Google confirmed that CVE-2026-85046 is being exploited in the wild and has released a patch for the high-severity flaw in Chrome’s V8 engine, which handles JavaScript and WebAssembly. The company has not yet identified the attackers, their victims, or the specific capabilities of the exploit. The patch is included in Chrome versions 152.0.7977.82 and 152.0.7977.83 for Windows and Mac, and version 152.0.7977.82 for Linux, with rollout expected over the coming days and weeks.
CVE-2026-85046 is a type-confusion bug that occurs when software treats data as the wrong type, potentially causing memory errors. Security researcher Salvatore Gulizia, also known as Serotav, reported the flaw on August 4 and received a $1,000 bug bounty. The update contains 12 security fixes in total, including nine high-severity and two medium-severity bugs, though Google is withholding some details until most users and affected third-party projects have installed the patches.
While Google has not tied the current exploit to cryptocurrency theft, browser-based crypto attacks have occurred through other methods. In November 2025, researchers discovered a malicious Chrome extension that added hidden SOL transfers to users’ swaps. In December 2025, a Singapore entrepreneur reported that malware disguised as a game drained over $14,000 from his browser-connected wallets, allegedly involving stolen authentication tokens and an earlier Chrome zero-day, though no link to CVE-2026-85046 was established. Additionally, in August, researchers uncovered dozens of fake Firefox wallet extensions designed to steal wallet credentials.