Google shipped Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux on 4 September 2026, fixing CVE-2026-85046 along with eleven other flaws.
The advisory language is the standard formula: "Google is aware that an exploit for CVE-2026-85046 exists in the wild." No threat actor, no campaign, no targeting. Google did not share further detail about the flaw or its exploitation, which is normal practice while the update rolls out.
CISA added it to the Known Exploited Vulnerabilities catalogue the same day. It is the sixth actively exploited Chrome zero-day of 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645.
What the bug is, precisely
A type confusion in V8, CWE-843, rated 8.8. In V8's compiler, an array holding PACKED_ELEMENTS can be given a PACKED_SMI_ELEMENTS map — the engine is told the contents are one thing while they are another. From there it becomes arbitrary read and write within the JavaScript heap.
The precision that matters: successful exploitation gives an attacker arbitrary code execution inside Chrome's sandbox after the victim visits a crafted page. That is severe. It is also not, on its own, a compromise of the machine — a sandbox escape is still required for that, and this bug is not one.
Anyone writing "visit a page, lose your computer" has skipped a step that Google did not skip.
The number that does not fit
The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, who works as Serotav. The award was $1,000.
Set that against Chrome's own published Vulnerability Reward Program schedule for memory corruption:
| Category | Reward |
|---|---|
| Baseline reports | $25,000 / $10,000 / $7,000 |
| Demonstrated memory corruption | up to $35,000 |
| Controlled write, non-sandboxed process | up to $90,000 |
| Demonstrated RCE, non-sandboxed process | up to $250,000 |
$1,000 is below every published tier. The floor on that table is $7,000.
Be careful about what that means
It is tempting to read a low payment as a judgment on the report. Resist that. Several things produce a token award under Chrome's VRP, and they say very different things:
- The report did not demonstrate security impact, and Google's own engineers established it afterwards.
- The bug was already known internally — a duplicate. This is the most common reason a report drops to a nominal amount.
- The panel applied some other consideration not visible from outside.
Google does not publish per-case reasoning, and none of the above reflects badly on Gulizia. Finding a V8 type confusion is difficult work regardless of what the panel decided about the paperwork.
But one of those branches is worth stating out loud. If it was a duplicate, Google knew about this bug before 4 August, and the fix shipped on 4 September. That is a question, not an accusation, and it is the only version of events in which the amount and the outcome are both explained.
What is not established about the timeline
Thirty-one days passed between report and patch. It would be easy to line that up against "exploited in the wild" and conclude that users were exposed for a month while a known bug sat unfixed.
There is no evidence for that ordering. Google's statement gives no date for when exploitation began or when it was detected. Exploitation may well have been discovered late in the cycle, after the fix was already being prepared — which is how several of the year's other Chrome zero-days went.
The honest position: the report date is known, the patch date is known, and the exploitation date is not. Three data points, and the interesting one is missing.
The economics underneath
There is a wider thing here worth noticing without overclaiming.
A human researcher found a V8 type confusion that turned out to matter enough to be exploited in the wild and to reach CISA's catalogue, and the transaction closed at $1,000. In the same week, a model was announced as scoring 100% on a benchmark of turning advisories into working exploits, with a valuation attached to it that does not fit on this page.
Those two facts are not causally connected and it would be silly to pretend otherwise. They are, however, both descriptions of what finding exploits is currently worth, and they point in opposite directions.
What to do
- Update Chrome now. 152.0.7977.82 or later. The rollout is progressive, so check rather than assume — the version in Help > About is the answer, not the update channel's promise.
- Update everything else built on Chromium. Edge, Brave, Opera, Vivaldi and every Electron application in your estate ship the same V8. Electron apps are the ones that get forgotten.
- Do not treat this as a full compromise. It is in-sandbox execution. Chain it with a sandbox escape and the picture changes, and no such chain has been reported here.
- If you run a bounty programme, publish your reasoning. Not the details of the bug — the reason for the amount. The absence of it is what turns a routine award into a story.
What is not established
- When exploitation began, or when Google detected it. Not stated.
- Who is exploiting it, or against whom. Not stated.
- Why the award was $1,000. No reasoning published.
- Whether the bug was a duplicate, which is the explanation that would resolve both open questions at once.
- Whether an escape chain exists. Nothing reported pairs this with a sandbox escape.
