Google Patches Sixth In-Wild V8 Zero-Day CVE-2026-85046 in Chrome 152

The update fixes twelve vulnerabilities, one of which permitted remote code execution inside the renderer sandbox via a crafted HTML page. Researcher Salvatore Gulizia reported the bug on 4 August after identifying a compiler error that swapped PACKED_ELEMENTS and PACKED_SMI_ELEMENTS maps, enabling arbitrary read-write on the JavaScript heap. Google confirmed active exploitation but withheld attack details to protect unpatched users. Contract awards and prior CVE records show V8 type-confusion issues recurring since 2023, with six in-wild cases patched this year alone. Procurement filings for Chrome enterprise deployments indicate defenders receive exploit indicators only after widespread rollout, creating a detection gap for SOC teams monitoring renderer crashes. Independent analysis of the six CVEs reveals consistent compiler-layer root causes rather than isolated coding errors, pointing to deeper architectural risk in V8's optimizing tiers. Chromium's bug-bounty payouts remain low relative to commercial exploit values, incentivizing delayed or selective reporting. Chrome 153 and Edge stable channels are expected within four weeks; administrators should verify update telemetry against enterprise policy baselines before month-end.