Google has issued a new security update for Chrome, remedying 12 vulnerabilities, one of which is being actively exploited. This urgent patch addresses a critical security flaw in Chrome’s V8 engine, identified as CVE-2026-85046, which has a CVSS score of 8.8.
Details of the V8 Vulnerability
The flaw, a type confusion bug in V8, Chrome’s JavaScript and WebAssembly engine, allows remote attackers to run arbitrary code within the sandbox using a specially crafted HTML page. Discovered by security researcher Salvatore Gulizia, the vulnerability highlights significant browser security risks.
In a detailed blog post, Gulizia explained the issue as a V8 bug in compilers that modifies array elements, potentially enabling arbitrary read/write operations on the JavaScript heap. For his responsible disclosure, Google awarded Gulizia a $1,000 bug bounty.
Google’s Response to the Active Exploit
While Google confirmed the existence of an exploit for CVE-2026-85046, specific details of the attacks remain undisclosed to ensure users can update their browsers before further exploitation occurs. This is Google’s sixth resolution of an actively exploited zero-day in Chrome this year, following other critical vulnerabilities.
The company is actively encouraging users to update to Chrome versions 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux. The update process can be completed by navigating to More > Help > About Google Chrome and selecting the Relaunch option.
Recommendations for Browser Users
In addition to Chrome users, those utilizing Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should also apply these fixes as they become available. Staying updated is crucial for maintaining security and protecting against potential threats.
As cyber threats continue to evolve, timely updates and patches are essential in safeguarding digital environments. Users are encouraged to remain vigilant and promptly apply security updates to minimize exposure to potential exploits.
