Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has distributed an urgent update for Chrome to correct CVE-2026-85046, a zero-day vulnerability in V8 that is being actively exploited. The solution requires updating to Chrome 152.0.7977.82 or higher and restarting the browser to apply the patch.
Google released the emergency update after detecting active exploitation of CVE-2026-85046, a high-severity zero-day in V8, the JavaScript and WebAssembly engine used by Chrome. The vulnerability enables a remote attacker to execute arbitrary code inside the browser sandbox when the victim visits a manipulated HTML page, a scenario typical in campaigns that combine malicious links, malvertising, or compromised websites.
The defect is classified as a type confusion in V8, a class of vulnerability that often provides dangerous primitives such as arbitrary read and write access within the JavaScript heap. Technical analysis points to the Maglev compiler and optimizations related to Array.prototype.sort, where certain inlining and specialization decisions can leave the engine in an inconsistent state that becomes exploitable.
Google has corrected the issue in the stable desktop channel with versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. The update also addresses a total of twelve vulnerabilities, reinforcing the recommendation to apply the patch as soon as possible.
The company continues its policy of limiting technical details on selected flaws until the majority of users have updated, aiming to slow further exploitation. Researcher Salvatore Gulizia, known as Serotav, reported the vulnerability on 4 August 2026 and received a $1,000 reward. The published CVSS score is 8.8, reflecting the requirement for user interaction consistent with web-based attacks.
For users, the practical mitigation is straightforward: update Chrome and restart the browser so the patched version is running. In enterprise environments it is advisable to accelerate patch management, verify deployed versions, and prioritize high-exposure systems. Administrators should also monitor Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi, which will need to incorporate the fix in their own release cycles.
Related articles
Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access
Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.
Check Point Patches Critical Zero-Day CVE-2026-93616 Enabling Unauthenticated Remote Code Execution on Management Servers
Check Point has addressed a critical zero-day vulnerability tracked as CVE-2026-93616 with a CVSS score of 9.8 that allowed remote unauthenticated attackers to upload and execute arbitrary scripts on management servers. The flaw combined directory traversal with insecure file handling, enabling attackers to escape the intended directory and place scripts in executable locations. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Targeted attacks were observed starting July 23 before public disclosure, though exploitation remained limited. Vulnerable versions span multiple R82, R81, and R80 releases, with fixes now available through specific hotfixes and Jumbo Takes. Administrators are advised to apply patches immediately, place management servers behind a Security Gateway, and restrict TCP port 19009 access. Detection guidance includes reviewing cpm.elg logs for unusually long usernames and ReflectionUtils errors containing directory traversal sequences.
GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws
GitLab has issued critical security updates for its development platform to address 11 vulnerabilities across Community Edition and Enterprise Edition. The patches cover versions 19.4.1, 19.3.3, and 19.2.7 and were released on September 23, 2026. Two vulnerabilities rated Critical allow authenticated users to achieve arbitrary code execution on the server. CVE-2026-89078 involves a double-free issue in CI/CD configuration parsing triggered by crafted regular expressions, while CVE-2026-93577 is an integer overflow in the regular expression compiler. Additional High-severity issues include cross-site scripting in merge request diffs and unauthorized access to sensitive CI/CD variables via the Duo AI job troubleshooting feature. The update also resolves five Medium and two Low severity flaws.
Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities
Google has published Chrome 154 for Windows, macOS, and Linux, addressing a total of 108 vulnerabilities. Eleven of these issues are rated Critical, covering buffer overflows in ANGLE, out-of-bounds writes in GPU, and multiple Use-After-Free flaws in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL. Twenty-five High-severity issues were also fixed, including authorization problems in extensions, improper UI rendering in SecurityIndicators, and race conditions plus type confusion in the V8 JavaScript engine. Additional Medium and Low severity fixes bring the total to 108 patched flaws across components such as PDFium and WebAudio. The update is being rolled out over the coming days and weeks. Specific CVEs addressed include CVE-2026-95350, CVE-2026-95357, and CVE-2026-95281.