Chrome CVE-2026-85046: what the exploited V8 bug tells us

Downloading a Chrome update does not finish the job if the browser keeps running the old version. That gap is especially relevant to Google’s September 3 release, which fixes a V8 vulnerability the company says has already been exploited.

What Google confirmed

Google’s September 3 desktop release includes a fix for CVE-2026-85046, a high-severity type-confusion flaw in V8, Chrome’s JavaScript engine. Google reports exploitation in the wild and credits Salvatore Gulizia, also identified as Serotav, with reporting the issue. The release contains 12 security fixes in total.

The announcement identifies Chrome 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux. These are the builds announced with this fix. If a newer supported Stable release is available, install that release rather than seeking out an older build.

Google’s September 3 desktop release and CVE details

How type confusion becomes a memory-safety bug

V8 runs JavaScript and WebAssembly inside Chrome. It uses internal representations and optimizations to execute that code efficiently, including assumptions about the values and objects it handles. Those assumptions have to remain valid when a value is read or an object is accessed.

Type confusion occurs when a resource is handled as an incompatible type. In native code, different types can have different layouts and valid operations. Using the wrong interpretation can therefore become a memory-safety problem rather than merely an incorrect JavaScript result. MITRE classifies this weakness as CWE-843.

MITRE’s definition of type confusion, CWE-843

Google identifies V8 and the type-confusion weakness class, but does not name the failed optimization, object transition or runtime function. There is not enough information in the release note to attribute this CVE to a particular JIT compiler pass. The explanation above describes the bug class, not a confirmed reconstruction of this defect.

There is more than one sandbox involved

The V8 team documents an in-process sandbox intended to keep corruption of V8-managed memory from spreading into the rest of its host process. That is distinct from the browser’s process-level isolation, which limits what a renderer may do outside its process. A JavaScript-engine bug, an escape from the V8 sandbox and a browser-process sandbox escape are separate security outcomes.

V8’s explanation of its in-process sandbox

The confirmed exploitation of a V8 bug does not establish that every attack reached the kernel or installed malware. Those claims would need evidence about delivery, additional vulnerabilities and subsequent activity. Google’s announcement does not provide that account.

The isolation layers are still worth keeping, and the V8 flaw still needs patching. They address different parts of the problem: isolation can contain some consequences of memory corruption, while the update corrects the disclosed defect. The V8 architecture material explains the design; it cannot tell us how this particular exploit behaved.

Verify the browser version after relaunch

Check Chrome’s installed channel and running version after relaunch, either on the device or through managed-browser inventory. Record the operating system too, since the announced fixed build numbers differ. An OS update record by itself does not show that Chrome’s package was updated.

For an incident review, preserve relevant browser and endpoint alerts and available identity events around the suspected activity. A crash is not a unique indicator of this CVE; many unrelated defects can crash a browser. Avoid diagnosing exploitation from a crash dialog or a stale version alone. Use the version to establish exposure and independent evidence to assess whether an incident occurred.

Close the gap between downloading and restarting

Google’s update instructions direct desktop users to Chrome’s Help menu, then About Google Chrome, and to relaunch when prompted. Google explains that closing and reopening the browser normally allows background updates to take effect. Save unfinished work before restarting; do not assume a web form will preserve what you typed.

Google’s instructions for updating desktop Chrome

For a small team, a completion record can be short: the computer, Chrome’s version after relaunch, and when it was checked. That provides a better handoff than a screenshot showing a download still in progress.

• Include shared reception computers, spare laptops and machines used only occasionally. Give each one an owner for the update.

• Ask users to save work and complete the browser restart within the maintenance window you assign.

• Recheck the running version. If the expected update is unavailable or fails, record the exception and investigate it rather than marking the computer complete.

Include the browsers people actually use

Record the browser, channel and operating system for each check. Updating Chrome does not establish that another browser on the same machine is current; its vendor and release channel need their own review. The build numbers above apply to Google’s desktop Chrome announcement.

A shared bookkeeping laptop can easily fall between responsibilities: one person sends update reminders, another uses it for payroll, and neither confirms the restart. Assign the check to someone and leave a record of the result and any unresolved problem.

A patch check does not settle an incident

A corrected version establishes patch status. It cannot establish that the device was never compromised. Preserve suspicious sign-ins, endpoint alerts or unexplained browser behavior for a separate assessment. A stale version alone does not prove exploitation, and a successful update alone does not resolve evidence of an incident.

Finish with a list of verified supported browsers and any exceptions that still need attention. Give each exception an owner and a next action so machines that missed the update do not disappear from view.

Source check: September 8, 2026. This article is Short Circuit LLC’s independent analysis of published vendor findings.