Google has released security updates for its Chrome browser to address a high-severity type-confusion vulnerability, identified as CVE-2026-85046, which was reportedly being exploited in the wild. The vulnerability affects the V8 JavaScript engine, a core component used by Chrome for processing JavaScript and WebAssembly.
Google reported in a security notice published Thursday that it is aware of an exploit for CVE-2026-85046 being used. The company stated that the patch is included in Chrome versions 152.0.7977.82 and 152.0.7977.83 for Windows and Mac, and version 152.0.7977.82 for Linux. Google indicated that the update will be rolling out over the coming days and weeks.
Exploit Details Remain Unclear
The nature of the exploit, including the identity of the attackers and their victims, remains unknown. Google has not disclosed whether the bug can be used for remote code execution or when further details about the exploit will be made public. This lack of immediate detail is consistent with Google’s practice of withholding some information until a majority of users and affected third-party projects have installed the necessary patches.
CVE-2026-85046 is classified as a type-confusion bug. Such flaws typically occur when software misinterprets data types, potentially leading to memory errors or other unpredictable behavior. While Google has not directly linked this specific vulnerability to attacks on cryptocurrency users, browser wallets, exchange accounts, or trading extensions, these areas have been targeted by other methods in the past.
Researcher Awarded Bounty
Security researcher Salvatore Gulizia, also known by the alias Serotav, is credited with reporting the flaw on August 4. Google acknowledged his contribution by awarding him a bug bounty of $1,000.
The recent Chrome update addresses a total of 12 security fixes. Among these are nine high-severity bugs and two medium-severity issues, in addition to the actively exploited CVE-2026-85046. Google also expressed gratitude to all security researchers who collaborated during the development cycle to prevent security bugs from reaching the stable channel.
Google has not provided specific details regarding the capabilities of the exploit or the extent of its use. The company’s approach of limiting immediate disclosure aims to ensure that users are protected by the patch before detailed information becomes widely available, thereby mitigating further potential exploitation.
Why This Matters
The materials describe a narrow update: Google released security updates for Chrome to address a type-confusion vulnerability (CVE-2026-85046) that attackers were actively exploiting. The identity of the attackers.
Broader Context
Source materials place the factual news in this context: Google has patched a high-severity Chrome flaw after finding that attackers were already using it.
Leave a Reply