Google has released a security update for Chrome due to a vulnerability that is already being actively exploited. The vulnerability is located in the browser’s V8 engine and could allow an attacker to execute arbitrary code.
The vulnerability is tracked as CVE-2026-85046 and has been rated “High” by Google. It involves a so-called type confusion error in V8, Chrome’s JavaScript and WebAssembly engine. In this scenario, the software interprets data as a different type than it actually is, which can lead to memory handling errors.
Cybersecurity News points out that such errors in a browser can have various consequences. Specially crafted JavaScript code or other web content can cause Chrome to process memory in an unexpected way. Depending on the attack used, this can lead, for example, to a crash, data exposure, or the execution of code within the browser process.
Google confirms that an exploit for CVE-2026-85046 exists “in the wild.” The company has not provided details about the actual attacks. As a result, it is not yet known who is exploiting the vulnerability, which users or organizations are being targeted, or how the exploit is reaching victims.
Twelve security vulnerabilities patched
The fix is included in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. Google is rolling out the update gradually. Users can check which version is installed via Help > About Google Chrome. After installation, the browser must be restarted for the update to take effect.
The Chrome update contains a total of twelve security fixes. In addition to CVE-2026-85046, issues have been resolved in WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting. These include several vulnerabilities rated “High,” such as use-after-free errors and an out-of-bounds write.
Security researcher Salvatore Gulizia, also known as Serotav, reported CVE-2026-85046 to Google on August 4. He received a bug bounty of $1,000 for this discovery.
The Hacker News reports that this is the sixth Chrome zero-day this year for which Google has actively detected exploitation, and the site also notes that Google is withholding technical details for the time being.
This is standard practice for Chrome updates. Google restricts access to information about vulnerabilities until a large portion of users has received the new version. This makes it more difficult for other attackers to analyze the fixes and derive new exploits from them.
Also read: Chrome will receive biweekly updates starting in September