Google is urging users to update Chrome immediately after confirming that attackers have been actively exploiting a high-severity vulnerability in the browser's V8 JavaScript and WebAssembly engine.
The flaw, tracked as CVE-2026-85046, carries a CVSS score of 8.8 and is classified as a type-confusion bug.
Google acknowledged the active exploitation in a security notice published Thursday, stating that "an exploit for CVE-2026-85046 exists in the wild."
Users can manually trigger the update by navigating to More > Help > About Google Chrome and selecting Relaunch.
Google is withholding technical details on several of these until a majority of users and affected third-party projects have installed patches.
Google is urging users to update Chrome immediately after confirming that attackers have been actively exploiting a high-severity vulnerability in the browser's V8 JavaScript and WebAssembly engine.
The flaw, tracked as CVE-2026-85046, carries a CVSS score of 8.8 and is classified as a type-confusion bug. Such defects occur when software mishandles data types, leading to memory corruption or other unpredictable behavior. According to the CVE.org description, the vulnerability "allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page."
Google acknowledged the active exploitation in a security notice published Thursday, stating that "an exploit for CVE-2026-85046 exists in the wild." The company withheld details about the attackers, their targets, and the specific capabilities of the exploit, a standard practice intended to give users time to apply patches before threat actors can refine their techniques.
The fix ships in Chrome 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, along with version 152.0.7977.82 for Linux. Google said the update "will roll out over the coming days/weeks." Users can manually trigger the update by navigating to More > Help > About Google Chrome and selecting Relaunch.
Discovery and disclosure
Security researcher Salvatore Gulizia, who operates under the alias Serotav, reported the vulnerability on August 4, 2026. Google awarded him a $1,000 bug bounty for responsible disclosure.
In a technical blog post, Gulizia described the issue as a "V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS," which he said "can be turned into arbitrary read/write on the JavaScript heap."
The update addresses 12 security fixes in total, including nine high-severity and two medium-severity bugs. Google is withholding technical details on several of these until a majority of users and affected third-party projects have installed patches.
