Abstract:
Google recently released an emergency security update for the Chrome browser, focusing on fixing a high-risk zero-day vulnerability that has been actively exploited by hackers in the wild, and also patched 11 other security vulnerabilities. The zero-day vulnerability, tracked as CVE-2026-85046, is a type confusion vulnerability that exists in Chrome's open source JavaScript and WebAssembly engine V8.
The vulnerability was discovered and reported by security researcher Salvatore Gulizia (network code name "Serotav"). Under a type confusion flaw, software misjudges an object of one type as another type, causing memory corruption. An attacker can usually induce users to access a specially crafted web page containing malicious scripts, thereby triggering the vulnerability and achieving arbitrary code execution in the victim's sandbox rendering process.
In response to this threat, Google has pushed a repair version to all platforms. The Windows and macOS platforms have been updated to 152.0.7977.82/.83, and the Linux platform has been updated to 152.0.7977.82. Google confirmed in the security bulletin that it has learned that attacks and exploits targeting this vulnerability exist in the wild, but the official did not disclose the technical details and specific attack methods of the vulnerability, aiming to gain sufficient repair time for the majority of users and downstream projects that rely on the code.
The update patch pushed this time also fixes 9 other high-risk vulnerabilities, involving key components such as the crash reporting system (Crash Reporting), network module (Network), composition (Compositing), WebGL, cache storage (CacheStorage), developer tools (DevTools), Skia 2D graphics library, and race conditions in the V8 engine.
It is worth noting that CVE-2026-85046 is the sixth Chrome zero-day vulnerability patched by Google this year that has been exploited in the wild. Previously fixed issues cover out-of-bounds reads and writes in the V8 engine, iterator failures in CSS font feature value implementation, out-of-bounds writes in the Skia graphics library, and Use-After-Free vulnerabilities in the WebGPU standard implementation Dawn.
Security experts recommend that Chrome users check and apply the update as soon as possible. You can automatically trigger the download and installation through the "About Chrome" page in the browser's "Settings" and restart the browser after completion to ensure that the patch takes effect. At the same time, users who use browsers such as Microsoft Edge, Brave, Opera and Vivaldi based on the Chromium kernel also need to pay close attention to subsequent pushes and complete the upgrade as soon as each manufacturer releases the corresponding version.
Learn more:
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
Comments