Half of Chrome's Six 2026 Zero-Days Hit the Same Engine

The Sixth of the Year, and a Pattern in the Other Five

Google shipped the fix for CVE-2026-85046 on September 3, 2026, a high-severity type confusion flaw in Chrome's V8 JavaScript and WebAssembly engine that lets crafted web content trigger arbitrary read and write access inside the browser sandbox. It is the sixth zero-day Google has patched this year that was already under active exploitation before the fix existed, and looking at all six together shows something a single advisory never states outright: three of them, including this one, hit the same component.

The pattern only shows up when the year's advisories are lined up side by side.

Why V8 Keeps Coming Back

V8 is the component that turns the JavaScript and WebAssembly on every web page into running code, which makes it the part of Chrome that touches the most attacker-controlled input by design. A type confusion bug there, like the one in CVE-2026-85046, tricks the engine into treating one kind of memory object as another, which is enough to build arbitrary read and write access and, from there, code execution inside the sandbox. Three separate exploitable bugs in the same engine inside one year is not a coincidence of bad luck, it is a signal that offensive researchers and criminal groups alike have converged on V8 as the highest-value target in the browser, because a working exploit chain there tends to be reusable across many sites and many victims.

The researcher who found this specific flaw, Salvatore Gulizia, reported it on August 4, 2026 and received a 1,000 dollar bounty, a modest reward next to the fact that the bug was already being used in real attacks by the time Google shipped a fix a month later.

What to Do About It Now

The fix is in Chrome 152.0.7977.82 or .83 for Windows and macOS and 152.0.7977.82 for Linux, and it rolls out automatically over the coming days and weeks unless a business has disabled auto-update or delayed it through managed policy. The Cybersecurity and Infrastructure Security Agency added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026 with a September 18 remediation deadline for United States federal civilian agencies, a deadline that only binds government bodies directly but is a reasonable target date for any organization managing its own patch cycle.

Given that three of this year's six actively exploited Chrome bugs hit the same engine, the practical lesson is not just to patch this one flaw. It is to treat V8-related Chrome advisories as a recurring, not occasional, category of risk, and to check that automatic updates are actually enabled on managed fleets rather than assuming they are.

Read next: December 2026 Is When Your Ad Blocker Gets Weaker in Edge  |  Chrome's Next Zero-Day Files to Brussels