Key Takeaways

  • Google fixed CVE-2026-85046, a high-severity V8 type confusion flaw already exploited in attacks.
  • Chrome users should update to version 152.0.7977.82/.83 and restart the browser to activate the fixes.
  • Microsoft Edge, Brave, Opera, and Vivaldi share Chromium components and may receive corresponding updates after Google Chrome.

Google has released a Chrome security update addressing CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine. Google said an exploit for the flaw exists in the wild, making rapid deployment more pressing than a routine browser maintenance cycle.

The update moves Google Chrome to version 152.0.7977.82/.83 on Windows and macOS and version 152.0.7977.82 on Linux. Distribution is gradual, so the update may not appear on every device immediately. Users can check manually through Settings, followed by About Chrome. A browser restart is required after installation for the corrected code to take effect.

Security researcher Salvatore Gulizia, known online as "Serotav," reported CVE-2026-85046 to Google. The vulnerability is classified as a type confusion issue, which occurs when software handles one kind of object as though it were another. That mistake can corrupt memory and, under the right conditions, give an attacker a path toward executing code.

V8 sits unusually close to everyday web activity. It compiles and runs JavaScript and WebAssembly delivered by websites, so a maliciously constructed HTML page containing hostile JavaScript could potentially trigger CVE-2026-85046. Exploitation may permit remote code execution inside Chrome's sandboxed renderer process. Escaping that sandbox or reaching deeper system resources could require another vulnerability, depending on the attack chain.

For now, technical details remain limited. The Google Chrome Releases advisory confirms active exploitation but does not identify the attackers, their targets, the scale of observed activity, or the delivery method. Holding back exploit details gives users and Chromium-dependent browser developers time to deploy protections before broader technical information can help additional attackers.

Browser patches can look deceptively simple from an operations perspective. In managed fleets, however, open browser sessions, delayed relaunches, update rings, remote employees, virtual desktops, and incompatible applications can leave older builds running well after administrators approve an update. Security teams therefore need visibility into both installation status and the browser version actually active on each endpoint.

CVE-2026-85046 is the sixth actively exploited Chrome vulnerability Google has fixed since the start of 2026. Earlier cases included CVE-2026-2441 in February; CVE-2026-3909 and CVE-2026-3910 in March; CVE-2026-5281 in April; and CVE-2026-11645 in June. Several involved memory safety problems in V8, Skia, Dawn, and other components that process complex web content.

The pattern also follows a busy 2025, when Google patched at least seven Chrome zero-days exploited in attacks. At the same time, Google Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited across technology products during 2025, with browsers representing under 10% of that activity. Browsers may no longer dominate zero-day exploitation, but their broad deployment and direct exposure to untrusted content keep them attractive targets.

Beyond CVE-2026-85046, Google's update fixes 11 other vulnerabilities. Nine are rated high severity and include use-after-free, out-of-bounds memory, and race-condition issues affecting Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia, and V8. That breadth is another reason organizations may want to treat the release as more than a single-flaw patch.

What should enterprise security leaders prioritize? Short update deadlines, forced relaunch policies where practical, and reporting that identifies lagging devices can narrow the exposure window. Those controls support the continuous-verification approach described in NIST SP 800-207, rather than assuming an enrolled endpoint remains trustworthy indefinitely.

Microsoft Edge, Brave, Opera, and Vivaldi also inherit many security changes from Chromium. Their release schedules may trail Google Chrome by a few days, so administrators should monitor each vendor independently instead of treating the Chrome update as proof that every Chromium-based browser is protected. The immediate objective is straightforward: deploy the corrected build, confirm installation, and make sure users actually restart their browsers.