Google has released an emergency security update for Chrome after confirming that a high-severity zero-day vulnerability in the browser’s V8 JavaScript and WebAssembly engine is being actively exploited.
The flaw, tracked as CVE-2026-85046, could potentially expose users to browser crashes, data exposure or attacker-controlled code execution, depending on how it is exploited.
The company has not disclosed details about the attacks, their targets or the threat actors involved. However, its confirmation that an exploit for the vulnerability exists in the wild has made installing the latest Chrome update an immediate security priority for desktop users.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Zero-Day Flaw Targets Chrome’s V8 Engine
CVE-2026-85046 is described as a high-severity type confusion vulnerability affecting V8, the engine Chrome uses to process JavaScript and WebAssembly content.
Type confusion occurs when software incorrectly treats data as one type when it is actually another. In a browser engine, such memory-handling errors can create dangerous conditions that attackers may attempt to exploit through specially crafted JavaScript or web content.
Depending on the exploit chain, the vulnerability could result in browser crashes, exposure of data or execution of attacker-controlled code within the browser process.
An exploit attempt may begin when a victim visits a malicious or compromised website. Exploit links could also potentially be distributed through phishing emails, malicious advertisements, social media messages or compromised legitimate websites. The vulnerability was reported by security researcher Salvatore Guilizia, also known as Serotav, on August 4, 2026. Google awarded a $1,000 bug bounty for the report.
Chrome Update Fixes 12 Security Issues
The latest security release moves Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS, while Linux users receive version 152.0.7977.82. Google said the update will be rolled out gradually over the coming days and weeks.
The Chrome update contains 12 security fixes in total. Several of the patched vulnerabilities are rated high severity and affect important browser components including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing and CrashReporting.
Other notable fixes include a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws affecting Compositing, DevTools and Skia, and another type confusion issue in Compositing.
Google is restricting access to some vulnerability details until most users have installed the update. The measure is intended to reduce the possibility of attackers rapidly reverse-engineering the patches and developing additional exploit code before users and organisations have secured their browsers.
Chrome Users Urged to Install Update Immediately
Chrome desktop users should update their browsers as soon as possible because CVE-2026-85046 is already being exploited. Users can check for the latest version by opening Chrome’s menu, selecting Help and then About Google Chrome. The browser will check for an available update and download it when available. Chrome should then be relaunched to ensure the security fixes are fully applied.
Enterprise administrators should also verify that managed endpoints have been upgraded to Chrome 152.0.7977.82 or a later version. With details about the active attacks being withheld, the precise scale and nature of the exploitation remain unclear. The confirmed existence of an in-the-wild exploit, however, means delaying the update could leave unpatched Chrome installations exposed to a vulnerability already being used in real-world attacks.
Follow the Centre for Police Technology on LinkedIn to stay updated on the latest developments in policing, cybersecurity, digital forensics, investigations, fraud risk management, and technology-driven public safety.
https://www.linkedin.com/company/policetechnology/
