Back
Google Chrome Hit by Wave of Vulnerabilities, Including Actively Exploited Zero-Day

Google Chrome Hit by Wave of Vulnerabilities, Including Actively Exploited Zero-Day

NEWS Publication date: 2026-09-07

Google released a large number of security fixes for Chrome during the first week of September, addressing dozens of vulnerabilities across different parts of the browser. Among them is CVE-2026-85046, a high-severity vulnerability in Chrome's V8 JavaScript engine that Google has confirmed is being actively exploited.

BaseFortify users can consult our annotated CVE-2026-85046 report for additional information. The report includes our vulnerability Q&A and AI assistant, allowing users to ask questions about the vulnerability, its impact and possible remediation.

Key point: Google fixed dozens of Chrome vulnerabilities in just a few days, including serious sandbox-related flaws and one vulnerability already being actively exploited.

An Actively Exploited V8 Vulnerability

CVE-2026-85046 is a type confusion vulnerability in V8, the JavaScript engine used by Google Chrome. A remote attacker can exploit the vulnerability through a specially crafted HTML page to execute arbitrary code inside the Chrome sandbox. The vulnerability was reported to Google on August 4 by security researcher Salvatore Gulizia and has been rated High severity.

More importantly, Google has confirmed that an exploit for CVE-2026-85046 exists in the wild. CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, indicating evidence of active exploitation. Google addressed the vulnerability in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux.

Dozens of Chrome Vulnerabilities in a Single Week

CVE-2026-85046 was only one vulnerability in an unusually busy week for Chrome security. On September 1, Google released Chrome 152.0.7977.75/.76 with 26 security fixes. Just two days later, another update followed containing 12 additional security fixes.

The vulnerabilities affect numerous Chrome components, including V8, WebGL, DevTools, Skia, FileSystem, WebRTC and browser networking. A selection of the CVEs published during the week illustrates the range of problems addressed:

CVE CVSS Component Vulnerability
CVE-2026-85046 8.8 V8 Type confusion allowing code execution inside the sandbox
CVE-2026-85042 9.6 DevTools Use-after-free allowing code execution outside the sandbox
CVE-2026-85050 9.6 WebGL Out-of-bounds write allowing code execution outside the sandbox
CVE-2026-85048 8.3 Compositing Use-after-free allowing code execution outside the sandbox
CVE-2026-84353 9.6 Shared Tab Groups Use-after-free allowing code execution outside the sandbox
CVE-2026-84352 9.6 WebGL Use-after-free allowing code execution outside the sandbox
CVE-2026-84325 9.8 DataTransfer Improper input validation allowing access restrictions to be bypassed
CVE-2026-84324 9.0 Proxy Use-after-free allowing code execution outside the sandbox

Several of these vulnerabilities involve memory-safety problems such as use-after-free, out-of-bounds access and type confusion. Some are particularly serious because exploitation can result in code execution outside the Chrome sandbox, crossing an important security boundary intended to contain a compromised browser process.

Update Chrome as Soon as Possible

While all of these vulnerabilities deserve attention, CVE-2026-85046 has the additional distinction of being exploited in real-world attacks. Google has not disclosed details about the attacks and may continue restricting access to technical information until most users have received the update. Chrome normally installs updates automatically, but organizations should verify that managed systems have actually received the latest security release rather than simply assuming that automatic updating has taken place.

Keeping Track of Vulnerabilities with BaseFortify

A week in which dozens of vulnerabilities appear for a single widely deployed product demonstrates one of the central challenges of vulnerability management: determining which newly published CVEs actually affect your organization.

With BaseFortify, organizations can maintain a component list containing the software products and technologies they use. When a newly published CVE matches one of those components, BaseFortify can immediately identify the match and warn users about the new vulnerability. Security teams can therefore concentrate on vulnerabilities relevant to their own environment rather than manually following vulnerability feeds for every product they use.

BaseFortify also provides annotated CVE reports, vulnerability Q&A and an AI assistant to help users understand individual vulnerabilities and determine appropriate next steps. The Chrome vulnerabilities published last week demonstrate the value of combining an accurate software inventory with continuous vulnerability monitoring, reducing the time between CVE publication, identification of exposure and remediation.

Resources