wbroom

What Chrome 152 CVE-2026-85046 is: 2026 sixth zero-day patch

Google patched its sixth Chrome zero-day of 2026 on the Stable channel. Here is the version floor, the in-the-wild line, and why Chromium forks lag.

On 3 September 2026 Google pushed desktop Chrome Stable to 152.0.7977.82/.83, closing a V8 type-confusion bug it says is already exploited in the wild.

The searchable event is CVE-2026-85046. The Chrome Releases post calls it type confusion in V8, reported by Salvatore Gulizia (Serotav) on 2026-08-04, with a $1,000 bounty.

4 Aug: Gulizia report 3 Sep: Stable 152.82 Check version, relaunch

What the advisory says

The Stable builds are 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux. Google says the update rolls out over the coming days and weeks. The same paragraph states that an exploit for this CVE exists in the wild.

6 / 2026
Chrome zero-days in 2026 (SecurityWeek count)
12
CVEs in the same Stable drop (HKCERT)
152.82
Linux floor; Win/mac also ship .83

How to read the update

  1. 1

    Treat it as a Stable security drop, not a feature release

    The 3 September Chrome Releases headline is a desktop Stable update. SecurityWeek says the package fixes 12 bugs, including nine high and two medium. The headline item is this already-exploited V8 type confusion.

  2. 2

    Treat the version number and a relaunch as one step

    A downloaded patch does nothing until Chrome restarts. Help → About Google Chrome, or chrome://settings/help. Confirm 152.0.7977.82 or later, then close leftover processes.

  3. 3

    Check Chrome and the Chromium skins separately

    The V8 fix lands in Chromium, but Edge, Brave, Opera, and Vivaldi ship on their own cadence. Enterprises still have to inventory pinned builds, kiosks, and browsers that never restart.

01

Sixth zero-day is a count, not a score

SecurityWeek lists five earlier Chrome zero-days patched in 2026. That only shows V8 remains a frequent target. It does not rank this bug against the last one.

02

Code inside the sandbox is not the same as a full-device takeover

Chromium’s own impact text stops at in-sandbox execution. Escaping the browser sandbox needs a second bug. The advisory does not say whether the wild exploit already chained that far.

03

Technical detail is being held back on purpose

The Stable note gives the CVE, the component, the reporter, and the bounty. Later compiler notes from researchers are not a user playbook, and this article does not replay exploit steps.

Claim Checkable source How to read it
CVE-2026-85046, V8 type confusion, High; exploit in the wild Chrome Releases, 2026-09-03; SecurityWeek, 2026-09-04 Vendor confirmation
Win/mac 152.0.7977.82/.83; Linux 152.0.7977.82 Same Stable post; HKCERT bulletin 4 Sep Minimum safe build
Sixth Chrome zero-day of 2026; five earlier CVE IDs SecurityWeek’s count of Google advisories Press tally, not a CVSS score

Patching a browser engine is not the same job as talking over a board in a tab. For voice and a whiteboard only, start from the wbroom homepage with no account. Room steps: create and join a room. Nearby browser notes: Firefox iOS ad blocking and GrapheneOS on Pixel 11. Rooms without accounts: privacy note.

Chrome Releases, 3 September 2026: Google is aware that an exploit for CVE-2026-85046 exists in the wild.

# Chrome Stable 2026-09-03
CVE-2026-85046  High  Type confusion in V8
Reporter: Salvatore Gulizia (Serotav)  2026-08-04  $1,000
Fixed: 152.0.7977.82/.83 Win/macOS · 152.0.7977.82 Linux
Google: exploit exists in the wild
Also: 11 more CVEs in the same Stable drop (HKCERT: 85042–85053)

Limits

Stable does not mean every machine is patched
Google says the rollout takes days to weeks. Tabs that never relaunch still run the old engine.
Forked browsers are not Chrome’s ship date
Edge and others ingest Chromium security fixes on their own calendars. Use each product’s About page.
Twelve CVEs are not one story
HKCERT lists 85042 through 85053. Only 85046 is the one Google marked as exploited in the wild.

Questions worth checking

Which build counts as patched?

Linux needs 152.0.7977.82 or later; Windows and macOS need 152.0.7977.82 or .83 or later. That floor comes from the 3 September Chrome Releases post and the HKCERT bulletin.

If Chrome is updated, are phones and other Chromium browsers done?

No. This note is desktop Stable. Android Chrome, Chrome on iOS, Edge, Brave, and the rest follow their own channels for the same V8 fix.

Is this a feature release or an emergency security drop?

Per the 3 September Stable note, it is a desktop update with 12 security fixes. The headline is an already-exploited V8 type-confusion bug, not a launch keynote.

Start a meeting