Google Patches Critical Zero-Day Flaw in Chrome's V8 Engine

A critical zero-day vulnerability has been patched in Chrome by Google's emergency update on September 4, 2026. The bug, tracked as CVE-2026-85046, lives inside V8, the JavaScript and WebAssembly engine that renders nearly every website you open in Chrome. It was reported to Google by researcher Salvatore Gulizia, who goes by 'Serotav' online.

The vulnerability allows an attacker to corrupt memory in ways the engine never intended, and in V8's case, that corruption can be steered into arbitrary code execution. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until September 18, 2026, to patch.

This is not an isolated incident. It's the sixth Chrome vulnerability in 2026 that Google has confirmed was exploited before a patch existed, a run that stretches back to mid-February. The concentration of V8-related bugs makes sense given its job: it processes untrusted, attacker-supplied code by design every time a page loads.