Chrome zero-day CVE-2026-85046: patch by September 18

Chrome zero-day CVE-2026-85046 is being exploited in the wild, and the fix is already sitting in your browser waiting for a restart. Google shipped it in the stable desktop channel this week, Help Net Security reported on September 4, and CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day with a September 18 remediation deadline for covered federal systems. That date is a reasonable deadline for everyone else too.

What actually happened

CVE-2026-85046 is a type confusion bug in V8, the JavaScript and WebAssembly engine inside Chrome. Rated CVSS 8.8, it lets a remote attacker execute arbitrary code inside Chrome's sandbox by way of a crafted HTML page — meaning a page you visit, or an ad served on a page you visit, is enough to start the chain. Google's own wording is the part that matters: an exploit for it exists in the wild.

Security researcher Salvatore Gulizia, who works under the handle Serotav, reported the bug on August 4 and received a $1,000 bounty. The fix landed in Chrome 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux, in a release carrying 12 security fixes total. This is the sixth Chrome zero-day Google has patched in 2026.

One nuance worth keeping straight: code execution inside the sandbox is not full machine compromise on its own. It is the first half of a chain that typically pairs with a sandbox escape. Treat it as urgent, not apocalyptic — and note that anything embedding Chromium, from Electron apps to your CI runners' headless browsers, inherits the same engine.

Why it matters for your business

The browser is now the widest attack surface most small teams have, because it is where the sessions live. Your admin console, your payment dashboard, your email, your CRM — all authenticated in tabs, all reachable by code running in the renderer. And the browser is increasingly where your agents run too: extension-based assistants and computer-use tooling all execute against the same engine.

Chrome updates on relaunch, which is exactly why this sits unpatched on real machines. Half your team has not restarted the browser in three weeks. The fix is not a project, it is a policy: set chrome://policy to force a relaunch window, or push the update through your MDM and verify the version rather than trusting that it happened. Check chrome://version on a sample of machines and confirm you are at or above 152.0.7977.82.

Then widen the check. Edge, Brave, Opera and every other Chromium browser on your fleet needs the corresponding build. So does anything shipping an embedded Chromium — desktop apps built on Electron are the ones people forget, and they do not prompt you to relaunch.

Sources: Help Net Security, CISA Known Exploited Vulnerabilities Catalog.