Google patches Chrome zero-day used in attacks

Google updated Chrome to versions 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux, and said the rollout would reach users gradually. The update fixed CVE-2026-85046, which the company described as a type-confusion flaw, along with 11 other vulnerabilities.

Google said it was aware of an exploit for CVE-2026-85046 in the wild, but it did not publish technical details. The company said that withholding information was meant to give users and dependent projects time to apply the fix.

Salvatore Gulizia, who is also known online as Serotav, reported the flaw to Google. The company said V8, Chrome’s open-source JavaScript and WebAssembly engine, was the affected component.

Google said the issue might be triggered by a specially crafted HTML page with malicious JavaScript and could lead to remote code execution inside Chrome’s sandboxed renderer process. It also said the update fixed nine other high-severity problems across Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools, Skia and a race condition in V8.

Google said CVE-2026-85046 was the sixth actively exploited Chrome bug it had fixed since the start of the year. It advised users to let the update arrive through Chrome’s settings page, then restart the browser, and said the same approach was advisable for Chrome-based browsers including Microsoft Edge, Brave, Opera and Vivaldi.