Google on Thursday rolled out fresh Chrome 152 security updates that resolve 12 vulnerabilities, including an exploited zero-day.
Tracked as CVE-2026-85046, the high-severity bug is described as a type confusion issue in Chrome’s V8 JavaScript and WebAssembly engine. It was reported by Salvatore Gulizia, who received a $1,000 bug bounty reward.
“Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the internet giant’s advisory reads.
While the company has not shared details on the security defect, type confusion flaws in the V8 engine may be exploited to perform remote read/write operations via crafted HTML pages.
Type confusion vulnerabilities are memory corruption bugs that could lead to crashes, remote code execution, and other malicious behavior.
CVE-2026-85046 is the sixth Chrome zero-day patched in 2026. The other five are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.
The security defect was resolved in Chrome versions 152.0.7977.82/.83 for Windows and macOS, and version 152.0.7977.82 for Linux.
The updates address nine other high-severity bugs, including out-of-bounds read/write, incomplete cleanup, use-after-free, race condition, improper resource exposure, and type confusion issues. Three of them have been reported by external researchers.
Additionally, Google fixed two medium-severity improper input validation and use-after-free weaknesses.
Related: Chrome and Firefox Updates Patch Dozens of Vulnerabilities
Related: Chrome 152 Patches Over 300 Vulnerabilities
Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Related: Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities
