What a type confusion bug is — why Chrome shipped six emergency patches this year
A type confusion bug is a memory-safety flaw that appears when a program stores a value as one kind of thing and later reads the same memory as a different kind of thing. Once the kinds disagree, an attacker can make the program treat an ordinary number as a memory address, and from there write to places the program never meant to expose. This class matters right now because of CVE-2026-85046. It is a type confusion flaw in V8, the JavaScript and WebAssembly engine inside Chrome; it was patched in the stable channel update of September 3, 2026; and it is the sixth Chrome zero-day of 2026 confirmed to have been exploited in the wild. It carries a CVSS score of 8.8. Researcher Salvatore Gulizia reported it on August 4, 2026 and received a $1,000 bounty. An attacker needs only a crafted HTML page to run arbitrary code inside the sandbox. The US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on September 4 and required federal civilian agencies to patch by September 18. The fixed builds are Chrome 152.0.7977.82 and .83
The three lines
- Definition — storing a value as one type and reading it as another; a number can be made to act as a memory address
- Case — CVE-2026-85046 in Chrome's V8, CVSS 8.8, the sixth actively exploited Chrome zero-day of 2026
- Fix — patched September 3 in Chrome 152.0.7977.82/.83; CISA set a September 18 federal deadline
Key questions
- What does type confusion actually mean
- **It is what happens when the same memory gets interpreted two different ways.** The analogy holds up well. You decide that **locker 3 holds a count of apples** and write the number **5** in it. Later a different piece of code opens locker 3 believing **it holds a warehouse address**. **Now 5 is not a quantity — it is address 5.** | Written as | Read as | Result | |---|---|---| | the number **5** (a value) | the address **0x5** (a pointer) | the attacker chooses the address | | a small object | a larger object | reads and writes past the end | **What makes this valuable to an attacker is that it does not stop at reading.** Once a number can be made to act as an address, the next step is a state where **the attacker writes a chosen value to a chosen location.** From there the program's execution flow is effectively available. That is why CVE-2026-85046 is described as **arbitrary code execution via a crafted HTML page** — **opening a web page is enough to run code.**
- Why do these keep appearing in browser JavaScript engines
- **Because going fast means guessing the type in advance.** JavaScript does not declare types. Writing `x = 5` leaves it to runtime to settle whether that is an integer or a float. Checking that honestly, every time, is slow. So modern engines like Chrome's **V8** use **JIT (just-in-time) compilation**. When the same code repeats, the engine concludes **"an integer always arrives here"** and emits fast machine code with the check removed. | Stage | What it does | Risk | |---|---|---| | Interpretation | checks the type every time | slow but safe | | **JIT optimization** | **assumes the type, drops the check** | **a broken assumption is type confusion** | | Deoptimization | unwinds when the assumption fails | **a hole in the unwinding is an exploit** | **This vulnerability class is the shadow of performance work.** The speed bought by skipping a check creates the place an attacker aims at. **It is why Chrome zero-days recur specifically in V8**, and why six is this year's count (「What a zero-day is」).
- How do I check my own browser
- **Look at the version number.** The fixed builds are **Chrome 152.0.7977.82** (Windows, macOS, Linux) and **152.0.7977.83** (Windows, macOS). Anything lower has not been fixed. | Item | Value | |---|---| | Identifier | **CVE-2026-85046** | | Location | **V8** (JavaScript and WebAssembly engine) | | Class | **type confusion** | | CVSS | **8.8** | | Reported | **August 4, 2026**, Salvatore Gulizia (**$1,000** bounty) | | Patched | **September 3, 2026**, stable channel | | CISA KEV listing | **September 4, 2026** | | US federal patch deadline | **September 18, 2026** | **Chrome updates itself, but the update only takes effect after a restart.** Whoever has not closed the browser in weeks is the most exposed. And **this is not only Chrome's problem — V8 is shared across every Chromium-based browser**: Edge, Brave, Opera and Whale all use the same engine, and **each must ship its own update.** **The $1,000 bounty may look small** for an exploited remote-code-execution flaw. The likely explanation is that when Gulizia reported it on August 4, exploitation had not yet been observed — but **the basis for the award was not published.**
Opening a web page is enough to run code. That is possible because the browser skips a check in order to be fast.
1. One-sentence definition
A type confusion bug appears when a program stores a value as one type and later reads the same memory as a different type.
| Written as | Read as | What follows |
|---|---|---|
| the number 5 | the address 0x5 | the attacker picks the address |
| a small object | a larger object | reads and writes past the end |
Once a number can be made to behave as an address, the next step is writing a chosen value to a chosen location. At that point the program's execution flow is available. Hence the description of CVE-2026-85046: arbitrary code execution via a crafted HTML page.
2. Why browser engines keep producing them
JavaScript declares no types. Whether x = 5 is an integer or a float is settled at runtime. Checking every time is slow.
| Stage | What it does | Risk |
|---|---|---|
| Interpretation | checks the type each time | slow but safe |
| JIT optimization | assumes "always an integer", drops the check | broken assumption = type confusion |
| Deoptimization | unwinds when the assumption fails | a hole here is an exploit |
This class is the shadow of performance engineering. Speed bought by removing a check creates the place to aim at. It is the structural reason Chrome zero-days recur in V8 (「What a zero-day is」).
3. The facts of this case
| Item | Value |
|---|---|
| Identifier | CVE-2026-85046 |
| Location | V8 |
| Class | type confusion |
| CVSS | 8.8 |
| Reported | August 4, Salvatore Gulizia ($1,000 bounty) |
| Patched | September 3, stable channel |
| Fixed builds | 152.0.7977.82 (Win/macOS/Linux) / .83 (Win/macOS) |
| CISA KEV listing | September 4 |
| US federal deadline | September 18 |
| 2026 sequence | sixth actively exploited zero-day |
4. Two things to do now
① Restart Chrome. The update downloads automatically but applies only after the browser is closed and reopened. Anyone who has not closed a window in weeks has been exposed the longest. Version 152.0.7977.82 or higher is fixed.
② Know that this is not only Chrome. V8 is shared by every Chromium-based browser.
| Browser | Engine | Status |
|---|---|---|
| Chrome | V8 | patched September 3 |
| Edge, Brave, Opera, Whale | V8 (Chromium) | each must ship its own update |
| Safari | JavaScriptCore | not affected by this CVE |
| Firefox | SpiderMonkey | not affected by this CVE |
5. What remains unresolved
- Google has not disclosed the targets or the timing of exploitation. It customarily withholds detail until most users are patched.
- Which JIT optimization path failed is not public. Section 2 describes the class, not a confirmed root cause for this CVE.
- The basis for the $1,000 award was not published — a low figure for an exploited remote-code-execution flaw.
- Patch timing for other Chromium browsers was not individually verified.
- 'Sixth' counts confirmed in-the-wild zero-days, not Chrome's total security patches this year.
Sources
- The Hacker News — Google releases Chrome update to patch actively exploited V8 zero-day
- Help Net Security — Google patches actively exploited Chrome zero-day (CVE-2026-85046)
- Security Affairs — Google fixes the sixth actively exploited Chrome zero-day of 2026
- SOC Prime — CVE-2026-85046: Chrome V8 zero-day exploited
- TechTimes — Chrome patches sixth zero-day of 2026 as V8 compiler exploit hits wild