Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild

Google has released an emergency Chrome security update that fixes a critical zero-day vulnerability already being exploited in real-world attacks.

The flaw, tracked as CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine used by Chrome to process web content. The company confirmed that it is aware of an exploit for the vulnerability existing in the wild.

While Google did not disclose details about the attacks, affected targets, or the threat actors behind the activity, the active exploitation notice makes immediate patching important for all Chrome desktop users.

The security update moves Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS. Linux users receive version 152.0.7977.82. Google said the update will roll out gradually over the coming days and weeks.

Chrome 0-Day Vulnerability Exploited

CVE-2026-85046 is described as a high-severity type confusion vulnerability in V8. Type confusion bugs occur when software incorrectly treats a piece of data as one type when it is actually another type.

In a browser engine, this kind of memory-handling error can be dangerous. An attacker may be able to create specially crafted JavaScript or web content that causes Chrome to handle memory unexpectedly.

Depending on the exploit chain, this could lead to browser crashes, data exposure, or the execution of attacker-controlled code within the browser process.

A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites.

The vulnerability was reported by security researcher Salvatore Gulizia, also known as Serotav, on August 4, 2026. Google awarded a $1,000 bug bounty for the report.

The Chrome update contains 12 security fixes in total. Several of the patched issues are rated high severity and affect important browser components, including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting.

Among the notable fixes are a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws in Compositing, DevTools, and Skia, and a type confusion issue in Compositing.

Google is restricting access to some vulnerability details until most users have installed the update. This approach is intended to reduce the chance that attackers can quickly reverse-engineer the fixes and build additional exploit code before organizations and individuals patch their browsers.

Chrome users should update immediately by opening the browser menu, selecting Help, and then choosing About Google Chrome. Chrome will check for the latest version and download the update when available.

Users should relaunch the browser after installation to ensure the security fixes are applied. Enterprise administrators should verify that managed endpoints are updated to Chrome 152.0.7977.82 or later.

Security teams should also monitor endpoint telemetry and web-filtering logs for suspicious browser activity, especially phishing campaigns that use newly registered domains or deceptive update prompts.

Because CVE-2026-85046 is actively exploited, delaying the update leaves systems exposed to a known browser attack path.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.