Google has issued an emergency Chrome update to fix a high-severity zero-day flaw that is being exploited in attacks, urging users to install the latest version as soon as it becomes available.
The vulnerability, tracked as CVE-2026-85046, affects V8, the browser’s engine for running JavaScript and WebAssembly. Google said it was alerted to the issue by security researcher Salvatore Gulizia, who uses the name “Serotav”.
In a security advisory, the company said: “Google is aware that an exploit for CVE-2026-85046 exists in the wild.” It has not released technical details about the attacks, saying this would give Chrome users and related software projects time to apply the fix.
The update takes Chrome for Windows and macOS to versions 152.0.7977.82 or 152.0.7977.83, while the Linux release is version 152.0.7977.82. Google is distributing the update gradually, so it may not appear on every device immediately.
CVE-2026-85046 is classified as a type-confusion vulnerability. Such flaws can cause software to treat one kind of data as another, potentially allowing attackers to corrupt memory and execute unauthorised code.
Because V8 processes code delivered by websites, a specially created webpage containing malicious JavaScript could potentially exploit the weakness in Chrome’s renderer process. The browser’s sandbox is intended to limit what code can access, but vulnerabilities in the renderer can still pose a serious security risk.
The release also contains fixes for 11 other security defects. Nine are rated high severity and include use-after-free and out-of-bounds memory bugs affecting components including Chrome’s crash reporting, networking, graphics, WebGL, CacheStorage, DevTools and Skia systems. A separate race condition in V8 has also been addressed.
How to update Chrome
Google said this is the sixth Chrome vulnerability confirmed as exploited since the beginning of the year. Earlier fixes covered flaws in V8, CSS font handling, the Skia graphics library, WebGPU’s Dawn component and other parts of the browser.
Users can check for the update by opening Chrome’s menu and selecting Settings, followed by About Chrome. The browser should begin downloading the patch automatically when it reaches the device.
Chrome must be restarted after installation for the security fixes to take effect. Users of Chromium-based browsers, including Microsoft Edge, Brave, Opera and Vivaldi, should also install the equivalent updates when released, although patches for those applications may arrive several days later.
