Google Patches 12 Chrome Vulnerabilities, Including an Actively Exploited Zero-Day

Google has released an update for Chrome (152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux) that includes patches for 12 vulnerabilities, notably a high-severity, actively exploited CVE (CVE-2026-85046).

The patched vulnerabilities include:

[$1,000][542403045] High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04.
[N/A][502304489] High CVE-2026-85052: Out of bounds read in CrashReporting. Reported by Google on 2026-04-13.
[N/A][533502257] High CVE-2026-85043: Incomplete cleanup in Network. Reported by Google on 2026-07-10.
[TBD][540357382] High CVE-2026-85048: Use after free in Compositing. Reported by Ngoc Hieu on 2026-07-29.
[TBD][547819997] High CVE-2026-85045: Race condition in V8. Reported by Brendan Dolan-Gavitt, XBOW on 2026-08-17.
[N/A][549350408] High CVE-2026-85050: Out of bounds write in WebGL. Reported by Google on 2026-08-20.
[TBD][552689418] High CVE-2026-85053: Improper resource exposure in CacheStorage. Reported by Salvatore Gulizia (Serotav) on 2026-08-26.
[N/A][553119925] High CVE-2026-85042: Use after free in DevTools. Reported by Google on 2026-08-26.
[N/A][553345874] High CVE-2026-85049: Use after free in Skia. Reported by Google on 2026-08-27.
[N/A][553449113] High CVE-2026-85051: Type confusion in Compositing. Reported by Google on 2026-08-27.
[N/A][513790581] Medium CVE-2026-85047: Improper input validation in Transactions Platform. Reported by Google on 2026-05-16.
[N/A][517482830] Medium CVE-2026-85044: Use of released resource in Mobile. Reported by Google on 2026-05-28.

While Google did not go into deep technical detail in its security advisory, the company did acknowledge that an exploit for the high-severity CVE (CVE-2026-85046) currently exists in the wild. Salvatore Gulizia is credited with reporting this flaw and was awarded a $1,000 bounty for the responsible disclosure.

In his own write-up, Gulizia goes into much more detail on what this CVE entails. Found and reported in early August, it is essentially a V8 bug in the compilers that causes an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS.

This can be turned into an arbitrary read/write on the JavaScript heap.

Please Note: To ensure you are protected against this exploit, please check your browser version. If it has not yet updated, follow the instructions below to apply the patch manually:

• Launch Google Chrome.
• Click the three-dot menu (⋮) icon and navigate to Help.
• Select About Google Chrome.
• Wait for the update to download, then click Relaunch to apply the patch.