BREAKING: CVE-2026-85046 is a Chrome V8 bug Google says is exploited in the wild

Google shipped a desktop Chrome update today because a V8 type confusion is already being exploited. Stable is now 152.0.7977.82/.83 on Windows and Mac, and 152.0.7977.82 on Linux. Google says that build will roll out over the coming days and weeks, so restarting the browser is not proof you have it.

The in-the-wild bug is CVE-2026-85046, a High type confusion in V8 reported on 4 Aug 2026 by Salvatore Gulizia. Google listed it first among 12 security fixes in the 3 Sep 2026 desktop stable note and wrote, explicitly, that it is aware an exploit exists in the wild. Chromium bug details stay restricted until a majority of users are on the fix.

What breaks

V8 is Chrome's JavaScript engine. A type confusion there means crafted HTML can make the engine treat one kind of object as another. Google rated this High. It did not publish a sandbox-escape claim, a CVSS score, or a technical write-up of the exploit. The operational fact that changes the priority is the in-the-wild sentence, not the High label by itself. Chrome High V8 issues ship often. Google saying the exploit is already out does not.

The same desktop train also ships ten other High issues (CrashReporting out-of-bounds read, Network incomplete cleanup, Compositing use-after-free, a second V8 race, WebGL out-of-bounds write, CacheStorage resource exposure, DevTools use-after-free, Skia use-after-free, Compositing type confusion) plus two Mediums. Google claimed in-the-wild exploitation only for CVE-2026-85046. The rest are the same binary, not a second incident.

Who is not in scope

• Desktop Chrome that already shows 152.0.7977.82 or 152.0.7977.83 at chrome://version.
• This Google post is desktop only. The latest Chrome for Android note is 1 Sep 2026, version 152.0.7977.75, matching the previous desktop train (Windows/Mac 75/76, Linux 75), not today's 82/83 build. Android is not patched by this advisory.
• ChromeOS and ChromeOS Flex stable as of 2 Sep 2026 is still M-151, browser 151.0.7922.222. That is not this 152.0.7977.82 desktop train.
• Firefox, Safari, and other non-Chromium browsers are outside this Google note. Other Chromium products (Edge, Electron, Brave, and so on) are not patched by this desktop post. Check those vendors' own channels.

How to fix

Upgrade desktop Chrome to 152.0.7977.82 on Linux, or 152.0.7977.82/.83 on Windows and Mac. Google's own words: the build "will roll out over the coming days/weeks."

The operator check is the version string, not "I relaunched Chrome":

1. Open a new tab and go to chrome://version.
2. On Windows or Mac, you want 152.0.7977.82 or 152.0.7977.83. On Linux, you want 152.0.7977.82.
3. If the build is older, use Chrome's about page or your enterprise package until this train appears. Do not assume a restart applied the in-the-wild fix.

If you pin Chrome by policy, move the pin. Helpdesk tickets that only say "restart the browser" will not close this until chrome://version matches. Do not wait for the Chromium bug to unrestrict. Google is holding those details until most users are updated.

What this is not

Google did not call this a sandbox escape, a server RCE, or a worm. It is a High V8 type confusion reached through a crafted HTML page, with an exploit Google says exists in the wild. The other eleven CVEs in this note ride the same upgrade. They are not extra in-the-wild claims.

Operator takeaway

Fleet the 152.0.7977.82/.83 desktop build and verify chrome://version. Do not open a second ticket for CVE-2026-85052, CVE-2026-85043, CVE-2026-85048, CVE-2026-85045, CVE-2026-85050, CVE-2026-85053, CVE-2026-85042, CVE-2026-85049, CVE-2026-85051, CVE-2026-85047, or CVE-2026-85044. They are the same Chrome binary.

The source record is available in HOL Guard. The primary vendor note is Google's 3 Sep 2026 desktop stable update. The Android comparison is the 1 Sep 2026 Chrome for Android 152.0.7977.75 note. ChromeOS stable as of 2 Sep 2026 is still M-151 on the Chrome Releases index.