Google Confirms Active Chrome Zero-Day Attacks as Emergency Fix Rolls Out

Google has patched an actively exploited Chrome zero-day affecting the browser’s V8 JavaScript and WebAssembly engine. The company confirmed that an exploit for CVE-2026-85046 exists in the wild.

The fix is now rolling out to Chrome 152 users on Windows, macOS, and Linux.

CVE-2026-85046 is a high-severity V8 flaw

Google released a Chrome security update that fixes CVE-2026-85046, a high-severity vulnerability affecting V8.

The CVE-2026-85046 vulnerability is described as a type confusion flaw. A specially crafted webpage containing malicious JavaScript could potentially trigger the issue.

Successful exploitation could potentially allow an attacker to execute code inside Chrome’s sandboxed renderer process.

Google confirmed that an exploit exists in the wild, but the company has withheld detailed technical information while users and other Chromium-based browser developers install the fix.

Chrome 152 update is rolling out now

Google has updated Chrome to version 152.0.7977.82/.83 on Windows and macOS.

Linux users are receiving Chrome 152.0.7977.82.

The update is rolling out gradually, so it may not appear on every device immediately. Users should install the latest version as soon as it becomes available and restart Chrome afterward so the security fixes can take effect.

Google also fixed 11 other Chrome vulnerabilities

The same Chrome update addresses 11 additional security vulnerabilities.

Nine of those flaws carry a high-severity rating, making this a significant security update beyond the actively exploited zero-day.

Google has limited access to detailed vulnerability information until a larger percentage of Chrome users receive the update.

Edge, Brave, Opera, and Vivaldi also need fixes

CVE-2026-85046 affects Chromium, which means the issue isn’t limited to Google Chrome.

Microsoft Edge, Brave, Opera, Vivaldi, and other Chromium-based browsers will also need corresponding security updates.

Those fixes may arrive several days after Google’s Chrome release, depending on each browser developer’s update schedule.

Google previously patched its fifth Chrome zero-day of 2026 earlier this year.

In other Chrome news, Google is working on an Ask Google From Anywhere feature on Windows, while the browser has also started showing new prompts for AI Mode on the New Tab page.

Via BleepingComputer