Google Patches 6th Chrome Zero-Day Of 2026
Google Chrome 152 patches 12 vulnerabilities, including one actively exploited zero-day (CVE-2026-85046) in the V8 JavaScript/WebAssembly engine The exploited zero-day is a type confusion flaw reported by Salvatore Gulizia, who received a $1,000 bug bounty reward This marks the sixth Chrome zero-day patched in 2026, highlighting an elevated threat landscape The remaining 11 fixes cover out-of-bounds read/write, use-after-free, race conditions, improper resource exposure, and additional type conf
Analysis
TL;DR
- Google Chrome 152 patches 12 vulnerabilities, including one actively exploited zero-day (CVE-2026-85046) in the V8 JavaScript/WebAssembly engine
- The exploited zero-day is a type confusion flaw reported by Salvatore Gulizia, who received a $1,000 bug bounty reward
- This marks the sixth Chrome zero-day patched in 2026, highlighting an elevated threat landscape
- The remaining 11 fixes cover out-of-bounds read/write, use-after-free, race conditions, improper resource exposure, and additional type confusion bugs
- Updates are available in Chrome 152.0.7977.82/.83 for Windows/macOS and 152.0.7977.82 for Linux
Why It Matters
This update underscores the ongoing vulnerability surface in browser engines, particularly V8, which remains a prime target for remote code execution attacks. The fact that an exploit is already in the wild makes this a time-sensitive patch for all Chrome users and enterprise environments relying on the browser.
Technical Details
- CVE-2026-85046: High-severity type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine, potentially enabling remote read/write operations through crafted HTML pages
- Vulnerability categories patched: Out-of-bounds read/write, incomplete cleanup, use-after-free, race condition, improper resource exposure, and type confusion — spanning both high and medium severity
- Patch versions: Windows/macOS — 152.0.7977.82/.83; Linux — 152.0.7977.82
- External researcher contributions: Three of the 11 non-zero-day vulnerabilities were reported by independent security researchers
- 2026 zero-day trend: CVE-2026-85046 is the sixth exploited zero-day patched this year, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645
Industry Insight
- Browser security remains a critical attack vector; organizations should enforce automatic Chrome updates and prioritize patching within 48 hours of critical zero-day announcements
- The recurring type confusion vulnerabilities in V8 suggest ongoing challenges in memory-safe JavaScript engine development — investing in fuzzing and formal verification for engine components could reduce this attack surface
- The $1,000 bug bounty for this zero-day highlights the value of responsible disclosure programs; companies should consider competitive bounty structures to incentivize early reporting of high-severity flaws
Disclaimer: The above content is generated by AI and is for reference only.