Google Patches Actively Exploited V8 Zero-Day in Chromium Browsers

Google has released an emergency update to address a high-severity zero-day vulnerability, tracked as CVE-2026-85046, affecting the V8 JavaScript engine. The flaw allows remote attackers to execute arbitrary machine code within the browser's sandbox via a specially crafted HTML page.

Google confirmed the vulnerability was being actively exploited in the wild before the patch was deployed. The flaw is classified as a "Type Confusion" (CWE-843) within the V8 engine. While the exploit enables Remote Code Execution (RCE), the impact is confined to the browser's sandbox. To fully compromise a host system, an attacker would typically need to chain this flaw with a separate "sandbox escape" vulnerability.

The Mechanics of Type Confusion

Chromium-based browsers employ a multi-process architecture designed to isolate the rendering engine—which includes the V8 engine—from the underlying operating system. This sandboxing is a critical security layer intended to prevent malicious web content from accessing sensitive system files or hardware.

Type confusion occurs when a program accesses a resource using an incompatible data type. In the V8 engine, attackers leverage this error to overwrite memory and redirect execution flow toward controlled code. By tricking the engine into misinterpreting the type of a specific object, the attacker gains the ability to run commands within the restricted environment of the sandbox.

Industry Implications

Although the sandbox limits immediate damage, an RCE in the V8 engine is a critical building block for a full system takeover. The urgency of this patch is amplified because Chromium serves as the foundation for a vast ecosystem of browsers, including Chrome, Edge, Brave, Opera, and Vivaldi. Consequently, millions of users across Windows, macOS, Linux, and Android are exposed until their respective browsers are updated.

Furthermore, the confirmation of active exploitation indicates that working exploit code is already in the hands of threat actors. This transforms the vulnerability from a theoretical risk into an active threat, necessitating immediate action from users and enterprise administrators.

Patching and Next Steps

Google confirmed the vulnerability is resolved in version 152.0.7977.82 or later across all supported platforms. This event marks the sixth actively exploited Chrome zero-day discovered in 2026, highlighting a persistent trend of targeting the browser's JavaScript execution layer.

Users are urged to update their browsers immediately. Security researchers will likely continue to monitor for the emergence of accompanying sandbox escape vulnerabilities that could be paired with CVE-2026-85046 to bypass the browser's remaining defenses.