--- title: Google patches actively exploited V8 type confusion bug... description: Google released a Chrome update on September 3rd fixing 12 vulnerabilities, headlined by CVE-2026-85046, a type confusion bug in the V8 JavaScript engine that... canonical: https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google patches actively exploited V8 type confusion bug in Chrome | daily.dev og:description: Google released a Chrome update on September 3rd fixing 12 vulnerabilities, headlined by CVE-2026-85046, a type confusion bug in the V8 JavaScript engine that... og:url: https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu og:image: https://api.daily.dev/og/posts/1NU1rTbzU.png og:image:alt: Google patches actively exploited V8 type confusion bug in Chrome og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google patches actively exploited V8 type confusion bug in Chrome **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary Google released a Chrome update on September 3rd fixing 12 vulnerabilities, headlined by CVE-2026-85046, a type confusion bug in the V8 JavaScript engine that is being actively exploited. Rated 8.8 CVSS, it allows sandbox code execution via a crafted web page. The fix ships in Chrome 152.0.7977.82/.83, and all Chromium-based browsers (Edge, Brave, Opera, Vivaldi) need the same patch. This marks the sixth actively exploited Chrome zero-day this year. Researcher Salvatore Gulizia reported it on August 4th for a $1,000 bounty, and security researcher LiveOverflow confirmed the patched bug matched an n-day exploit already circulating. Separately, the EU's Cyber Resilience Act begins enforcing 24-hour exploited-vulnerability reporting requirements on September 11th, which would apply to future incidents like this. ## Content ## What happened A newly documented exploit kit called BlueMoon chains three vulnerabilities to hand attackers full Windows admin access from a single phishing link click. Two are in Chromium's V8 JavaScript engine — CVE-2026-85046 (a type confusion bug) and CVE-2026-87491 (a V8 sandbox escape) — and one is a Windows kernel privilege escalation flaw, CVE-2026-85880. Google patched the Chrome side on September 3; Microsoft followed with the Windows fix on September 9. Proofpoint, working alongside Google, Microsoft, and Volexity, found the kit being used by at least four separate threat clusters, most of them China-nexus, targeting NGOs, mining firms, and commodity traders in the US and Southeast Asia. ## The patch-gap problem The V8 flaws were what researchers are calling "patch-gap" zero-days. The fixes existed in the open-source Chromium codebase before they reached stable Chrome releases — and attackers exploited that window. Using AI-accelerated reverse engineering of upstream patches, they identified and weaponized the vulnerabilities before most users received the fix. This is the sixth actively exploited Chrome zero-day this year. Security researcher Salvatore Gulizia (handle: Serotav) reported CVE-2026-85046 on August 4 and received a $1,000 bounty from a program that pays up to $250,000. LiveOverflow noted publicly that the fix for a bug they'd used in an n-day exploit had finally shipped with this update. The Chrome fix landed in versions 152.0.7977.82/.83. Every Chromium-based browser — Edge, Brave, Opera, Vivaldi — needs the same patch. ## How the attacks work Attack chains start with phishing emails. Once a target clicks the link, BlueMoon exploits the V8 bugs to run code inside the browser sandbox, then uses the Windows kernel flaw to escalate privileges. From there, attackers deploy several payloads: - **GemStone**, a fake Google Gemini browser extension used for surveillance, credential theft, and keylogging - **ShadowPad**, a well-known backdoor associated with Chinese espionage operations The speed at which the kit spread across four distinct threat groups is notable. Proofpoint says this kind of rapid, shared deployment reflects a shrinking barrier to entry for exploit development — partly structural (the patch gap), partly technological (AI tooling). ## What to do Patching Chrome and Windows closes the initial infection vector, but it won't remove malware that's already installed. Anyone in a targeted sector should: - Update Chrome to 152.0.7977.82 or later immediately - Apply the September 9 Windows security update - Apply Proofpoint's published detection rules - Rescan systems for persistence artifacts, especially the GemStone extension and ShadowPad indicators ## Regulatory context The EU's Cyber Resilience Act begins enforcing 24-hour exploited-vulnerability reporting obligations on September 11. Future incidents like this one would trigger mandatory disclosure timelines — something vendors and security teams will need to factor into their response workflows going forward. ## Questions this post answers ### What Chrome version fixes the actively exploited V8 type confusion vulnerability CVE-2026-85046? Chrome