Google patched CVE-2026-85046 in Chrome after confirming active exploitation of a V8 type-confusion bug that affects Windows, macOS, and Linux builds before 152.0.7977.82/.83. The flaw can be triggered by a crafted HTML page and lets a remote attacker execute code inside the browser sandbox.
The bug lives in V8, Chrome's JavaScript and WebAssembly engine, where the engine can be tricked into treating one object as another. That confusion can be turned into arbitrary read and write on the JavaScript heap, which is enough to reach code execution inside the browser's isolation boundary.
The practical exposure does not stop at Chrome. Any Chromium-based browser that shares the same V8 fix, including Edge, Brave, Opera, and Vivaldi, stays open until its own vendor ships the updated build, so the vulnerable window can outlast Google's release in mixed-browser fleets.