Gulizia's writeup gives the mechanism in one line: a compiler bug lets an array holding PACKED_ELEMENTS receive the map for PACKED_SMI_ELEMENTS, and the mismatch is turned into arbitrary read and write on the JavaScript heap [5]. The CVE record stops at arbitrary code execution inside the sandbox, delivered by a crafted HTML page [3]. Google acknowledged only that an exploit exists in the wild and withheld the attack details until most users are updated [6], so whether the live chain paired this bug with a sandbox escape is not public, and neither is who is running it.
Eleven of the twelve fixes in this release carry no public evidence of attack; the twelfth does [1][1]. A browser that has not been relaunched keeps running the old binary, and Google's own instruction ends at Relaunch after a check under More > Help > About Google Chrome [10]. The fixed builds are 152.0.7977.82 and .83 on Windows and macOS, and 152.0.7977.82 on Linux [8].
On the pattern: this is the sixth Chrome zero-day Google has fixed under active exploitation since the start of the year, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645 [7][2]. The material does not say which components the other five sat in, so a V8-specific rate is not something to read off this release.
Then the payment. Gulizia reported the bug on August 4, 2026 and was awarded $1,000 for the disclosure [4]. Two halves of that story need to stay apart. The report date is documented, but Google described none of the attacks, so the point at which exploitation began is not [6]. What the record does not say is whether an attacker found the same bug independently, whether the in-the-wild activity predates August 4, or whether Google revisited the award once it knew the bug was live. What is on the record is a four-figure payout attached to a V8 read/write primitive that someone was using against users, and researchers price their next disclosure off published numbers like that one.