versions 152.0.7977.82/.83 patch CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine with a CVSS score of 8.8 that was already being exploited in the wild. It lets an attacker run code inside the browser sandbox via a crafted web page. Every Chromium-based browser, including Edge, Brave, Opera, and Vivaldi, needs the same update, and it marks the sixth actively exploited Chrome zero-day of the year. _daily.dev helps security-minded developers keep up with actively exploited browser vulnerabilities like this one._ ### How much did Google pay for the CVE-2026-85046 Chrome zero-day report? Google paid $1,000 to researcher Salvatore Gulizia (handle Serotav), who reported the V8 type confusion bug on August 4th, out of a bug bounty program that pays up to $250,000 depending on severity. The relatively low payout suggests the bounty tier reflected the exploit's classification rather than the program's maximum reward range. _Track disclosure timelines and bounty outcomes for browser vulnerabilities via daily.dev._ ### When does the EU Cyber Resilience Act's 24-hour vulnerability reporting rule take effect? The EU's Cyber Resilience Act begins enforcing 24-hour exploited-vulnerability reporting obligations on September 11th. Under that framework, incidents like an actively exploited Chrome zero-day would trigger mandatory disclosure timelines going forward, adding regulatory pressure on top of existing patch cycles. _Developers navigating new EU security compliance rules can follow the details on daily.dev._ ## Similar posts on daily.dev - [Google patches new Chrome zero-day flaw exploited in the wild](https://daily.dev/posts/google-patches-new-chrome-zero-day-flaw-exploited-in-the-wild-tpectayr9) · BleepingComputer · 1 upvotes · 0 comments - [Claude Opus wrote a Chrome exploit for $2,283](https://daily.dev/posts/claude-opus-wrote-a-chrome-exploit-for-2-283-vrq54wsru) · The Register · 1 upvotes · 0 comments - [Microsoft feud escalates as researcher drops new Windows zero-day](https://daily.dev/posts/microsoft-feud-escalates-as-researcher-drops-new-windows-zero-day-3qmkx9mgs) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#google-chrome](https://daily.dev/tags/google-chrome), [#zero-day](https://daily.dev/tags/zero-day), [#v8](https://daily.dev/tags/v8) [View this post on daily.dev](https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google patches actively exploited V8 type confusion bug in Chrome","url":"https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu"},"datePublished":"2026-09-07T19:43:51.788Z","dateModified":"2026-09-11T01:13:55.477Z","description":"Google released a Chrome update on September 3rd fixing 12 vulnerabilities, headlined by CVE-2026-85046, a type confusion bug in the V8 JavaScript engine that...","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,google-chrome,zero-day,v8","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Google patches actively exploited V8 type confusion bug in Chrome"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-patches-actively-exploited-v8-type-confusion-bug-in-chrome-1nu1rtbzu#faq","mainEntity":[{"@type":"Question","name":"What Chrome version fixes the actively exploited V8 type confusion vulnerability CVE-2026-85046?","acceptedAnswer":{"@type":"Answer","text":"Chrome versions 152.0.7977.82/.83 patch CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine with a CVSS score of 8.8 that was already being exploited in the wild. It lets an attacker run code inside the browser sandbox via a crafted web page. Every Chromium-based browser, including Edge, Brave, Opera, and Vivaldi, needs the same update, and it marks the sixth actively exploited Chrome zero-day of the year. daily.dev helps security-minded developers keep up with actively exploited browser vulnerabilities like this one."}},{"@type":"Question","name":"How much did Google pay for the CVE-2026-85046 Chrome zero-day report?","acceptedAnswer":{"@type":"Answer","text":"Google paid $1,000 to researcher Salvatore Gulizia (handle Serotav), who reported the V8 type confusion bug on August 4th, out of a bug bounty program that pays up to $250,000 depending on severity. The relatively low payout suggests the bounty tier reflected the exploit's classification rather than the program's maximum reward range. Track disclosure timelines and bounty outcomes for browser vulnerabilities via daily.dev."}},{"@type":"Question","name":"When does the EU Cyber Resilience Act's 24-hour vulnerability reporting rule take effect?","acceptedAnswer":{"@type":"Answer","text":"The EU's Cyber Resilience Act begins enforcing 24-hour exploited-vulnerability reporting obligations on September 11th. Under that framework, incidents like an actively exploited Chrome zero-day would trigger mandatory disclosure timelines going forward, adding regulatory pressure on top of existing patch cycles. Developers navigating new EU security compliance rules can follow the details on daily.dev."}}]} ```