Google has issued an emergency update for its Chrome browser to address a critical security vulnerability that has been actively exploited by attackers. The issue, identified as CVE-2026-85046, is a type confusion bug in the V8 engine, which compiles and executes JavaScript code used by websites. This flaw allows hackers to corrupt memory and potentially execute malicious code within Chrome’s sandboxed renderer process.
The update, which brings Chrome to version 152.0.7977.82/.83 on Windows and macOS, and 152.0.7977.82 on Linux, is part of a gradual rollout. However, Google has warned that an exploit for this flaw already exists in the wild, meaning that attackers have been using it to compromise systems. The company has not disclosed any technical details about the exploitation method, giving users time to apply the fix and dependent projects time to update their code.
Type confusion flaws occur when software misinterprets one type of object as another, allowing attackers to manipulate memory and potentially execute malicious code. In this case, the V8 engine is vulnerable to such an attack, which could be triggered by a specially crafted HTML page containing malicious JavaScript.
The Chrome update addresses not only CVE-2026-85046 but also nine other high-severity vulnerabilities, including use-after-free and out-of-bounds memory flaws in various components of the browser. These issues were discovered through Google’s continuous security efforts and have been fixed to prevent potential attacks.
This is the sixth actively exploited bug that Google has fixed in Chrome since the start of the year, highlighting the importance of keeping software up-to-date to prevent exploitation by attackers. Previous fixes included an out-of-bounds read and write vulnerability in V8, an iterator invalidation flaw in CSSFontFeatureValuesMap, and two zero-day vulnerabilities in Skia 2D graphics library and V8.
To protect yourself from this vulnerability, we recommend that Chrome users apply the available update as soon as it reaches them. This can be done by going to Settings > About Chrome and waiting for the update to download and install. A browser restart is required after the update process is complete for the fixes to take effect. Users of Chrome-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, should also apply the update, although it may take a couple of extra days for the fix to arrive on these apps.
Remember that keeping your software up-to-date is one of the most effective ways to prevent exploitation by attackers. Regularly check for updates and install them as soon as they become available to protect yourself from potential security threats.
Source: Bleeping Computer — 2026-09-04