Hajra Naz
Google has patched a dangerous Chrome vulnerability. Attackers were already exploiting it in real-world attacks. The company fixed 12 vulnerabilities in the browser on September 3. Most of them received a high severity rating from Google. However, one flaw stood out from the rest. That’s because attackers were actively using it in live attacks.
The exploited bug is tracked as CVE-2026-85046. It’s a type of confusion flaw. Specifically, it exists in V8, Chrome’s JavaScript and WebAssembly engine. This vulnerability carries a serious CVSS score of 8.8. Essentially, it lets a remote attacker run malicious code. They can do this through a crafted web page. Crucially, simply loading that page can trigger the attack. No further action is required from the user.
Understanding this flaw helps explain why it’s so dangerous. Type confusion happens when software misinterprets one memory object as a different type entirely. According to the researcher’s own write-up, an array meant to carry one internal map instead received another map.
Read More: Google’s Latest AI Weather Model Could Save You From Getting Caught in the Rain
That mismatch grants attackers something significant. They gain arbitrary read and write access on the JavaScript heap. As a result, attackers can run code inside Chrome’s sandboxed renderer process.
This marks the sixth actively exploited Chrome zero-day this year. Notably, it’s also the third to directly target the V8 engine specifically. Analysts say this pattern reveals something important. It points to organized, sustained research efforts targeting the browser. After all, Chrome serves more than three billion users worldwide. That massive user base creates an enormous attack surface for hackers to target.
This update also addressed nine other high-severity vulnerabilities. That includes use-after-free flaws. It also includes out-of-bounds memory flaws across several components. Affected areas included Network, WebGL, DevTools, and the Skia graphics library. Google also patched a race condition within V8 during this same update.
Read More: Google’s Latest AI Upgrade Adds Voice Features to Gmail, Docs, and Keep
The fix arrives through specific Chrome builds. Users should update to versions 152.0.7977.82 or .83 immediately. It’s worth noting that this rollout happens gradually. It won’t reach every user instantly. This threat also extends well beyond Chrome alone. Every Chromium-based browser inherits this same underlying flaw. Therefore, browsers like Edge, Brave, Opera, and Vivaldi all need updating too.
U.S. authorities have already responded formally to this threat. On September 4, the Cybersecurity and Infrastructure Security Agency added this flaw to its Known Exploited Vulnerabilities catalog. This action requires federal agencies to patch the vulnerability by September 18. For users in Pakistan, the fix remains straightforward. Simply update Chrome and restart the browser promptly.
