---
title: "Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491"
url: https://erroneo.us/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/
description: "Two exploited V8 bugs fixed in Chrome 152.0.7977.82 (Sep 3) and 153.0.8010.36 (Sep 8), and in Edge. Auto-updated browsers are safe; check pinned fleets."
type: security-brief
section: "Security Digest"
date_published: 2026-09-03
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-85046", "CVE-2026-87491"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome V8 Zero-Days CVE-2026-85046 and CVE-2026-87491

**Verdict: Check exposure.** Both were exploited zero-days, but Chrome and Edge fixed them in early September and auto-update has had six weeks to deliver the fix; the job now is finding browsers that did not update, not a scramble.

- **Who must act:** Admins of fleets where Chrome or Edge updates are pinned, deferred or broken, owners of kiosk and VDI images, and users of Chromium-based browsers whose vendor has not shipped a September 2026 or later V8 fix.
- **Who can relax:** Chrome users on 153.0.8010.36 or later and Edge users on 153.0.4234.32 or later, which includes anyone whose browser auto-updated and relaunched since mid-September.
- **Affected:** Google Chrome before 152.0.7977.82 (CVE-2026-85046); Google Chrome before 153.0.8010.36 (CVE-2026-87491); Chrome for Android before 152.0.7977.82 / 153.0.8010.36; Microsoft Edge before 152.0.4191.62 (CVE-2026-85046) and before 153.0.4234.32 per Microsoft's Security Update Guide (CVE-2026-87491); Other Chromium-based browsers until their vendors ship both V8 fixes
- **Fixed:** Chrome 152.0.7977.82/.83 Windows and Mac, 152.0.7977.82 Linux (CVE-2026-85046, Sep 3, 2026); Chrome 153.0.8010.36/.37 Windows and Mac, 153.0.8010.36 Linux (CVE-2026-87491, Sep 8, 2026); Chrome for Android 152.0.7977.82 (Sep 3) and 153.0.8010.36 (Sep 8); ChromeOS Stable 152.0.7977.113 (OS 16765.41.0) for CVE-2026-85046; Microsoft Edge 152.0.4191.62 (CVE-2026-85046) and 153.0.4234.32 (CVE-2026-87491)
- **CVEs:** CVE-2026-85046, CVE-2026-87491
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm Chrome is at 153.0.8010.36 or later.
2. In managed fleets, report browser versions and flag any endpoint below Chrome 153.0.8010.36 or Edge 153.0.4234.32.
3. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and use RelaunchNotification policies so updates actually apply.
4. Check Opera, Brave, Vivaldi and any other Chromium-based browser in use for a release that includes the September 2026 V8 fixes.
5. If you use Chrome Extended Stable, confirm your build carries both fixes, because its release notes do not list CVEs, or move those users to Stable.

### How to check if you are affected

- Query endpoint inventory for chrome.exe or msedge.exe versions below the fixed builds at any point since early September 2026, and list the users of those machines.
- Google has published no indicators; for high-risk users who ran old builds, review EDR for browser processes spawning unexpected executables and for new services, scheduled tasks or launch agents around that time.

## What happened

On September 3, 2026, Google shipped [Chrome 152.0.7977.82/.83](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html) for Windows and Mac and 152.0.7977.82 for Linux, with 12 security fixes. One was [CVE-2026-85046](https://www.cve.org/CVERecord?id=CVE-2026-85046), a high-severity type confusion in V8, Chrome's JavaScript and WebAssembly engine. Google said it "is aware that an exploit for CVE-2026-85046 exists in the wild." Salvatore Gulizia (Serotav) reported the bug on August 4; Google's notes do not credit its Threat Analysis Group. His [write-up](https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/) places it in how the Maglev compiler inlines `Array.prototype.sort`. A comparator that calls `fill()` can change the array's element kind mid-sort and still pass a guard check. He says he chained it with an n-day sandbox escape and submitted it to v8CTF, Google's V8 exploit program.

On September 8, Google promoted [Chrome 153](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html) to Stable as 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, with 230 security fixes. Among them was [CVE-2026-87491](https://www.cve.org/CVERecord?id=CVE-2026-87491), a Medium-rated out-of-bounds write in V8. Jihyeon Jeong of Seoul National University's Compsec Lab reported it on August 6. Again, Google said an exploit "exists in the wild."

For both bugs, the records say a crafted HTML page lets a remote attacker "execute arbitrary code inside the sandbox." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-85046) shows CISA-ADP scores of CVSS 3.1 8.8 for [both](https://nvd.nist.gov/vuln/detail/CVE-2026-87491). CISA added [CVE-2026-85046](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046) to KEV on September 4 (due September 18) and [CVE-2026-87491](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491) on September 9 (due September 23). Google has not said who used either exploit, against whom, or what it was chained with. [Help Net Security](https://www.helpnetsecurity.com/2026/09/09/google-chrome-cve-2026-87491-zero-day-flaw/) counted CVE-2026-87491 as the seventh exploited Chrome zero-day of 2026.

