Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491

What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm Chrome is at 153.0.8010.36 or later.
2. In managed fleets, report browser versions and flag any endpoint below Chrome 153.0.8010.36 or Edge 153.0.4234.32.
3. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and use RelaunchNotification policies so updates actually apply.
4. Check Opera, Brave, Vivaldi and any other Chromium-based browser in use for a release that includes the September 2026 V8 fixes.
5. If you use Chrome Extended Stable, confirm your build carries both fixes, because its release notes do not list CVEs, or move those users to Stable.

How to check if you are affected or compromised

• Query endpoint inventory for chrome.exe or msedge.exe versions below the fixed builds at any point since early September 2026, and list the users of those machines.
• Google has published no indicators; for high-risk users who ran old builds, review EDR for browser processes spawning unexpected executables and for new services, scheduled tasks or launch agents around that time.

What happened#

On September 3, 2026, Google shipped Chrome 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, with 12 security fixes. One was CVE-2026-85046, a high-severity type confusion in V8, Chrome's JavaScript and WebAssembly engine. Google said it "is aware that an exploit for CVE-2026-85046 exists in the wild." Salvatore Gulizia (Serotav) reported the bug on August 4; Google's notes do not credit its Threat Analysis Group. His write-up places it in how the Maglev compiler inlines Array.prototype.sort. A comparator that calls fill() can change the array's element kind mid-sort and still pass a guard check. He says he chained it with an n-day sandbox escape and submitted it to v8CTF, Google's V8 exploit program.

On September 8, Google promoted Chrome 153 to Stable as 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, with 230 security fixes. Among them was CVE-2026-87491, a Medium-rated out-of-bounds write in V8. Jihyeon Jeong of Seoul National University's Compsec Lab reported it on August 6. Again, Google said an exploit "exists in the wild."

For both bugs, the records say a crafted HTML page lets a remote attacker "execute arbitrary code inside the sandbox." NVD shows CISA-ADP scores of CVSS 3.1 8.8 for both. CISA added CVE-2026-85046 to KEV on September 4 (due September 18) and CVE-2026-87491 on September 9 (due September 23). Google has not said who used either exploit, against whom, or what it was chained with. Help Net Security counted CVE-2026-87491 as the seventh exploited Chrome zero-day of 2026.

Who is affected#

Chrome on Windows, Mac, Linux and Android below the fixed builds is affected. Chrome for Android got 152.0.7977.82 on September 3 and 153.0.8010.36 on September 8, with the same security fixes as desktop. ChromeOS Stable 152.0.7977.113 (September 8) lists CVE-2026-85046.

CISA notes that the bugs could affect other Chromium-based browsers, including Edge and Opera. Microsoft's Edge security release notes say Edge Stable 152.0.4191.62 (September 2) fixes CVE-2026-85046 and 152.0.4191.66 (September 4) fixes CVE-2026-87491. Microsoft's Security Update Guide, however, lists 153.0.4234.32, released September 10, as the fixed Edge build for CVE-2026-87491. Treat 153.0.4234.32 as the safe minimum.

Do you really need to act?#

For most people, not anymore. These were real zero-days. In the days after each fix, anyone browsing on an old build could have been targeted just by loading a page. But Chrome and Edge update themselves, and a browser that has auto-updated and relaunched since mid-September has both fixes.

Exposure is now concentrated in a few places: fleets where an update policy pins or defers versions, machines where the update is downloaded but the browser never restarts, kiosk and VDI golden images, and Chromium forks that ship V8 fixes late. Code execution "inside the sandbox" usually needs a second bug to take over the device. That is a hurdle for attackers, not a guarantee, and exploited browser bugs are routinely paired with sandbox escapes.

What to do now#

1. Check a single machine: open chrome://settings/help or edge://settings/help and relaunch. From a shell, use google-chrome --version on Linux, "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version on macOS, or (Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion in PowerShell.
2. In managed fleets, pull browser versions from your MDM or EDR inventory and chase anything below Chrome 153.0.8010.36 or Edge 153.0.4234.32.
3. Remove version pins and long update deferrals, and set relaunch policies so downloaded updates actually apply.
4. Update other Chromium-based browsers and rebuild kiosk or VDI images that bundle an old browser.
5. If you use Extended Stable, confirm with Google that your build contains both fixes, since those release notes do not list CVEs, or move users to Stable.

How to tell if you were hit#

Google has published no indicators, targets or delivery details, so after-the-fact detection is hard. First, find the machines that ran a vulnerable build in late August or early September, and note their users. For high-risk users on those machines, such as executives, admins and people in sensitive roles, review EDR telemetry from that window. Look for browser processes launching unexpected executables, new services, scheduled tasks or launch agents, and unusual outbound connections. If you find anything, reimage the device and rotate credentials and session tokens used in that browser.

Timeline#

• Aug 4, 2026 — Salvatore Gulizia reports CVE-2026-85046.
• Aug 6, 2026 — Jihyeon Jeong reports CVE-2026-87491.
• Sep 2, 2026 — Edge 152.0.4191.62 ships with the CVE-2026-85046 fix.
• Sep 3, 2026 — Chrome 152.0.7977.82 is released for desktop and Android. Google confirms an in-the-wild exploit for CVE-2026-85046.
• Sep 4, 2026 — CISA adds CVE-2026-85046 to KEV, and Edge 152.0.4191.66 is released.
• Sep 8, 2026 — Chrome 153.0.8010.36 fixes CVE-2026-87491, with an in-the-wild exploit confirmed. ChromeOS 152.0.7977.113 is released.
• Sep 9, 2026 — CISA adds CVE-2026-87491 to KEV.
• Sep 10, 2026 — Edge 153.0.4234.32 is released.
• Sep 18, 2026 — CISA deadline for CVE-2026-85046.
• Sep 23, 2026 — CISA deadline for CVE-2026-87491.

Vulnerability records

• CVE-2026-85046 · KEV 2026-09-04 · Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
• CVE-2026-87491 · KEV 2026-09-09 · Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Sep 3, 2026) chromereleases.googleblog.com
2. Google Chrome Releases — Stable Channel Update for Desktop (Sep 8, 2026) chromereleases.googleblog.com
3. CVE record — CVE-2026-85046 cve.org
4. CVE record — CVE-2026-87491 cve.org
5. NVD — CVE-2026-85046 nvd.nist.gov
6. NVD — CVE-2026-87491 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2026-85046 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-87491 cisa.gov
9. Google Chrome Releases — Chrome for Android Update (Sep 3, 2026) chromereleases.googleblog.com
10. Google Chrome Releases — Chrome for Android Update (Sep 8, 2026) chromereleases.googleblog.com
11. Google Chrome Releases — Stable Channel Update for ChromeOS (Sep 8, 2026) chromereleases.googleblog.com
12. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
13. Serotav — When Sorting Leads To Confusion (CVE-2026-85046 write-up) serotav.github.io

Coverage and analysis

1. Help Net Security — Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491) helpnetsecurity.com