Updated

Updated · Malwarebytes Labs · Sep 5

Google Patches 26 Chrome Flaws, Including 1 Exploited V8 Bug and 2 Critical RCE Risks

Updated

Updated · Malwarebytes Labs · Sep 5

Google Patches 26 Chrome Flaws, Including 1 Exploited V8 Bug and 2 Critical RCE Risks

Q: With Google withholding the attackers' identities, who is actively exploiting this critical browser vulnerability in the wild right now?

No public attribution is available. Google has confirmed that CVE-2026-85046 is being exploited in the wild, but it has deliberately withheld the attackers’ identities, targeting details, and operational information while patches roll out. The available reporting and Google’s advisory do not name any threat actor, government, spyware vendor, criminal group, or campaign linked to the exploitation. CISA’s addition of the flaw to the Known Exploited Vulnerabilities catalog confirms active exploitation, but it also does not attribute the attacks. What is known is the nature of the bug and the risk: it is a high-severity type confusion flaw in Chrome’s V8 engine that can be triggered through a crafted HTML page and may allow arbitrary code execution inside Chrome’s sandbox. Security researcher Salvatore Gulizia reported the flaw, and Google patched it in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. In practical terms, the answer to “who is exploiting it right now?” is that the public does not know yet. Any claim naming a specific actor would be speculative unless Google, CISA, or a trusted incident-response disclosure later provides attribution. For now, the most useful fact is that exploitation is real and confirmed, and users of Chrome and Chromium-based browsers should update immediately.

3 articles · Updated · Malwarebytes Labs · Sep 5

Chrome 152.0.7977.82/.83 for Windows and Mac, and .82 for Linux, fixes an actively exploited V8 flaw plus 26 security issues in the desktop browser.
CVE-2026-85046 is a high-severity V8 bug already exploited in the wild; Google said a crafted HTML page could execute arbitrary code inside Chrome’s sandbox, and HKCERT rated the overall risk extremely high.
Two other critical use-after-free bugs—CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL—could let attackers run code outside the sandbox if users are lured to malicious HTML content.
The update is rolling out automatically, but users can trigger it through Settings > About Chrome and must restart the browser to complete protection.
The V8 issue is the sixth actively exploited Chrome zero-day patched this year, and other Chromium-based browsers may also need corresponding fixes.