GOOGLE has issued an emergency Chrome update after a critical zero‑day vulnerability, CVE-2026-85046, was exploited in the wild. The flaw is a V8 JavaScript engine type confusion that can allow an attacker to read memory out-of-bounds and execute arbitrary code on a victim’s device, with no extra user interaction required. The advisory notes that threat actors are actively exploiting this flaw, underscoring the urgency for immediate action.
Affected are Chrome releases prior to 152.0.7977.82 for Linux, and prior to 152.0.7977.82/.83 for Windows and macOS. Google has confirmed that an active exploit for CVE-2026-85046 exists in the wild, but has withheld certain bug details and PoC links to prevent weaponisation. Practically, users should upgrade to the latest secure Chrome version without delay, re-launch the browser after updating, and ensure automatic updates remain enabled to prevent future exploitation.
The fast‑moving nature of the threat highlights the importance of keeping browsers patched, given Chrome’s large share of the desktop market and the potential impact on stored credentials, active sessions, or installation of follow‑on payloads.