## Who is affected

Chrome on Windows, Mac, Linux and Android below the fixed builds is affected. Chrome for Android got [152.0.7977.82](https://chromereleases.googleblog.com/2026/09/chrome-for-android-update.html) on September 3 and [153.0.8010.36](https://chromereleases.googleblog.com/2026/09/chrome-for-android-update_01729269728.html) on September 8, with the same security fixes as desktop. [ChromeOS Stable 152.0.7977.113](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-chromeos_0586661566.html) (September 8) lists CVE-2026-85046.

CISA notes that the bugs could affect other Chromium-based browsers, including Edge and Opera. Microsoft's [Edge security release notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security) say Edge Stable 152.0.4191.62 (September 2) fixes CVE-2026-85046 and 152.0.4191.66 (September 4) fixes CVE-2026-87491. Microsoft's Security Update Guide, however, lists 153.0.4234.32, released September 10, as the fixed Edge build for CVE-2026-87491. Treat 153.0.4234.32 as the safe minimum.

## Do you really need to act?

For most people, not anymore. These were real zero-days. In the days after each fix, anyone browsing on an old build could have been targeted just by loading a page. But Chrome and Edge update themselves, and a browser that has auto-updated and relaunched since mid-September has both fixes.

Exposure is now concentrated in a few places: fleets where an update policy pins or defers versions, machines where the update is downloaded but the browser never restarts, kiosk and VDI golden images, and Chromium forks that ship V8 fixes late. Code execution "inside the sandbox" usually needs a second bug to take over the device. That is a hurdle for attackers, not a guarantee, and exploited browser bugs are routinely paired with sandbox escapes.

## What to do now

1. Check a single machine: open `chrome://settings/help` or `edge://settings/help` and relaunch. From a shell, use `google-chrome --version` on Linux, `"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version` on macOS, or `(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion` in PowerShell.
2. In managed fleets, pull browser versions from your MDM or EDR inventory and chase anything below Chrome 153.0.8010.36 or Edge 153.0.4234.32.
3. Remove version pins and long update deferrals, and set relaunch policies so downloaded updates actually apply.
4. Update other Chromium-based browsers and rebuild kiosk or VDI images that bundle an old browser.
5. If you use Extended Stable, confirm with Google that your build contains both fixes, since those release notes do not list CVEs, or move users to Stable.

## How to tell if you were hit

Google has published no indicators, targets or delivery details, so after-the-fact detection is hard. First, find the machines that ran a vulnerable build in late August or early September, and note their users. For high-risk users on those machines, such as executives, admins and people in sensitive roles, review EDR telemetry from that window. Look for browser processes launching unexpected executables, new services, scheduled tasks or launch agents, and unusual outbound connections. If you find anything, reimage the device and rotate credentials and session tokens used in that browser.

## Timeline

- Aug 4, 2026 — Salvatore Gulizia reports CVE-2026-85046.
- Aug 6, 2026 — Jihyeon Jeong reports CVE-2026-87491.
- Sep 2, 2026 — Edge 152.0.4191.62 ships with the CVE-2026-85046 fix.
- Sep 3, 2026 — Chrome 152.0.7977.82 is released for desktop and Android. Google confirms an in-the-wild exploit for CVE-2026-85046.
- Sep 4, 2026 — CISA adds CVE-2026-85046 to KEV, and Edge 152.0.4191.66 is released.
- Sep 8, 2026 — Chrome 153.0.8010.36 fixes CVE-2026-87491, with an in-the-wild exploit confirmed. ChromeOS 152.0.7977.113 is released.
- Sep 9, 2026 — CISA adds CVE-2026-87491 to KEV.
- Sep 10, 2026 — Edge 153.0.4234.32 is released.
- Sep 18, 2026 — CISA deadline for CVE-2026-85046.
- Sep 23, 2026 — CISA deadline for CVE-2026-87491.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Sep 3, 2026)](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html)
2. [Google Chrome Releases — Stable Channel Update for Desktop (Sep 8, 2026)](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html)
3. [CVE record — CVE-2026-85046](https://www.cve.org/CVERecord?id=CVE-2026-85046)
4. [CVE record — CVE-2026-87491](https://www.cve.org/CVERecord?id=CVE-2026-87491)
5. [NVD — CVE-2026-85046](https://nvd.nist.gov/vuln/detail/CVE-2026-85046)
6. [NVD — CVE-2026-87491](https://nvd.nist.gov/vuln/detail/CVE-2026-87491)
7. [CISA — Known Exploited Vulnerabilities: CVE-2026-85046](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-87491](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491)
9. [Google Chrome Releases — Chrome for Android Update (Sep 3, 2026)](https://chromereleases.googleblog.com/2026/09/chrome-for-android-update.html)
10. [Google Chrome Releases — Chrome for Android Update (Sep 8, 2026)](https://chromereleases.googleblog.com/2026/09/chrome-for-android-update_01729269728.html)
11. [Google Chrome Releases — Stable Channel Update for ChromeOS (Sep 8, 2026)](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-chromeos_0586661566.html)
12. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
13. [Serotav — When Sorting Leads To Confusion (CVE-2026-85046 write-up)](https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/)
14. [Help Net Security — Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491)](https://www.helpnetsecurity.com/2026/09/09/google-chrome-cve-2026-87491-zero-day-flaw/)

---
Source page: https://erroneo.us/security/briefs/chrome-v8-cve-2026-85046-87491-exploited-zero-days/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt