company did not disclose any technical or specific exploitation details about the flaw to give users and dependent projects time to apply the fix. Type confusion flaws cause software to misinterpret one type of object as another, allowing attackers to corrupt memory. V8 is Chrome’s open-source JavaScript and WebAssembly engine, which compiles and executes code used by websites. Hence, CVE-2026-85046 could potentially be triggered by a specially crafted HTML page containing malicious JavaScript, potentially allowing remote code execution within Chrome's sandboxed renderer process. The update also addresses nine other high-severity vulnerabilities, including use-after-free and out-of-bounds memory flaws in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia, and a race condition in V8. CVE-2026-85046 is the sixth actively exploited bug Google has fixed in Chrome since the start of the year. Previous fixes include: An out-of-bounds read and write vulnerability in Chrome’s V8 JavaScript engine (CVE-2026-11645), exploited in the wild and patched in June. An iterator invalidation vulnerability (CVE-2026-2441) in CSSFontFeatureValuesMap, Chrome’s implementation of CSS font feature values, fixed in mid-February. Two additional Chrome zero-days exploited in March attacks: an out-of-bounds write flaw in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation issue in the V8 JavaScript and WebAssembly engine (CVE-2026-3910). A use-after-free vulnerability in Dawn (CVE-2026-5281), the cross-platform implementation of the WebGPU standard used by Chromium, was patched in April. Chrome users are recommended to apply the available update as soon as the rollout reaches them by going to Settings > About Chrome and waiting for the update to download and install. After the update process is done, a browser restart is required for the fixes to apply. A similar action is recommended for users of Chrome-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, though it may take a couple of extra days for fixes to arrive on those apps. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Critical Elementor Pro flaw exploited to take over WordPress sitesHackers exploit Sangoma Switchvox flaw to deploy reverse shellsHackers exploit critical JFrog Artifactory flaw to forge admin tokensSonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch nowCritical Langflow flaw exploited to steal OpenAI and AWS keys","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgoogle-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F03\u002F13\u002FGoogle_Chrome.jpg","2026-09-04T11:48:17+00:00","2026-09-04T12:00:20.093974+00:00",9,[18,21,24,26,28,30],{"name":19,"type":20},"Chrome","product",{"name":22,"type":23},"V8 engine","technology",{"name":25,"type":20},"Microsoft Edge",{"name":27,"type":20},"Brave",{"name":29,"type":20},"Opera",{"name":31,"type":20},"Vivaldi","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,61,64,67],{"type":52,"value":53,"context":54},"cve","CVE-2026-85046","Actively exploited zero-day flaw in Chrome's V8 engine.",{"type":52,"value":56,"context":57},"CVE-2026-11645","Out-of-bounds read\u002Fwrite in V8 engine, previously exploited.",{"type":52,"value":59,"context":60},"CVE-2026-2441","Iterator invalidation in CSSFontFeatureValuesMap, previously patched.",{"type":52,"value":62,"context":63},"CVE-2026-3909","Out-of-bounds write in Skia graphics library, previously exploited.",{"type":52,"value":65,"context":66},"CVE-2026-3910","Inappropriate implementation in V8 engine, previously exploited.",{"type":52,"value":68,"context":69},"CVE-2026-5281","Use-after-free vulnerability in Dawn, previously patched."]