Loading story…
Google released Chrome Stable 152.0.7977.82 for Linux and 152.0.7977.82/.83 for Windows and macOS to fix CVE-2026-85046, a high-severity type-confusion zero-day in the V8 JavaScript and WebAssembly engine that is being exploited in the wild. A malicious website can trigger unsafe memory handling and potentially execute attacker-controlled code within Chrome's browser sandbox; an additional vulnerability could be chained to escape that boundary.
The release contains 12 security fixes—10 rated high severity and two medium severity—affecting V8, WebGL, Compositing, Network, DevTools, Skia, and other components. Google has withheld exploit and targeting details while patch adoption increases. Organizations should force an update and relaunch Chrome across managed endpoints, verify deployed versions, and prioritize corresponding updates for Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi when available.
See which actors are running it and whether you're in range.
16 events from the most recent confirmed update back to the earliest known activity.
CIRT.cm published alert CIRT-AL-2026-09-05 for Cameroonian organizations, including the actively exploited Chromium V8 vulnerability CVE-2026-85046. The alert urged immediate patching and browser updates, MFA for critical access, monitoring of anomalous outbound HTTPS and SSH traffic, and incident reporting.
CISA added CVE-2026-85046, a Chromium V8 type-confusion vulnerability, to its Known Exploited Vulnerabilities Catalog. It directed organizations to follow vendor mitigations under BOD 26-04 guidance and set a remediation due date of September 18, 2026.
The Canadian Centre for Cyber Security published advisory AV26-883, warning that Chrome versions before 152.0.7977.82 are affected by CVE-2026-85046 and urging users and administrators to apply available updates. The advisory noted Google's awareness of an in-the-wild exploit as of September 3, 2026.
TA412 began using Proofpoint's newly observed BlueMoon exploit kit against US NGOs, mining companies, and physical commodity-trading organizations. The chain exploited Chrome V8 flaw CVE-2026-85046 with an unassigned V8 sandbox escape and Windows kernel LPE CVE-2026-85880, and delivered the GemStone malicious browser extension.
Salvatore Gulizia reported CVE-2026-85053, a high-severity improper-resource-exposure vulnerability in Chrome's CacheStorage component.
Brendan Dolan-Gavitt of XBOW reported CVE-2026-85045, a high-severity race-condition vulnerability in Chrome's V8 component.
Salvatore Gulizia (Serotav) reported CVE-2026-85046, a high-severity type-confusion vulnerability in Chrome's V8 JavaScript engine. Google awarded a $1,000 bug bounty for the report.
Proofpoint observed at least four cyber-espionage groups using the shared BlueMoon Chrome exploit framework in separate campaigns beginning in late August. In addition to TA412, UNK_LateNight targeted U.S. aerospace and defense firms, UNK_DoubleCheck targeted a Vietnamese manufacturer, and UNK_QuietRacket targeted organizations in Indonesia and Singapore; most were assessed as linked or suspected to be linked to Chinese state intelligence.
Ngoc Hieu reported CVE-2026-85048, a high-severity use-after-free vulnerability in Chrome's Compositing component.
Google reported CVE-2026-85052, a high-severity out-of-bounds read vulnerability in Chrome's CrashReporting component.
Opera released security updates for Opera One, Opera GX, Opera Air, Opera Neon, and Opera for Android that address several vulnerabilities, including the CVE-2026-85046 zero-day. The updated versions include Opera One 135.0.5973.92, Opera GX 135.0.5973.94, Opera Air 135.0.5973.93, Opera Neon 135.0.5973.100, and Opera for Android 101.4.
The Guyana National CIRT recommended that users and administrators review Google's Chrome security advisory and apply the available update for versions affected by CVE-2026-85046.
The Netherlands' NCSC warned that Chrome versions before 152.0.7977.82 are vulnerable to multiple flaws, including CVE-2026-85042, CVE-2026-85046, and CVE-2026-85047. It said proof-of-concept code is available for CVE-2026-85046 and urged users to install Google's updates.
Salvatore Gulizia said the V8 compiler flaw can cause an array with PACKED_ELEMENTS to receive the PACKED_SMI_ELEMENTS map, enabling arbitrary read and write access on the JavaScript heap. Google withheld details of observed in-the-wild exploitation while users apply the update.
Google confirmed that CVE-2026-85046 is being actively exploited in the wild. The high-severity V8 type-confusion flaw can be triggered through malicious web content and enables code execution within Chrome's browser sandbox.
Google updated Chrome Stable to 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, addressing 12 security vulnerabilities across components including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 97 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
48 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourceproofpoint.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026
Google released Chrome stable-channel updates to address multiple security vulnerabilities, including **CVE-2024-5274**, a high-severity **type confusion** flaw in the **V8 JavaScript engine** that Google said was being exploited in the wild. The company shipped patched desktop versions `125.0.6422.112/.113` for Windows and Mac and `125.0.6422.112` for Linux, while limiting technical details until more users had updated. The bug was reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security. Subsequent Chrome advisories and release notes show Google continuing to issue stable-channel fixes for broader sets of browser and platform weaknesses, including advisories describing **seven vulnerabilities with three critical flaws** and ChromeOS updates carrying additional browser and third-party security patches. The later fixes covered high-, medium-, and low-severity issues such as **use-after-free**, **type confusion**, **race conditions**, **bad cast**, and implementation errors across components including **V8**, **WebRTC**, **DevTools**, **Downloads**, **Password Manager**, and **WebGPU**, underscoring the ongoing need for rapid Chrome and ChromeOS patch deployment.
Aug 24, 2026
Google released an urgent **Chrome stable channel** update to address two **high-severity zero-day vulnerabilities** that the company says are being **actively exploited in the wild**. The patched versions are `146.0.7680.75/76` for **Windows and macOS** and `146.0.7680.75` for **Linux**, with rollout occurring over days to weeks. The flaws were reported internally by Google on March 10, and Google said access to additional bug details may remain restricted until most users have updated. The two vulnerabilities are **CVE-2026-3909**, an **out-of-bounds write in Skia**, and **CVE-2026-3910**, an **inappropriate implementation in V8**. Both components are high-value targets because they sit in Chrome’s rendering and JavaScript execution paths, creating opportunities for malicious webpages to trigger memory corruption or unsafe browser behavior that could lead to **arbitrary code execution**. The update is a substantive security release rather than routine product news because Google explicitly confirmed that exploits exist for both issues, making rapid patching a priority for enterprises and end users.
Jun 29, 2026