Google has issued an urgent update for its Chrome browser to address a critical zero-day vulnerability, which is currently being exploited in the wild. This flaw, identified as CVE-2026-85046, impacts the V8 JavaScript and WebAssembly engine integral to Chrome’s web content processing capabilities. The company has acknowledged the existence of active exploits targeting this vulnerability.
Details on the Exploited Vulnerability
While specific information about the attacks and the entities behind them remains undisclosed, the vulnerability’s active exploitation underscores the necessity for immediate patching by all desktop Chrome users. The update elevates Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS, while Linux users should expect version 152.0.7977.82. Google plans a gradual rollout of this update over the following days and weeks.
The CVE-2026-85046 flaw represents a high-severity type confusion vulnerability within the V8 engine. Such bugs occur when software incorrectly interprets data types, potentially allowing attackers to craft specific JavaScript or web content that triggers unexpected memory handling in Chrome. This can lead to browser crashes, unauthorized data access, or attacker-controlled code execution.
Potential Impact and Exploit Methods
Victims of this exploit might only need to visit a malicious or compromised website to become targets. Attackers can also spread exploit links through phishing emails, malicious ads, social media messages, or compromised legitimate sites. This vulnerability was reported on August 4, 2026, by security researcher Salvatore Gulizia, also known as Serotav, who received a $1,000 bug bounty from Google for the discovery.
The latest Chrome update includes a total of 12 security patches, several of which address high-severity issues affecting critical browser components like V8, WebGL, and DevTools. Noteworthy fixes include a race condition in V8, an out-of-bounds write flaw in WebGL, and use-after-free vulnerabilities in Compositing and Skia.
Recommendations for Users and Administrators
Google has implemented restrictions on access to specific vulnerability details to prevent attackers from reverse-engineering the fixes before users have updated their browsers. To secure their systems, Chrome users should promptly update their browsers by accessing the menu, selecting Help, and choosing About Google Chrome. The browser will check for updates and install them if available. Users must restart Chrome to apply the security patches effectively.
Enterprise administrators are advised to confirm that all managed endpoints are updated to version 152.0.7977.82 or later. Security teams should vigilantly monitor endpoint activity and web-filtering logs for any suspicious browser behavior, particularly phishing attempts leveraging newly registered domains or misleading update prompts. Given the active exploitation of CVE-2026-85046, delaying this update increases the risk of exposure to a known browser attack vector.
.webp?ssl=1 "Torg Grabber Stealer Evolves to Encrypted API C2")
