Google has patched CVE-2026-85046, an actively exploited high-severity type-confusion vulnerability in the V8 JavaScript engine used by Chrome. The September 3 stable-channel release fixes the flaw on Windows, macOS and Linux, while the US Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalog on September 4. Users and administrators should verify that desktop browsers have received the corrected build.

Google credited security researcher Salvatore Gulizia, also known as Serotav, with reporting the vulnerability on August 4. The company awarded a 1,000 dollar bounty and classified the issue as high severity. Google said an exploit exists in the wild but did not identify the attackers, their targets or the scale of observed exploitation, and it has restricted access to technical bug details while updates reach users.

CVE-2026-85046 is a type-confusion weakness in V8, the component that processes JavaScript in Chrome. NHS England Digital, citing the CVE record and Google advisory, said a remote attacker could use a crafted HTML page to execute arbitrary code inside the browser sandbox. Type-confusion bugs arise when software handles an object as an incompatible data type, potentially corrupting memory and opening a path to unintended code execution.

The stable update moves Chrome to versions 152.0.7977.82 or 152.0.7977.83 on Windows and macOS, and 152.0.7977.82 on Linux. Google said the release contains 12 security fixes in total. The company has not published indicators of compromise or enough exploit-chain detail to determine whether CVE-2026-85046 alone can escape the Chrome sandbox, so defenders should not infer capabilities beyond the confirmed in-sandbox code execution.

CISA placed the vulnerability in its KEV catalog after determining that it has been exploited, making remediation a priority for organizations that manage Chrome fleets. The Canadian Centre for Cyber Security and NHS England Digital also urged users and administrators to apply the available update. Managed environments should confirm deployment through browser inventory rather than assume that the staged rollout has reached every endpoint.

Chrome users can open the browser settings and review the About Chrome page to trigger an update check, then restart the application and confirm the installed version. Security teams should prioritize internet-facing user workstations, monitor for unusual browser-child processes or post-exploitation activity, and follow Google and CISA advisories for additional technical details as disclosure restrictions are lifted.