Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has distributed an urgent update for Chrome to correct CVE-2026-85046, a zero-day vulnerability in V8 that is being actively exploited. The solution requires updating to Chrome 152.0.7977.82 or higher and restarting the browser to apply the patch.
Google released the emergency update after detecting active exploitation of CVE-2026-85046, a high-severity zero-day in V8, the JavaScript and WebAssembly engine used by Chrome. The vulnerability enables a remote attacker to execute arbitrary code inside the browser sandbox when the victim visits a manipulated HTML page, a scenario typical in campaigns that combine malicious links, malvertising, or compromised websites.
The defect is classified as a type confusion in V8, a class of vulnerability that often provides dangerous primitives such as arbitrary read and write access within the JavaScript heap. Technical analysis points to the Maglev compiler and optimizations related to Array.prototype.sort, where certain inlining and specialization decisions can leave the engine in an inconsistent state that becomes exploitable.
Google has corrected the issue in the stable desktop channel with versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. The update also addresses a total of twelve vulnerabilities, reinforcing the recommendation to apply the patch as soon as possible.
The company continues its policy of limiting technical details on selected flaws until the majority of users have updated, aiming to slow further exploitation. Researcher Salvatore Gulizia, known as Serotav, reported the vulnerability on 4 August 2026 and received a $1,000 reward. The published CVSS score is 8.8, reflecting the requirement for user interaction consistent with web-based attacks.
For users, the practical mitigation is straightforward: update Chrome and restart the browser so the patched version is running. In enterprise environments it is advisable to accelerate patch management, verify deployed versions, and prioritize high-exposure systems. Administrators should also monitor Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi, which will need to incorporate the fix in their own release cycles.
Related articles
Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing team requested reactivation of a three-year-old promotional landing page, only to discover that its domain now served an unrelated third-party website. The root cause was a forgotten CNAME record in the company's DNS zone that continued pointing to a project name on external hosting after the original service had been decommissioned. Because many hosting providers use wildcard DNS entries, standard availability checks and simple DNS resolution tests fail to detect that the target project no longer exists. Attackers who re-register the freed project name can then serve content under the company's legitimate subdomain, automatically obtaining valid TLS certificates and inheriting domain-wide cookies. The article details how such dangling records accumulate across infrastructure, marketing, and acquired company zones, and explains the concrete risks including cookie theft, bypass of Content-Security-Policy, and unauthorized domain ownership proofs. It concludes with a practical remediation workflow: export the full zone, assign owners to every record, validate external targets by application response rather than DNS resolution, and embed record removal into decommissioning procedures.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.
CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog, Including SonicWall and LiteLLM Flaws Targeting AI Infrastructure
CISA has added seven vulnerabilities confirmed to be exploited in the wild to its Known Exploited Vulnerabilities catalog, with two carrying CVSS scores of 10.0. The list includes critical issues in SonicWall SMA 1000 devices, JFrog Artifactory, Kestra workflow engine, and LiteLLM AI gateway components. Attackers are now systematically targeting AI infrastructure to steal large language model API keys and configuration data from databases such as LiteLLM_ProxyModelTable. Qilin ransomware operators have already chained LiteLLM flaws for remote code execution and data theft. CISA has set a 48-hour remediation deadline for federal agencies, underscoring the urgency for all organizations running these components.
Critical Vulnerabilities Patched in VMware Workstation and Fusion Allowing Host Code Execution
Broadcom has disclosed two vulnerabilities in VMware Workstation and VMware Fusion rated as critical and important respectively. CVE-2026-59346 is an integer overflow flaw in the VMXNET3 virtual network adapter that can be exploited by a local administrator inside a virtual machine to execute arbitrary code on the host system, carrying a CVSS v3.1 base score of 9.3. CVE-2026-59347 is a stack-based buffer overflow in the HGFS file system that permits code execution on the host as the VMX process with a CVSS score of 8.1. Both issues were privately reported and affect users who run virtual machines with local administrative privileges. The flaws have been addressed in VMware Workstation 26H1u1 and VMware Fusion 26H1u1, and Broadcom urges immediate updates via advisory VMSA-2026-0007.