Google Chrome Patches Actively Exploited Zero-Day Vulnerability

Google has issued a critical security update for its popular Chrome browser, patching a newly identified zero-day vulnerability that attackers are actively exploiting in the wild. The flaw, designated CVE-2026-85046, resides within the V8 JavaScript and WebAssembly engine, a core component responsible for executing web code.

The vulnerability is described as a "type confusion" issue, which occurs when software incorrectly interprets one data type as another. This misinterpretation can lead to memory corruption, a common pathway for attackers to execute malicious code on a user's system. The discovery was reported to Google by independent researcher Salvatore Gulizia, also known by his online alias “Serotav.”

Google confirmed in an advisory that an exploit for CVE-2026-85046 has been observed "in the wild." To prevent further exploitation and allow users ample time to update, the company has withheld specific technical details about the flaw and its exploitation methods. The update brings Chrome to version 152.0.7977.82/.83 for Windows and macOS users, and version 152.0.7977.82 for Linux users.

The V8 engine is fundamental to how Chrome renders web pages, processing complex JavaScript and WebAssembly. A flaw within V8 could potentially be triggered by a malicious HTML page loaded in the browser. Successful exploitation might grant attackers the ability to execute arbitrary code within the browser's highly restricted "renderer process," which is designed to isolate web content from the operating system.

Broader Security Patching

Beyond the critical zero-day, the latest Chrome update, version 152, also addresses eleven additional vulnerabilities. Nine of these are classified as high-severity, including several "use-after-free" and "out-of-bounds write" errors. These flaws were found in various browser components, such as Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, and the Skia 2D graphics library. A race condition vulnerability was also patched within the V8 engine itself.

This marks the sixth actively exploited zero-day vulnerability Google has had to address in Chrome since the beginning of 2026. This year has seen a persistent stream of security challenges for the browser. Earlier in the year, an out-of-bounds read and write vulnerability in the V8 engine (CVE-2026-11645) was patched in June. Prior to that, an iterator invalidation flaw in CSSFontFeatureValuesMap (CVE-2026-2441) was fixed in February. March saw two significant zero-day fixes: an out-of-bounds write in the Skia graphics library (CVE-2026-3909) and an improper implementation in V8 (CVE-2026-3910). In April, a use-after-free vulnerability in Dawn, the WebGPU standard implementation for Chromium (CVE-2026-5281), was also addressed.

Google strongly advises all Chrome users to update their browsers immediately. Users can initiate the update process by navigating to Settings > About Chrome within the browser. The update will download and install automatically, requiring a browser restart to fully apply the security fixes. Users of other browsers based on the Chromium project, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also encouraged to update promptly, although patches for these browsers may take a few extra days to roll out.