Google security advisory (AV26-883) – Update 1
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Serial Number: AV26-883 Date: September 4, 2026 As of September 3, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 152.0.7977.82 Google is aware that an exploit for CVE-2026-85046 exists in the wild. Update 1 On September 4, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Stable Channel Update for Desktop CISA KEV: CVE-2026-85046
CSIRTS triage
- What
- Type confusion vulnerability in V8 JavaScript engine allows remote code execution inside the sandbox via crafted HTML.
- Who is affected
- Users of Google Chrome versions before 152.0.7977.82 on desktop and mobile platforms.
- Urgency
- Critical; active exploitation in the wild with public proof-of-concept code available.
- Action
- Update Google Chrome to version 152.0.7977.82 or later immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Chrome
Get an email when a new Chrome advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-883
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-85046Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 71% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-85046 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highexploited[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere Schwachstellencert-bund
- unknownexploitedCVE-2026-85046: Chromium: CVE-2026-85046 Type confusion in V8msrc
- unknownexploitedDSA-6484-1 chromium - security updatedebian
- unknownexploitedNCSC-2026-0341 [1.00] [M/H] Kwetsbaarheden verholpen in Google Chromencsc-nl
- highexploitedCISA Adds One Known Exploited Vulnerability to Catalogcisa
- unknownexploitedGoogle Chrome Multiple Vulnerabilitieshkcert
- unknownexploitedMultiples vulnérabilités dans Google Chrome (04 septembre 2026)cert-fr-avis
- criticalexploitedCVE-2026-85046: Google Chromium V8 Type Confusion Vulnerabilitycisa-kev
- highexploitedCVE-2026-85046: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to exec…nvd
More from Canadian Centre for Cyber Security
- unknownFortra security advisory (AV26-906)2026-09-10
- unknownPalo Alto Networks security advisory (AV26-905)2026-09-10
- unknownAL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-…2026-09-09
- unknownCitrix security advisory (AV26-833) - Update 12026-09-09
- criticalCisco security advisory (AV26-197) – Update 32026-09-09