Google fixes actively exploited Chrome zero-day ahead of new EU cyber rules
Critical V8 engine flaw patched as Cyber Resilience Act's 24-hour exploit reporting begins September 11.
1Critical Chrome vulnerability patched
Google fixed 12 Chrome vulnerabilities on September 3, including CVE-2026-85046 - a type confusion flaw in V8 JavaScript engine rated 8.8 CVSS. This actively exploited zero-day allows remote attackers to execute code via malicious web pages. The patch covers Chrome builds 152.0.7977.82/.83, with details initially withheld until widespread deployment. This marks the sixth Chrome zero-day exploited in attacks this year.
2Impact across Chromium browsers
The V8 vulnerability affects all Chromium-based browsers including Edge, Brave, Opera and Vivaldi, requiring identical updates. Google's phased rollout means protection isn't instantaneous. Researcher Salvatore Gulizia reported the bug on August 4, receiving a $1,000 bounty - significantly below Chrome's $250,000 maximum. Google's reward system considers report quality and potential duplicate discoveries, though specifics remain undisclosed in this case.
3EU's new cyber reporting timeline
Eight days post-patch, the EU Cyber Resilience Act takes effect September 11, mandating 24-hour exploit reporting for software sold in Europe. Chrome qualifies as a 'product with digital elements' under these rules. Manufacturers must now report actively exploited vulnerabilities within one day of awareness, followed by detailed notifications within 72 hours and final reports in 14 days after fixes are available.
4Reporting chain requirements
The Act establishes a centralized reporting platform where disclosures simultaneously reach national response teams and ENISA (EU Cybersecurity Agency). ENISA then distributes alerts to all countries where affected products are marketed. Crucially, the 24-hour clock starts when exploitation is confirmed, not at initial bug report. Google's September 3 public acknowledgment demonstrates compliance timing awareness ahead of the regulation.
5Contrast with current practices
Google's September 3 patch preceded legal obligations, as the Act wasn't yet in force. Future similar discoveries would require formal filings. The company recently endorsed cybersecurity as leadership priority, aligning with these coming requirements. The $1,000 bounty for this critical flaw raises questions about reward calibration versus vulnerability severity and market impact.
6Technical specifics of the exploit
The type confusion flaw in V8 - Chrome's JavaScript engine - enables attackers to bypass sandbox protections through carefully crafted web pages. Such vulnerabilities are particularly dangerous as they require no user interaction beyond visiting a compromised site. The gradual update rollout creates temporary protection gaps, though Google accelerated distribution given the active exploitation status.
7Industry-wide implications
This case demonstrates how Chromium's dominance (65% browser market share) makes its vulnerabilities high-value targets. The EU's 24-hour reporting rule will pressure all software vendors to establish rapid response protocols. For context, Google fixed five other Chrome zero-days earlier in 2026, showing persistent attacker focus on browser vulnerabilities.
8New era of vulnerability transparency
The Cyber Resilience Act fundamentally changes how companies handle security flaws in Europe, prioritizing rapid disclosure over perfect patches. While improving threat awareness, the 24-hour deadline may strain vendor resources during critical incidents. This Chrome case serves as both a final unregulated example and template for future compliance under the world's strictest cyber reporting regime.