Chrome 152 patches actively exploited V8 type confusion zero-day

Affected Systems

Google Chrome versions prior to 152.0.7977.82 on Windows/macOS/Linux. The vulnerability (CVE-2026-85046) affects the V8 JavaScript engine. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) are also affected pending vendor patches.

Exploitation Status

Active exploitation confirmed in the wild. Google acknowledged exploits exist but has not disclosed attack details, targets, or threat actors. This is the sixth Chrome zero-day exploited in 2026.

Business Impact

Type confusion in V8 allows remote code execution within Chrome's sandbox via crafted HTML pages (CVSS 8.8). Attackers can achieve arbitrary read/write on the JavaScript heap. Users visiting malicious or compromised websites are at risk. Sandbox escape would require chaining with additional vulnerabilities, but in-sandbox compromise enables credential theft, session hijacking, and further exploitation.

Urgency

🔴 Immediate

Recommended Actions

• Update Chrome to version 152.0.7977.82 (Linux), 152.0.7977.82/.83 (Windows/macOS) immediately via Settings > Help > About Google Chrome
• Force Chrome updates via Group Policy (Windows) or MDM for enterprise deployments to ensure rapid rollout
• Monitor for and apply updates to Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as vendors release patches
• Review web proxy and endpoint logs for unusual JavaScript execution patterns or sandbox escape attempts around August 4–September 4, 2026
• Consider blocking access to high-risk or untrusted websites until patching is complete for critical user groups