Google rushes out sixth Chrome zero-day fix of 2026 as CISA sets federal patch deadline

Google has patched the sixth actively exploited zero-day vulnerability found in its Chrome browser this year, pushing an emergency fix after confirming that attackers were already using the flaw to break out of the browser's security sandbox. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog the same day, starting a two-week clock for federal agencies to install the update.

The vulnerability, tracked as CVE-2026-85046, lives in V8, the JavaScript and WebAssembly engine that powers Chrome and every other Chromium-based browser. Google shipped the fix on September 3 in Chrome version 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, according to the Chrome release notes Google's browser team published to confirm the update. The company was terse about how the bug was being used in practice, a standard practice meant to slow down copycat attackers while users update.

"Google is aware that an exploit for CVE-2026-85046 exists in the wild," the company said in its release notes announcing the patch.

The numbers

The flaw carries a severity score of 8.8 out of 10 under the industry-standard CVSS scale, reflecting how a successful attack can let a remote party run arbitrary code merely by getting a victim to load a booby-trapped web page. Google's engineers classified the underlying problem as a type confusion bug: a coding error in V8's compiler that causes certain arrays to be tagged with the wrong internal data type, opening a path to read and write memory the browser sandbox is supposed to keep off-limits.

Independent researcher Salvatore Gulizia, who goes by the handle Serotav, is credited with discovering and privately reporting the bug on August 4, a month before the public fix. Google paid a $1,000 bounty for the disclosure, according to the Chromium bug tracker entry for the issue, which the company keeps hidden from public view until a fix has broadly rolled out. CVE-2026-85046 is the sixth Chrome zero-day Google has confirmed under active attack in 2026, following five earlier V8 and rendering-engine bugs patched over the course of the year — a pace security researchers say reflects both the intensity of interest in browser exploitation and Google's aggressive bug-bounty and hardening programs finding more of what attackers are already using.

CISA's September 4 alert set a remediation deadline of September 18 for civilian federal agencies, a compressed two-week window that the agency reserves for vulnerabilities it judges to be under real-world exploitation and a "frequent attack vector for malicious cyber actors."

How a browser engine becomes a weapon

V8 sits at the center of nearly every mainstream web browser apart from Safari and Firefox, translating the JavaScript that runs on virtually every website into instructions the computer's processor can execute. Because it processes untrusted code from any site a user visits, V8 is wrapped in a sandbox: a set of restrictions meant to keep a malicious script from touching anything outside the browser tab that loaded it. Type confusion bugs like this one are prized by attackers precisely because they can undermine that sandbox from the inside, turning ordinary-looking JavaScript into a foothold for reading passwords, session tokens or other data, or for chaining with a second flaw to escape the browser and reach the operating system entirely.

Chrome has weathered a version of this problem for years — 2023 alone saw eight zero-days patched, and 2024 and 2025 each produced roughly half a dozen. What has changed, according to researchers who track the Chromium security program, is less the frequency of bugs than the speed with which Google's internal fuzzing tools and outside researchers are finding them before or shortly after criminal groups begin using them. Google's Chrome Security page notes that the same September update bundled fixes for eleven other flaws discovered internally or through its bounty program, most rated high severity, underscoring how much of the work happens before any single bug becomes a public emergency.

Who is affected

The exposure extends well beyond people who use Chrome directly. Microsoft Edge, Brave, Opera and Vivaldi are all built on the open-source Chromium project and inherit the same V8 engine, meaning users of those browsers needed the equivalent patch once their vendors shipped it. Firefox and Safari, which use different JavaScript engines, are not affected by this particular flaw.

For most consumers the fix arrives automatically: Chrome checks for updates in the background and applies them the next time the browser restarts, though Google's notes caution that the rollout can take "the coming days/weeks" to reach all users, leaving a window during which unpatched machines remain vulnerable to any attacker who has reverse-engineered the fix. Enterprises and government agencies face a more deliberate process, since many organizations test updates before pushing them across managed fleets of computers — precisely the gap CISA's binding directive is designed to close for federal networks, which are required to patch cataloged vulnerabilities on the agency's published deadlines rather than at each department's own pace.

Reaction and what happens next

Security researchers who reviewed the flaw described the underlying mechanism — an array incorrectly tagged with a more permissive internal type than it should carry — as a classic but still effective class of V8 bug, one that keeps surfacing despite years of hardening work by Google's V8 team. Coverage from The Hacker News and Help Net Security both noted that Google, as is typical, withheld details of who is exploiting the bug or which targets have been hit, information that tends to surface only later through threat-intelligence reports once patch adoption is further along. A separately reported account published the same week the fix shipped walked through the same CVE and CISA timeline for readers outside the security-trade press.

CISA's directive applies only to federal civilian agencies, but security teams broadly treat KEV catalog additions as a signal to prioritize patching regardless of sector, since inclusion means the agency has direct evidence of exploitation rather than theoretical risk. State and local governments, universities and private companies that follow CISA's guidance as a baseline are expected to move on the same or a similar timeline even though the September 18 deadline does not legally bind them.

For everyday users, the practical step is simply making sure Chrome — or whichever Chromium-based browser they run — is current; the browser's "About Chrome" menu both checks for and installs the latest version. Google has not said whether it expects to disclose further technical detail about the flaw or the attackers behind it once patch adoption climbs, following its usual pattern of publishing a fuller writeup weeks or months after a fix has reached the vast majority of users. With six confirmed zero-days already patched this year, the incident adds to a now-familiar rhythm for the world's most widely used browser: a quiet discovery, a rushed patch, and a race between rollout and exploitation that plays out largely invisibly to the billions of people who rely on it every day.