Google has released a new security update for Chrome that fixes 12 vulnerabilities, including a high-severity zero-day flaw that the company says is already being actively exploited in the wild.
The most serious issue, tracked as CVE-2026-85046 with a CVSS score of 8.8, affects Chrome’s V8 JavaScript and WebAssembly engine. The vulnerability is classified as a type confusion flaw and could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox by convincing a victim to open a specially crafted HTML page.
According to the vulnerability description published by CVE.org, the flaw affects Google Chrome versions prior to 152.0.7977.82.
Chrome Zero-Day CVE-2026-85046 Under Active Exploitation
Security researcher Salvatore Gulizia, also known online as Serotav, discovered and reported CVE-2026-85046 to Google on August 4, 2026.
Gulizia was awarded a $1,000 bug bounty for responsibly disclosing the vulnerability.
In a technical write-up about the flaw, the researcher explained that the vulnerability originates in the V8 compiler and involves an incorrect map transition between JavaScript array element types. Under the right conditions, the issue can potentially be leveraged to achieve arbitrary read and write operations on the JavaScript heap.
That capability can significantly increase the impact of a browser vulnerability, potentially allowing an attacker to move from a memory-corruption bug toward arbitrary code execution.
Google Confirms Exploit Exists in the Wild
Google has confirmed that an exploit for CVE-2026-85046 exists in the wild. However, the company has not disclosed technical details about the attacks, including how the vulnerability is being exploited or who may be behind them.
This limited disclosure is typical for actively exploited vulnerabilities. Keeping exploit details restricted gives users and organizations more time to install the security update before additional attackers can reproduce and weaponize the flaw.
With CVE-2026-85046, Google has now addressed six actively exploited Chrome zero-days in 2026. The other vulnerabilities include:
- CVE-2026-2441
- CVE-2026-3909
- CVE-2026-3910
- CVE-2026-5281
- CVE-2026-11645
Update Chrome as Soon as Possible
Google recommends that Chrome users install the latest security release to protect their systems against potential attacks.
The patched versions are:
- Windows: Chrome 152.0.7977.82 or 152.0.7977.83
- macOS: Chrome 152.0.7977.82 or 152.0.7977.83
- Linux: Chrome 152.0.7977.82
To check for the latest update, open Chrome and go to:
More → Help → About Google Chrome
Chrome will automatically check for available updates. If an update has been installed, click Relaunch to complete the process.
Users should also remember that other Chromium-based browsers may be affected by vulnerabilities in shared Chromium components. Those using Microsoft Edge, Brave, Opera, Vivaldi, or other Chromium-based browsers should install the corresponding security updates as soon as they become available.
CISA Adds the Vulnerability to Its KEV Catalog
The urgency surrounding the vulnerability increased on September 4, 2026, when the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalog.
Under CISA’s directive, Federal Civilian Executive Branch (FCEB) agencies are required to apply the appropriate security fixes by September 18, 2026.
The CISA listing provides another indication that the vulnerability is being actively exploited and should be treated as a high-priority security update.
What Chrome Users Should Do
Chrome users should update their browsers immediately rather than waiting for the update to be installed automatically.
Because CVE-2026-85046 can potentially be triggered through a maliciously crafted HTML page, users should also be cautious when opening links or web pages from untrusted sources.
For organizations managing large numbers of Chrome installations, administrators should prioritize deployment of the patched versions across affected systems and ensure that Chromium-based browsers are updated when their respective vendors release fixes.
Bottom line: CVE-2026-85046 is an actively exploited Chrome zero-day, and installing the latest Chrome security update is the best way to reduce the risk of exploitation.
