GOOGLE has released Chrome 152 security updates that patch 12 vulnerabilities, including a zero‑day that was exploited in the wild. The most notable flaw is CVE-2026-85046, described as a high‑severity type confusion issue in Chrome’s V8 JavaScript and WebAssembly engine, reported by Salvatore Gulizia. Google’s advisory confirms exploitation in the wild, though details of the defect are not disclosed. Type confusion flaws in V8 can enable remote read/write via crafted HTML pages, potentially leading to remote code execution or other malicious activity.
Chrome 152’s fixes cover versions 152.0.7977.82 and 152.0.7977.83 for Windows and macOS, and 152.0.7977.82 for Linux. In total, the update addresses 12 vulnerabilities, including nine other high‑severity bugs such as out‑of‑bounds read/write, incomplete cleanup, use‑after‑free, race conditions and improper resource exposure, with three holes reported by external researchers. The patch also corrects two medium‑severity improper input validation and use‑after‑free weaknesses.
CVE‑2026‑85046 is noted as the sixth Chrome zero‑day patched in 2026; earlier disclosures include CVE‑2026‑2441, CVE‑2026‑3909, CVE‑2026‑3910, CVE‑2026‑5281 and CVE‑2026‑11645. Google emphasises that these updates mitigate active exploitation and recommends users apply the Chrome 152 updates promptly to reduce risk.