Google has released an emergency update for the Chrome browser to patch an actively exploited high-severity zero-day vulnerability in the V8 JavaScript engine. The update also addresses 11 other security vulnerabilities. The flaw is being exploited in real-world attacks, prompting an urgent advisory from Google. V8 is the core JavaScript engine used by Chrome and is a frequent target for threat actors due to its complexity. Users are strongly advised to update their Chrome browsers immediately to the latest version. This is one of several Chrome zero-days that have been addressed in recent periods, highlighting the ongoing risk posed by browser-based vulnerabilities. The vulnerability is classified as high severity, indicating significant potential impact on affected systems.
CVE-2026-85046 is a type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine. Type confusion flaws cause software to misinterpret one type of object as another, enabling attackers to corrupt memory. The flaw can potentially be triggered via a specially crafted HTML page containing malicious JavaScript, potentially allowing remote code execution within Chrome's sandboxed renderer process. The update also addresses nine other high-severity vulnerabilities including use-after-free and out-of-bounds memory flaws in Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, and Skia, plus a race condition in V8. This is the sixth actively exploited Chrome zero-day patched in 2026. The vulnerability was reported by researcher Salvatore Gulizia (online alias 'Serotav').
Update Google Chrome to version 152.0.7977.82/.83 (Windows/macOS) or 152.0.7977.82 (Linux) immediately by navigating to Settings > About Chrome and allowing the update to download and install. Restart the browser after the update to apply the fixes. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should also apply updates as soon as they become available for those platforms.
