CVE-2026-85046: The Chrome Zero-Day That Turns a Web Page Into Code Execution

By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)

Read this in 30 seconds: CVE-2026-85046 is a CVSS 8.8 type confusion vulnerability in Chrome’s V8 JavaScript engine, actively exploited in the wild as a zero-day before Google’s September 3, 2026 patch. The bug lets a specially crafted HTML page trick V8 into treating an array with a PACKED_ELEMENTS layout as if it carried the PACKED_SMI_ELEMENTS map instead, a mismatch that converts into arbitrary read and write access on the JavaScript heap. From there, an attacker can execute code inside Chrome’s sandbox just by getting a victim to visit a malicious page, no download, no click-through, no exploit chain beyond the page load itself.

CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a September 18 federal patch deadline. It’s the sixth Chrome zero-day Google has patched in 2026, and it hits every Chromium-based browser, not just Chrome. If your browser hasn’t auto-updated to 152.0.7977.82 or later, relaunch it today.

Most vulnerabilities need a victim to do something. This one just needs them to look at a page. That’s the entire threat model behind CVE-2026-85046: a type confusion bug deep in V8, the engine that runs the JavaScript on every website you’ve ever visited, weaponized into code execution triggered by nothing more than loading a crafted HTML page.

What CVE-2026-85046 Actually Is

The flaw is classified as CWE-843, access of a resource using an incompatible type, better known as type confusion, a memory-safety bug class where code treats an object in memory as a different data type than what’s actually stored there. In V8’s case, the specific mechanism is precise: an array holding PACKED_ELEMENTS can incorrectly end up tagged with the PACKED_SMI_ELEMENTS map, a compiler-level bookkeeping error about what kind of values the array is supposed to contain.

That mismatch sounds abstract until you see what it enables. Once V8’s internal type tracking is wrong about what an array holds, an attacker can manipulate it to read and write memory on the JavaScript heap far outside where a normal script should ever reach. From that primitive, a crafted HTML page, no plugin, no download, just a page load, gets an attacker arbitrary read/write access inside Chrome’s renderer process, which converts into remote code execution running inside the sandbox.

Google’s advisory confirms the part that matters most: this wasn’t found by a researcher and reported before anyone touched it. Google says it’s aware an exploit for CVE-2026-85046 exists in the wild, meaning attackers were using this before the September 3 patch existed. That’s what makes it a zero-day rather than just a critical bug on a normal disclosure timeline.

Why “Inside the Sandbox” Still Matters

It’s worth being precise about what this bug does and doesn’t hand an attacker on its own. Chrome’s sandbox is specifically designed to contain exactly this kind of renderer-process compromise, so code execution “inside the sandbox” isn’t automatically full system compromise. Real-world Chrome exploit chains that achieve that typically pair a V8 bug like this one with a separate sandbox-escape vulnerability.

That said, treating a sandboxed RCE as low-stakes misses the point. A renderer-process compromise is enough to read whatever the browser tab can see, session cookies, autofill data, anything rendered in that page’s context, and it’s the first link in the chain attackers reach for specifically because it’s the most reliable one: a page load, not a download the user has to be tricked into running. Sandbox escapes get chained onto bugs like this one regularly, and by the time a chain is fully weaponized and public, the entry-point bug has usually already been fixed and forgotten while the exploit itself keeps circulating.

The Sixth Zero-Day of the Year

CVE-2026-85046 isn’t an isolated incident, it’s the sixth actively exploited Chrome zero-day Google has patched in 2026. That cadence is the real story here as much as any single CVE: browsers are consistently one of the most actively targeted pieces of software on any given machine, precisely because they’re the software most likely to be pointed at attacker-controlled content by design, every link clicked, every page loaded.

The vulnerability was originally reported responsibly, credited to researcher Salvatore Gulizia (also known as Serotav), who received a $1,000 bug bounty for the disclosure. Whether the in-the-wild exploitation Google observed came from an independent discovery of the same bug or a leak isn’t publicly established, but the pattern, responsible report on one side, live exploitation on the other, before a patch ships, is now routine for browser zero-days rather than the exception.

CISA’s Response and the Federal Deadline

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026, the day after Google’s fix went out, with a September 18, 2026 deadline for federal civilian agencies to patch. That’s a two-week window, generous compared to the three-day turnarounds CISA has issued for the most severe infrastructure bugs this year, but still a clear signal that this is confirmed active exploitation, not a theoretical risk.

