Google has pushed an urgent security update for its Chrome browser after confirming that a high‑severity vulnerability in the V8 JavaScript and WebAssembly engine is being actively weaponized. The flaw, catalogued as CVE‑2026‑85046, is a type‑confusion bug that could let a remote attacker run arbitrary code inside Chrome’s sandboxed renderer process when a victim visits a specially crafted web page.
Details of the patched vulnerability
The vulnerability resides in V8, the open‑source engine Chrome uses to interpret JavaScript and WebAssembly code embedded in web pages and applications. According to the U.S. National Vulnerability Database, versions of Chrome released before 152.0.7977.82 are susceptible to arbitrary‑code execution when presented with a malicious HTML page.
Type‑confusion occurs when software allocates an object as one data type but later treats it as another. In a performance‑critical engine like V8, such a mismatch can cause the browser to make faulty assumptions about an object’s size, layout, or memory location. An attacker who can reliably trigger this behavior may read or write memory outside intended boundaries, potentially crashing the browser, exposing data, or executing code under the attacker’s control.
Google’s advisory states that an exploit for CVE‑2026‑85046 is already observed “in the wild.” The company has not disclosed who is running the exploit, which organizations have been targeted, or how the malicious payload is delivered. Consequently, the scale and intent of the campaign remain unknown.
Patch rollout and user guidance
The fix is included in Chrome 152, which bundles twelve separate security improvements. The patched desktop builds are Chrome 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. An Android version (152.0.7977.82) will appear on Google Play over the next several days. Google is distributing the update gradually, but the advisory urges users and administrators not to wait for the regular automatic‑update schedule.
To verify that the latest version is installed, users can open the Chrome menu, select Help → About Google Chrome, or navigate to chrome://settings/help. After the download completes, a browser restart is required for the patches to become effective.
Because the vulnerability is being actively exploited, Google recommends that organizations prioritize confirming the deployment of the patch across all Chrome installations, including secondary browsers built on Chromium, such as Microsoft Edge, Brave, Opera, and Vivaldi. The underlying V8 engine is shared across these products, meaning they could be vulnerable until their vendors ship the corresponding update.
Broader context and additional fixes
While CVE‑2026‑85046 represents the most immediate danger, Chrome 152 also addresses a range of other high‑severity memory‑safety issues. The release notes cite an out‑of‑bounds read in the crash‑reporting component, an incomplete cleanup problem in the networking stack, and a separate V8 race condition reported by security researcher Brendan Dolan‑Gavitt of XBOW.
Additional mitigations include an out‑of‑bounds write flaw in WebGL, improper resource exposure in CacheStorage, use‑after‑free bugs affecting DevTools and the Skia graphics library, and another type‑confusion issue in the compositing subsystem. Two medium‑severity vulnerabilities were also disclosed in the Transactions Platform and Chrome’s mobile code.
Google’s security team employs automated tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control‑Flow Integrity, and extensive fuzzing to locate defects before release. Nevertheless, the sheer size and complexity of modern browsers mean that exploitable bugs continue to surface in production versions.
Security analysts are advised to monitor for indirect signs of exploitation, such as unexpected renderer crashes, anomalous child processes, suspicious downloads, or unexplained command‑interpreter launches following visits to untrusted sites. Although these indicators are not exclusive to CVE‑2026‑85046, they can help detect activity consistent with browser‑based attacks while detailed technical indicators remain restricted.
The V8 flaw marks the sixth Chrome vulnerability Google has confirmed as being exploited in the wild during 2026. The first known exploit this year targeted CVE‑2026‑2441, an iterator‑invalidation issue affecting the browser’s handling of CSS font‑feature values, which was patched in February.
Google has chosen to withhold deeper technical details about the exploit while the patch is being deployed. This practice is common for actively exploited browser bugs, as releasing proof‑of‑concept code too early could enable additional threat actors to replicate the attack before a sufficient share of users has updated.
Organizations should also consider that Chromium‑based applications and embedded browsers—such as those used in virtual desktops, kiosks, or custom software—may rely on the vulnerable V8 version. A comprehensive inventory of all Chromium derivatives in the environment will ensure that no lingering exposure remains after the Chrome update is applied.
Finally, Chrome on iOS operates under Apple’s WebKit engine rather than Google’s V8‑based Chromium stack, so the exact risk profile differs for iOS users. Nevertheless, the broader recommendation to keep all browsers up to date applies across platforms.
Be First to Comment