Google has shipped an emergency security update for Chrome after confirming that a previously unknown flaw in the browser’s JavaScript engine is already being used in real-world attacks. The vulnerability, now tracked as CVE-2026-85046, gives the company’s security team another reminder that browser exploitation remains one of the most reliable ways for attackers to get a foothold on a target machine, with no phishing email or malicious attachment required beyond a single web page visit.

What Makes This Bug Dangerous

The flaw is a type confusion vulnerability inside V8, the JavaScript and WebAssembly engine that powers Chrome and every Chromium-based browser. Type confusion bugs occur when a program treats a piece of data as one type of object when it is actually structured as something else entirely. In a browser engine, that mismatch can be manipulated by a carefully crafted script to corrupt memory, and from there an attacker can often pivot toward crashing the browser, leaking sensitive data, or in the worst case running their own code inside the browser process.

What separates this from a routine bug report is that Google has explicitly confirmed exploitation is already happening. That single detail changes the calculus for defenders: this is not a theoretical weakness waiting to be weaponized, it is an active attack technique that has already been observed against real users.

Who Is at Risk

Because the flaw sits in the core scripting engine, exploitation does not require a user to download anything or enter credentials on a fake site. The attack surface is simply loading a web page that contains the malicious script. That page could arrive through several familiar channels:

• A phishing email containing a link to an attacker-controlled site
• Malicious advertising placed on otherwise legitimate ad networks
• Direct messages on social media pointing to booby-trapped pages
• A legitimate website that has itself been compromised and seeded with the exploit

Google has not disclosed who is behind the exploitation or which organizations have been targeted so far, which is consistent with its usual practice of withholding technical detail until the majority of the user base has updated. That silence is deliberate: publishing specifics too early would hand a working blueprint to attackers who have not yet built their own exploit.

The Fix and Rollout

The patched build lands as Chrome Stable version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux. Google’s update bundles twelve security fixes in total, several of which also carry real weight on their own: a race condition inside V8, an out-of-bounds write affecting WebGL, and multiple use-after-free issues spanning the Compositing, DevTools, and Skia components. None of the other eleven fixes are currently flagged as exploited, but the presence of that many memory-safety bugs in a single release underscores how much attack surface a modern browser still carries.

The vulnerability was reported to Google by an external researcher operating under the handle Serotav, who received a $1,000 bounty for the find, a relatively modest payout given the real-world severity that followed. As is standard practice, the rollout is staged and will continue over the coming days and weeks rather than reaching every installed copy of Chrome instantly.

What Defenders Should Do Now

Chrome typically updates itself in the background, but given that this bug is already being exploited, security teams should not assume the update has already landed everywhere. Recommended steps include:

• Manually trigger the update by opening Chrome’s menu and navigating to Help > About Google Chrome, then relaunching the browser to apply the fix
• Verifying that managed and unmanaged endpoints alike have reached version 152.0.7977.82 or later, since patch compliance can lag significantly on devices that are rarely restarted
• Reviewing endpoint telemetry and web filtering logs for unusual browser crash patterns or connections to newly registered domains, which can be an early indicator of exploitation attempts
• Treating unexpected browser update prompts with suspicion, since attackers sometimes exploit patch announcements as cover for fake “update now” phishing pages

Because Chromium underpins a wide range of other browsers, organizations running Edge, Brave, Opera, or other Chromium derivatives should also confirm whether equivalent patches have been issued for those products rather than assuming the fix is Chrome-specific.

The Bigger Picture

Actively exploited browser zero-days have become a near-monthly occurrence for Chrome over the past several years, and V8 in particular remains a favorite target because a single successful exploit chain can be reused across every platform the browser supports. For most organizations, the practical takeaway is less about this specific CVE and more about patch velocity: the gap between a fix becoming available and it actually reaching every endpoint is exactly the window attackers are counting on.