Google patches Chrome V8 flaw already exploited in the wild

Google pushed a Chrome Stable security update on Thursday, 3 September 2026, and said it is already seeing an exploit for one of the bugs. The Chrome Releases notes update Stable to 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux, rolling out over the coming days and weeks. Google did not name a campaign and did not publish a public exploit.

The bug Google flagged is CVE-2026-85046, a High severity type confusion in V8. Google's own line is: "Google is aware that an exploit for CVE-2026-85046 exists in the wild." The notes do not name targets, actors, or exploit details. A typical V8 type-confusion risk is that a crafted page can start an exploit attempt, which is the known shape, not a disclosed ransomware run or a confirmed enterprise campaign.

The extra detail in the notes, past the 0-day headline, is the patched builds and the report trail. Salvatore Gulizia (Serotav) reported the V8 bug on 4 August 2026. Chrome Releases lists a $1,000 reward against that CVE. The same update ships 12 security fixes in total.

The in-the-wild acknowledgment puts the V8 bug with other already-exploited cases such as the JFrog Artifactory auth bypass, not with a researcher-only claim.

Some offers on this page may be paid placements or contain affiliate links.