After confirming active exploitation of a dangerous "zero-day" vulnerability in the V8 engine, Google has released a new version of the Chrome browser that, in addition to fixing this security flaw, addresses eleven other vulnerabilities.
This vulnerability, registered as "CVE-2026-85046", is classified as a "Type Confusion". The discovery and reporting of this security flaw was made to Google by security researcher Salvatore Gulzia, who operates under the alias "Serotav" online.
With this update, Chrome is upgraded to version 152.0.7977.82/83 on Windows and macOS and to version 152.0.7977.82 on Linux. This upgrade is being distributed to users as a staged, gradual update.
Google stated in its security bulletin that it is aware of exploitation of "CVE-2026-85046" "in the wild." The company intentionally refrained from disclosing technical details and exact exploitation methods so that users and Chrome-based projects have sufficient time to install the security patch.
Type confusion vulnerabilities occur when a program mistakenly interprets the type of a software object as another type; an error that can enable attackers to corrupt system memory.
V8 is the open-source JavaScript and WebAssembly engine in Chrome that compiles and runs code used on websites. Accordingly, the "CVE-2026-85046" vulnerability theoretically can be exploited via an HTML page containing malicious JavaScript code and enable remote code execution within Chrome's isolated renderer process.
This update also includes fixes for nine other high-risk vulnerabilities, including Use-After-Free and Out-of-Bounds Access issues in areas such as crash reporting, networking, UI composition, WebGL, CacheStorage, DevTools, and the Skia graphics library, along with a race condition in the V8 engine.
"CVE-2026-85046" is the sixth security flaw Google has identified and patched in Chrome this year that was subject to active exploitation. Previously, an out-of-bounds read/write vulnerability identified as "CVE-2026-11645" in the V8 engine was found to have been exploited by attackers prior to being patched in June.
In February, Google fixed an Iterator Invalidation vulnerability identified as "CVE-2026-2441" in the CSSFontFeatureValuesMap component; a flaw related to how font features are managed in Chrome.
In March, the company patched two vulnerabilities that were exploited in cyberattacks: first, an out-of-bounds write identified as "CVE-2026-3909" in the Skia 2D graphics library, and second, a Badness of Execution (improper execution) vulnerability identified as "CVE-2026-3910" in the V8 engine related to JavaScript and WebAssembly.
In April, Google fixed a Use-After-Edit vulnerability identified as "CVE-2026-5281" in Dawn - the cross-platform implementation of the WebGPU standard used in Chromium.
Google strongly urges all Chrome users to install the update as soon as it becomes available. To do so, users should go to Settings and then About Chrome and wait for the update to finish downloading and installing. Note that the browser must be restarted after completion for the security fixes to be fully applied.
Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to take the same action, as similar security patches are likely to be released for those browsers within at most two days.