Chrome Zero-Day Vulnerability Exploited Before the Patch

Google says a Chrome zero-day vulnerability was already being exploited in the wild when it shipped a fix for it. Tracked as CVE-2026-85046 (CVSS 8.8), the flaw sits in V8, Chrome’s JavaScript and WebAssembly engine, and lets a crafted web page execute attacker-controlled code inside the browser sandbox. Security reporting identifies it as the sixth Chrome zero-day Google has patched in 2026, and CISA added it to its Known Exploited Vulnerabilities catalog within a day of the fix.

What Happened

This Chrome zero-day vulnerability, CVE-2026-85046, is a type confusion vulnerability in V8. Security researchers analyzing the fix describe the underlying bug as a compiler issue that lets an array holding one type of internal element data structure (PACKED_ELEMENTS) incorrectly receive the map for another (PACKED_SMI_ELEMENTS); the public NVD entry confirms the type-confusion classification without detailing that internal mechanism. An attacker who controls that mismatch gains arbitrary read/write access to the JavaScript heap, which researchers say can be escalated into code execution inside Chrome’s sandbox — triggered simply by a victim loading a malicious or compromised web page, no download or file needed. Security researcher Salvatore Gulizia (“Serotav”) reported the bug to Google on August 4, 2026. Google shipped the fix on September 3, 2026, in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, and confirmed at the time of release that an exploit already existed in the wild — meaning the window of exposure predates the public disclosure.

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026, with a federal remediation deadline of September 18. Security reporting counts this as the sixth Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645 — roughly one exploited V8/sandbox-escape bug reaching production every one to two months this year. Other Chromium-based browsers, including Microsoft Edge, Opera, and Brave, may also be affected if they incorporate the vulnerable V8 code; organizations should verify each vendor’s own advisory and patched version separately rather than assume blanket coverage.

Why It Matters

Most of the vulnerabilities DIESEC covers this year sit on servers, appliances, or edge devices — infrastructure that IT teams already track and patch on a defined schedule. A Chrome zero-day is different: it reaches every employee endpoint running the browser, managed or not, and requires nothing from the victim beyond opening a web page. Because exploitation began before the patch existed, organizations cannot assume “we patched quickly, so we’re fine” — any device that remained on an unpatched Chrome build before September 3 is a candidate for a retrospective look at browser activity logs. For German Mittelstand organizations, unmanaged or BYOD Chrome installations — the machines least likely to be centrally forced to update — are the highest-risk population, and browser patch compliance is rarely tracked with the same discipline as server or firewall patching.

What You Should Do Now

1. Enforce or verify the Chrome update on managed endpoints today; check per-device by navigating to chrome://settings/help, which triggers an update check and shows the installed version. Require unmanaged or BYOD devices to meet the minimum patched version before they can access corporate resources — you generally cannot force an update on privately owned hardware.
2. Verify: confirm managed endpoints are on Chrome 152.0.7977.82/.83 (Windows and macOS) or 152.0.7977.82 (Linux) or later, and separately identify unmanaged or BYOD devices where auto-update cannot be centrally enforced.
3. Mitigate: for devices that cannot be immediately updated, restrict or monitor browsing to known-trusted destinations until the patch is confirmed installed.
4. Monitor: review browser and endpoint logs for suspicious activity on devices that remained on a pre-September 3 Chrome build, since exploitation predates the public fix.

If your organization does not currently track browser version compliance the way it tracks server or firewall patch levels, treat that as the underlying gap this incident exposes.

DIESEC Perspective

Six exploited Chrome zero-days in a single year is not an anomaly at this point — it is the operating baseline for the browser your entire workforce uses every day. The governance question worth asking is not “did we patch this one,” but whether browser patch compliance is tracked and enforced with the same rigor as the server and appliance patching most organizations already take seriously.

Not sure whether your organization has visibility into browser patch compliance across managed and unmanaged devices? Contact DIESEC for a rapid endpoint exposure assessment.

Sources: NVD | Google Chrome Releases | The Hacker News | SecurityWeek
Published: 2026-09-09 | Category: Vulnerabilities & Patches | ~4 min read