Google Patches 6th Chrome Zero

Google on Thursday rolled out fresh Chrome 152 security updates that resolve 12 vulnerabilities, including an exploited zero-day.

Tracked as CVE-2026-85046 , the high-severity bug is described as a type confusion issue in Chrome’s V8 JavaScript and WebAssembly engine. It was reported by Salvatore Gulizia, who received a $1,000 bug bounty reward.

“Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the internet giant’s advisory reads.

While the company has not shared details on the security defect, type confusion flaws in the V8 engine may be exploited to perform remote read/write operations via crafted HTML pages.

Type confusion vulnerabilities are memory corruption bugs that could lead to crashes, remote code execution, and other malicious behavior.

CVE-2026-85046 is the sixth Chrome zero-day patched in 2026. The other five are CVE-2026-2441 , CVE-2026-3909, CVE-2026-3910 , CVE-2026-5281 , and CVE-2026-11645 .

The security defect was resolved in Chrome versions 152.0.7977.82/.83 for Windows and macOS, and version 152.0.7977.82 for Linux.

The updates address nine other high-severity bugs, including out-of-bounds read/write, incomplete cleanup, use-after-free, race condition, improper resource exposure, and type confusion issues. Three of them have been reported by external researchers.

Additionally, Google fixed two medium-severity improper input validation and use-after-free weaknesses.

Related: Chrome and Firefox Updates Patch Dozens of Vulnerabilities

Related: Chrome 152 Patches Over 300 Vulnerabilities

Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Related: Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Exploit Published for Fresh Cleo Harmony Vulnerability

Malicious Virtualizor Update Served via BGP Hijacking

Chrome and Firefox Updates Patch Dozens of Vulnerabilities

23-Year-Old Sality P2P Botnet Disrupted

Hackers Start Exploiting Critical Langflow Vulnerability

Five Venezuelans Plead Guilty in US Court to ATM Jackpotting

Ransomware Gang Claims Nutex Health Data Breach

9.5 Million Impacted by Aesto Health Data Breach

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

Capsule Security Launches ‘AI Circuit Breaker’ to Stop Rogue Agents

HiddenLayer Raises $100 Million for AI Runtime Security

AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million

153 Million Driver License Images Offered on Dark Web

Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities

OpenLeash Adds a Human Check to Risky AI Agent Actions

Virtual Event: Attack Surface Management Summit 2026

Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.

Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover?

In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.

Flipboard Whatsapp Whatsapp Email