Google has released an urgent Chrome security update after confirming that attackers are already exploiting a high-severity flaw in the browser’s V8 engine. Tracked as CVE-2026-85046, the vulnerability can be triggered through a maliciously crafted web page. Chrome users and organisations managing Chromium-based browsers should treat this as a priority patch rather than waiting for a routine maintenance window.
Background: why Chrome zero-days demand quick action
A zero-day is a vulnerability exploited by attackers before users have had a reasonable opportunity to install a fix. Browser flaws are especially important because the browser routinely processes code and content from websites, advertisements, email links and web applications. A victim may not need to install a suspicious program for an attack attempt to begin; visiting malicious content can be enough to expose the vulnerable component.
CVE-2026-85046 affects V8, the open-source engine Chrome uses to run JavaScript and WebAssembly. V8 is designed for speed, but flaws in a high-performance engine can have serious security consequences. Google classified this issue as high severity and confirmed that an exploit exists in the wild.
What Google changed in the Chrome security update
Google’s 3 September 2026 Stable Channel update moved Chrome to versions 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux. The release contains 12 security fixes in total.
The headline fix addresses CVE-2026-85046, a type-confusion vulnerability in V8. Type confusion occurs when software handles an object as though it were a different type, potentially corrupting memory and creating a path for unintended code execution. Google credited security researcher Salvatore Gulizia, also known as Serotav, with reporting the bug on 4 August 2026.
Google has temporarily restricted detailed bug information. That is standard practice while an update is still reaching the majority of users and helps reduce the information available to attackers attempting to reproduce the exploit.
What an attacker could do
The US Cybersecurity and Infrastructure Security Agency (CISA) says the flaw can allow a remote attacker to execute arbitrary code inside Chrome’s sandbox through a crafted HTML page. A browser sandbox is intended to limit what compromised web content can reach, so “inside the sandbox” does not automatically mean complete control of a device. However, code execution in the renderer is still a serious foothold and could potentially be combined with another vulnerability.
CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalogue on 4 September, confirming that exploitation is not merely theoretical. Its catalogue also warns that the issue may affect other browsers built on Chromium, including Microsoft Edge and Opera. Users should update those products through their respective vendors rather than assuming a Chrome update protects every browser.
Why CVE-2026-85046 matters
Chrome is widely used on personal computers and across enterprise fleets. The combination of broad exposure, active exploitation and a web-delivered attack path makes this patch particularly important. Even cautious users can encounter compromised websites, malicious advertising or convincing links sent through email and messaging services.
For businesses, browser patching is now a core security control. Browsers hold authenticated sessions for email, cloud dashboards, customer systems and developer tools. A successful attack could put sensitive work at risk, especially if it is paired with credential theft, session-token abuse or a second exploit that escapes the sandbox.
What users and businesses should do now
Update Chrome and restart it
On desktop Chrome, open the three-dot menu and go to Help > About Google Chrome. Chrome should check for updates automatically. Install the available update, then select Relaunch. The restart matters because a downloaded patch does not fully protect open browser processes until the browser is relaunched.
After restarting, return to the About page and confirm the installed version is at least the fixed release for your operating system. Because Google rolls updates out over time, some devices may not receive the build immediately. Keep checking if it is not yet offered.
Patch every Chromium-based browser separately
If you also use Edge, Opera, Brave or another Chromium-based browser, open that browser’s update page and install the latest vendor-provided security release. Each product has its own release schedule and version numbering. Do not rely on updating Chrome alone.
Enterprise actions for IT teams
- Use endpoint or browser-management tools to identify Chrome versions across the fleet.
- Prioritise internet-facing workstations and devices used for privileged administration.
- Enforce browser relaunches after allowing a reasonable window for users to save work.
- Check managed Edge and other Chromium deployments for corresponding vendor updates.
- Monitor unusual browser crashes, suspicious child processes and credential or session anomalies.
- Review exceptions for devices that have missed recent browser updates.
CISA set 18 September 2026 as the remediation due date for relevant US federal civilian agencies under its current guidance. Other organisations are not necessarily bound by that deadline, but the catalogue is a useful risk signal: active exploitation should push this fix near the top of the patch queue.
Risks and limitations
Public information about the attacks remains limited. Google has not disclosed who is using the exploit, which targets are affected or whether it is being combined with additional vulnerabilities. CISA lists known ransomware use as unknown. Claims about a particular threat group or campaign should therefore be treated cautiously unless supported by new evidence.
Updating also does not replace other protections. Phishing-resistant multi-factor authentication, endpoint detection, least-privilege access and prompt investigation of suspicious sessions all reduce the damage an attacker may cause if one defensive layer fails.
What to watch next
More technical details may emerge after the patched version reaches most users. Watch for security updates from other Chromium browser vendors, revisions to CISA guidance and any confirmed indicators of compromise. Organisations should also verify that devices actually restarted after receiving the update; deployment dashboards that show a package as downloaded can create a false sense of security.
Conclusion
CVE-2026-85046 is an actively exploited Chrome zero-day with a straightforward response: update and relaunch the browser now. Individuals should verify the installed version, while organisations should confirm coverage across all managed Chrome and Chromium-based browsers. The available evidence does not justify panic, but it does justify prompt, measurable patching.