www.it-connect.fr
Google Chrome: the 6th 2026 zero-day is here, patch now
Six zero-day flaws since the start of 2026 for Google Chrome: the count was updated on September 3, 2026, following the release of a new security update designed to patch 12 vulnerabilities, including CVE-2026-85046. Here's what you need to know.
On Thursday, September 3, 2026, Google released a new security bulletin to announce the rollout of new Google Chrome versions for Windows, macOS, and Linux. As usual, the rollout is gradual and will take place over the next few days.
CVE-2026-85046: another flaw in the JavaScript engine
This security bulletin mentions 12 now-patched security flaws, including 10 classified as important. But the one that caught my attention is associated with the CVE-2026-85046 identifier. The reason: it is a zero-day flaw and it is reportedly being actively exploited. "Google is aware of the existence of an exploit for CVE-2026-85046 in the wild," the bulletin states. It was reported to Google on August 4 by a security researcher nicknamed Serotav, who received $1,000 for this great discovery.
The vulnerability is located in V8, Google Chrome's JavaScript and WebAssembly engine. It is a "type confusion" flaw. As a reminder, this type of bug occurs when the engine handles an object in memory as if it belonged to a different type than its own. In a JavaScript engine like the one used by Google's browser, this opens the door to uncontrolled memory reads and writes.
In practice, this could allow a remote attacker to execute arbitrary code inside Chrome's sandbox from a booby-trapped web page. Classic behavior when exploiting a security flaw in a browser, whether Chrome or another one.
However, Google has not said who is behind these attacks. The Mountain View company also does not provide technical details until most users have received the fix; as usual.
How can you protect yourself?
To protect yourself from this security flaw, you need to install the latest version of Google Chrome:
- Windows and Mac: 152.0.7977.82/.83
- Linux: 152.0.7977.82
Finally, beyond the zero-day flaw, this update addresses nine other important vulnerabilities spread across several browser components. A few examples:
- CVE-2026-85045. A race condition in V8.
- CVE-2026-85048. A use-after-free in the Compositing component.
- CVE-2026-85050. An out-of-bounds write in WebGL.
- CVE-2026-85042 and CVE-2026-85049. Two use-after-free bugs, respectively in DevTools and in the Skia graphics library.
- CVE-2026-85052. An out-of-bounds read in CrashReporting.
Time to patch!
