Google on Thursday rolled out fresh Chrome 152 security updates that resolve 12 vulnerabilities, including an exploited zero-day.
Tracked as CVE-2026-85046, the high-severity bug is described as a type confusion issue in Chrome’s V8 JavaScript and WebAssembly engine. It was reported by Salvatore Gulizia, who received a $1,000 bug bounty reward.
“Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the internet giant’s advisory reads.
While the company has not shared details on the security defect, type confusion flaws in the V8 engine may be exploited to perform remote read/write operations via crafted HTML pages.
Type confusion vulnerabilities are memory corruption bugs that could lead to crashes, remote code execution, and other malicious behavior.
