Google has released an emergency patch for a critical zero-day flaw in Chrome that is being exploited in live attacks. The vulnerability, labeled CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine—an essential component that handles web content and script execution. The company confirmed the flaw is being actively exploited in the wild.
Details of the Vulnerability
The issue is a type confusion bug in the V8 engine. In type confusion scenarios, data is misinterpreted as another type, potentially leading to memory errors. Such an error in a browser engine may allow crafted web pages or JavaScript to force Chrome into unpredictable behavior—crashes, exposure of data, or full execution of hostile code. Users could be compromised simply by visiting a malicious or compromised website; delivery vectors also include phishing, malvertising, social media, or preyed-upon legitimate sites.
The flaw was reported to Google by researcher Salvatore Gulizia (known as Serotav) on August 4, 2026, and earned a modest bug bounty of US$1,000. The update also addresses 11 other security issues, with affected browser subsystems including WebGL, DevTools, Skia, CacheStorage, Compositing, and CrashReporting. Among the fixes are race conditions, out-of-bounds writes, use-after-free vulnerabilities, and type confusion errors beyond V8.
Update Rollout and What You Should Do
The patch elevates Chrome Stable for Windows and macOS to version 152.0.7977.82/.83; Linux builds are moving to version 152.0.7977.82. Google said the update will reach users gradually over the coming days and weeks. Since CVE-2026-85046 is being exploited already, every Chrome desktop user needs to act immediately.
To update: open Chrome’s menu, go to Help, then About Google Chrome—this triggers a version check and download. After the update finishes, relaunch the browser to activate the fix. For enterprises, managed endpoints must be verified to be on version 152.0.7977.82 or later. Administrators should also monitor logs and telemetry for signs of activity like suspicious phishing or misleading update prompts stemming from newly registered or spoofed domains.
Google is withholding some technical details of the flaw until the majority of users have updated, to hinder attackers from reverse-engineering the patch and accelerating exploit development.
Because attackers are already leveraging this zero-day, delaying the update places users and organizations at real risk of browser‐based attacks.
Why this matters: Chrome remains one of the most used browsers globally, meaning any active zero-day in its core engine poses a huge threat. The V8 engine powers essential web functions for nearly every Chrome user—mistakes there can ripple into many attack vectors. Rapid patching is critical, not only to protect individual users but also to limit exposure in enterprise and managed systems.
