Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has distributed an urgent update for Chrome to fix CVE-2026-85046, a zero-day vulnerability in the V8 engine that is under active exploitation. Users must update to Chrome 152.0.7977.82 or later and restart the browser to apply the patch.
The vulnerability is a type confusion flaw in V8, the JavaScript and WebAssembly engine. It resides in the Maglev compiler and affects optimizations related to Array.prototype.sort. Certain inlining and specialization decisions can leave the engine in an inconsistent state, enabling attackers to build reliable exploitation chains that achieve arbitrary memory access within the JavaScript heap.
An attacker can trigger the flaw by serving a malicious HTML page, a technique commonly seen in malvertising, compromised sites, or phishing campaigns. The published CVSS score is 8.8, reflecting the requirement for user interaction.
Google fixed the issue in the stable desktop channel with versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. The update also resolves 11 additional vulnerabilities, bringing the total to 12 fixes.
The researcher Salvatore Gulizia, operating under the handle Serotav, reported the bug on 4 August 2026 and received a $1,000 reward. Google continues its policy of limiting technical details until the majority of users have updated.
Administrators should accelerate patch deployment, verify installed versions, and prioritize high-exposure systems. Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, must apply updates from their respective vendors once available.
Related articles
Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations
A single user created four separate accounts using valid Gmail address formats that all deliver to the same inbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com. Simple string comparison in the registration code treated these as distinct entries, allowing circumvention of new-user promotions, free-tier limits, and one-application-per-person rules. The root cause lies in three Gmail-specific behaviors: case-insensitive local parts, plus-addressing that ignores everything after the + symbol, and dots that carry no semantic meaning in the local part. Additional risks arise from IDNA homograph domains that visually mimic legitimate addresses but encode to different Punycode strings. Proper mitigation requires storing both the original email for delivery and a domain-aware normalized form for uniqueness checks, combined with explicit IDNA validation on registration.
Dangling DNS Records Expose Companies to Subdomain Takeovers Years After Projects Shut Down
A marketing team requested reactivation of a three-year-old promotional landing page, only to discover that its domain now served an unrelated third-party website. The root cause was a forgotten CNAME record in the company's DNS zone that continued pointing to a project name on external hosting after the original service had been decommissioned. Because many hosting providers use wildcard DNS entries, standard availability checks and simple DNS resolution tests fail to detect that the target project no longer exists. Attackers who re-register the freed project name can then serve content under the company's legitimate subdomain, automatically obtaining valid TLS certificates and inheriting domain-wide cookies. The article details how such dangling records accumulate across infrastructure, marketing, and acquired company zones, and explains the concrete risks including cookie theft, bypass of Content-Security-Policy, and unauthorized domain ownership proofs. It concludes with a practical remediation workflow: export the full zone, assign owners to every record, validate external targets by application response rather than DNS resolution, and embed record removal into decommissioning procedures.
Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)
Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw is a type confusion issue tied to the Maglev compiler and optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Successful exploitation allows a remote attacker to execute arbitrary code within the browser sandbox after a victim visits a specially crafted HTML page, a technique commonly seen in malvertising and compromised-site campaigns. The fix is included in Chrome 152.0.7977.82 and later for Windows, macOS, and Linux, and the update also resolves a total of twelve vulnerabilities. The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will require corresponding updates from their respective vendors.
CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog, Including SonicWall and LiteLLM Flaws Targeting AI Infrastructure
CISA has added seven vulnerabilities confirmed to be exploited in the wild to its Known Exploited Vulnerabilities catalog, with two carrying CVSS scores of 10.0. The list includes critical issues in SonicWall SMA 1000 devices, JFrog Artifactory, Kestra workflow engine, and LiteLLM AI gateway components. Attackers are now systematically targeting AI infrastructure to steal large language model API keys and configuration data from databases such as LiteLLM_ProxyModelTable. Qilin ransomware operators have already chained LiteLLM flaws for remote code execution and data theft. CISA has set a 48-hour remediation deadline for federal agencies, underscoring the urgency for all organizations running these components.