Google patched CVE-2026-85046, a type confusion bug in the V8 JavaScript and WebAssembly engine, in the Chrome Stable Channel update that shipped on September 3, 2026, bringing Chrome to version 152.0.7977.82. The flaw carries a CVSS base score of 8.8, affects all earlier Chrome versions, and Google confirmed active exploitation in the wild on the same day. CISA added the bug to its Known Exploited Vulnerabilities catalog on September 4, giving federal agencies until September 18 to patch.

Security researcher Salvatore Gulizia, who publishes as Serotav, reported the issue on August 4, 2026, and received a $1,000 bounty. It is the sixth actively exploited Chrome zero-day of 2026, following CVE-2026-11645, CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

Classified as CWE-843, the bug lets V8 mismatch array representations: an array holding PACKED_ELEMENTS can end up tagged with a PACKED_SMI_ELEMENTS map. That mismatch gives an attacker arbitrary read and write access on the JavaScript heap, triggered simply by getting a victim to load a crafted HTML page. No prior privileges are required, and the code runs inside Chrome's sandboxed renderer process, so full host takeover would still need a separate sandbox-escape bug.

Because V8 powers every Chromium-based browser as well as Electron, the exposure extends far beyond desktop browsing. Electron apps including Slack, Discord, VS Code, Figma, Notion, and Tidal ship their own bundled Chromium and only inherit the fix once Electron updates and each app rebuilds. Headless Chrome instances driven by Puppeteer or Playwright, used for scraping, testing, and CI pipelines, carry the same risk and often lag behind the official Chrome patch by days, weeks, or months.