Who’s Affected

This hits more than just Chrome. The type confusion bug lives in V8, and V8 ships inside every Chromium-based browser, which means Microsoft Edge, Brave, Opera, and Vivaldi are all built on the same vulnerable engine until each vendor ships its own downstream update. If your organization standardized on a Chromium-based browser other than Chrome itself for policy reasons, don’t assume you’re covered just because the headlines say “Chrome.”

Fixed versions are 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux, rolling out progressively rather than all at once, which is standard Chrome update behavior but means not every affected machine gets the fix on the same day.

What To Do Right Now

1. Relaunch your browser today. Chrome (and most Chromium browsers) auto-download updates in the background but only apply them on restart. Go to More menu > Help > About Google Chrome, let it finish checking, then hit Relaunch. Don’t assume a running browser that hasn’t been restarted in days is actually patched.
2. Check Chromium-based browsers separately. Edge, Brave, Opera, and Vivaldi need their own downstream patches. Confirm each one you run has shipped a fix rather than assuming Chrome’s patch covers them.
3. Prioritize machines that can’t auto-update. Locked-down enterprise images, kiosk deployments, and anything on a delayed update ring are exactly where a live-exploited zero-day survives longest. Push the update explicitly rather than waiting for the normal cadence.
4. Don’t wait for the September 18 deadline if you’re not a federal agency. That date is CISA’s floor for federal civilian compliance, not a reasonable target for anyone actively exposed to a confirmed in-the-wild browser exploit.

How XHack Treats Client-Side Attack Surface Like It Deserves

Brand note: a browser zero-day is exactly the kind of exposure that a network-perimeter-focused security program misses entirely, because it doesn’t touch a server, a firewall, or an open port. It touches whatever page an employee happened to load.

The XHack AI agent’s mobile and web-application testing maps client-side attack surface the same way it maps server-side vulnerabilities, because the endpoint a user’s browser runs on is as much a target as anything sitting behind a VPN. For organizations running managed fleets, human-led VAPT validates patch compliance and browser configuration the way a real attacker would test it, not just a checklist scan, and XHack doesn’t store your findings on our servers either, your engagement data stays local and fully deletable by you.

FAQ: CVE-2026-85046 Questions Answered

What is CVE-2026-85046?

CVE-2026-85046 is a CVSS 8.8 type confusion vulnerability in Chrome’s V8 JavaScript engine, actively exploited in the wild before Google’s patch. It allows a specially crafted HTML page to trigger arbitrary read/write access on the JavaScript heap, leading to remote code execution inside Chrome’s sandbox with no user interaction beyond loading the page.

Which browsers are affected by CVE-2026-85046?

Any Chromium-based browser is affected, including Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi, since the vulnerable code lives in the shared V8 engine. Each browser needs its own update; Chrome’s fix does not automatically patch other Chromium-based browsers.

Is CVE-2026-85046 being actively exploited?

Yes. Google confirmed an exploit for CVE-2026-85046 exists in the wild before the patch was released, making it a genuine zero-day. CISA added it to its Known Exploited Vulnerabilities catalog on September 4, 2026, one day after the fix shipped, with a September 18, 2026 deadline for federal agencies to patch.

How do I know if my Chrome is patched against CVE-2026-85046?

Go to the Chrome menu, select Help, then About Google Chrome. Chrome checks for updates automatically on this screen and will show a Relaunch button if a patched version has already downloaded in the background. You’re protected once you’re running version 152.0.7977.82 or later and have restarted the browser.

Can this vulnerability alone compromise my whole computer?

Not by itself. CVE-2026-85046 grants code execution inside Chrome’s sandbox, which is specifically designed to contain that kind of compromise. Full system compromise typically requires chaining a separate sandbox-escape vulnerability on top of a bug like this one, though a sandboxed compromise alone can still expose session data and anything the affected tab could access.

The Bottom Line

CVE-2026-85046 is the sixth Chrome zero-day of 2026, and the pattern behind that number matters more than any single patch note: browsers remain the most consistently targeted client-side software precisely because loading a page requires no user judgment call the way opening an attachment does. Relaunch your browser today, check every Chromium-based browser you run separately, and don’t let this become the seventh entry on next year’s list of zero-days that sat unpatched on someone’s machine for weeks after the fix already existed.