Google Fixes Actively Exploited CVE-2026-85046 in Chrome

Google released a Chrome update fixing CVE-2026-85046 in V8, for which an in-the-wild exploit already exists. Opera also released a fix.

CVE-2026-85046 in Chrome is an actively exploited vulnerability in the V8 JavaScript engine that Google fixed in a new stable update for desktop systems. The company confirmed the existence of an in-the-wild exploit but did not disclose technical details, scope, or attribution of the observed exploitation.

On September 3, Google released Chrome 152.0.7977.82/.83 for Windows and macOS. Version 152.0.7977.82 is available for Linux. Users and device administrators should verify that this version or a newer browser version is deployed.

CVE-2026-85046 in Chrome affects the V8 engine

The vulnerability is classified as a type confusion bug in V8, the engine Chrome uses to process JavaScript. According to the CVE record, an attacker could execute arbitrary code within the browser sandbox after a user opens a specially crafted HTML page.

Active exploitation means the update has higher priority than a bug for which no working exploit is currently known. Simply visiting a maliciously crafted website could be an entry point for an attack in the described scenario.

However, the confirmed scope must be clearly distinguished from broader claims. Available information does not confirm that CVE-2026-85046 alone enables escaping the browser sandbox or compromising the operating system without another vulnerability. What is confirmed is code execution within the browser sandbox.

Opera also received a fix

On September 4, Opera released stable version Opera 135.0.5973.92, which, according to its announcement, fixes CVE-2026-85046. This is a specifically confirmed fix in another Chromium-based browser.

However, there is no evidence that all versions or all products built on Chromium are affected. For browsers such as Microsoft Edge and Brave, as well as other products, users should follow their vendors’ security advisories and the fixed versions they specify.

What to check when updating Chrome

  • On Windows and macOS, verify Chrome version 152.0.7977.82 or 152.0.7977.83, or a newer version.
  • On Linux, verify Chrome version 152.0.7977.82 or a newer version.
  • In Opera, check for an update to version 135.0.5973.92 or newer.
  • In managed environments, review the status of the update rollout and identify devices that remain on an older release.

Announcements from other Chromium-based browser vendors may provide additional information. Technical details of the exploit, indicators of compromise, and information about the attackers are also not yet public.

Sources

  • Chrome Releases – Google confirms the fixed Chrome versions, the nature of the V8 bug, and the existence of an in-the-wild exploit.
  • CVE Record – The Chrome CVE record lists the affected Chrome versions and the possibility of code execution in the sandbox through a specially crafted HTML page.
  • Opera Desktop Blog – Opera confirms the release of version 135.0.5973.92 with a fix for CVE-2026-85046.

Verified and updated: 09/05/2026 21:24

Tags
Sharing

Súvisiace