AppYour homeOperatorJournalAlerts
Request an introduction
Security issueGoogle Chrome

CVE-2026-85046

A flaw that makes Chrome's JavaScript engine mix up types of data, letting a web page run code. Google fixed it in Chrome 152 on 3 Sep 2026. It’s being used in attacks.

CVE-2026-85046Type confusion in V8
Attacks
Used in attacksOn CISA's list of flaws used in attacks since 4 Sep 2026. Every Google flaw on the list
Affected
  • Google Chrome before 152.0.7977.82 (152.0.7977.83 on Mac)
  • Brave before 1.94.121, the first Brave built on Chromium 152.0.7977.83
  • Microsoft Edge, Opera, Arc, Vivaldi and other browsers built on Chromium, until each ships the fix
  • Apps built on Electron, which carry their own copy of Chromium, until each ships it
Fixed in
Chrome 152.0.7977.82 (152.0.7977.83 on Mac), released 3 Sep 2026
In Brave
Brave 1.94.121, built on Chromium 152.0.7977.83, released 4 Sep 2026
Severity
Rated high by Google. CVSS 8.8 out of 10 (high), scored by CISA.
Official name
Google Chromium V8 Type Confusion Vulnerability
What's known.From Google’s release notes, CISA's catalogue of exploited flaws and NVD, checked 23 Oct 2026.

What it is

V8 is the part of Chrome that runs the JavaScript in every web page. This flaw is a type confusion: V8 can be made to treat one kind of data as another, which corrupts memory. Google and NVD both describe the result the same way: a remote attacker can use a crafted web page to run code inside Chrome's sandbox.

Inside the sandbox, that code is fenced off from the rest of the Mac. Getting out takes a second flaw. Google hasn't said whether the attacks it knows of used one, or who was targeted.

Is it being used in attacks?

Yes. Google’s release notes for Chrome 152.0.7977.82 say: “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”

CISA, the US cybersecurity agency, added it to its catalogue of known exploited vulnerabilities on 4 Sep 2026, the day after the fix. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 18 Sep 2026 to fix it.

Google keeps bug details private until most people have updated, and CISA doesn’t say who was attacked or how.

What to do

  1. Update Chrome, then relaunch it.Chrome → About Google Chrome in the menu bar. Chrome downloads updates by itself but only applies them when it relaunches, with your tabs.
  2. Do the same in every other browser you use.Brave, Edge, Arc, Vivaldi and Opera each have an About page in the app menu that checks for updates.
  3. Update apps built on Electron.Slack, Discord, Notion and many others carry their own copy of Chromium. The HARD app lists which ones on your Mac are behind.

Advisories that include it

  1. Chrome before 156.0.8078.47
  2. Apps built on Electron 41

Sources

  1. Stable Channel Update for Desktop: Chrome 152.0.7977.82/83The fix, rated high by Google, and Google’s statement that an exploit exists in the wild.chromereleases.googleblog.com ·
  2. Brave 1.94.121 (Chromium 152.0.7977.83)The first Brave release built on a Chromium with the fix.github.com/brave ·
  3. Known Exploited Vulnerabilities catalog: CVE-2026-85046Added 4 Sep 2026: CISA has evidence it is being used in attacks.cisa.gov ·
  4. CVE-2026-85046The official description, and a CVSS score of 8.8 out of 10 from CISA.nvd.nist.gov ·
Every advisoryLook up any app, company or CVEThe HARD Mac app links its warnings here.