Google just patched CVE-2026-85046, a Chrome bug that attackers were already using before anyone outside Google knew it existed. If you’re on Windows, Mac, or Linux, the short version is simple: open Chrome’s settings, let it update, and actually restart the browser today. The flaw lets a booby-trapped webpage break out of Chrome’s sandbox, and Google confirms exploit code is active right now.
Here’s what matters before you keep reading:
- CVE-2026-85046 is a type confusion bug in Chrome’s V8 JavaScript engine, and Google says it’s already being exploited in the wild.
- It’s fixed in Chrome 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux, released September 4, 2026.
- This is the sixth actively exploited Chrome zero-day Google has patched in 2026 alone.
- CISA added it to its Known Exploited Vulnerabilities catalog the same day, giving federal agencies until September 18 to patch.
- Chromium-based browsers like Edge, Brave, Opera, and Vivaldi run the same V8 engine and need their own separate updates.
What CVE-2026-85046 Actually Does to Your Browser
V8 is the engine that turns the JavaScript on every webpage into something your computer can actually run. CVE-2026-85046 is a “type confusion” bug inside that engine, which is a fancy way of saying V8 gets tricked into treating one kind of data as another. Security researcher Salvatore Gulizia, who reported the bug back on August 4 and earned a $1,000 bounty for it, described it as an array that’s supposed to hold one type of value getting swapped for another, which opens the door to reading and writing memory it shouldn’t touch.
Once an attacker can do that, a single crafted HTML page is enough to run code inside Chrome’s sandbox without you clicking anything except the link that loaded the page. Researchers rated it 8.8 out of 10 on the CVSS severity scale, which is high but not maximum: it’s serious because it needs no user interaction beyond visiting a page, though it’s contained to the sandbox rather than an instant full system takeover on its own.
How Attackers Are Already Using This Chrome Bug
Google’s own advisory is unusually blunt and unusually thin at the same time: “Google is aware that an exploit for CVE-2026-85046 exists in the wild.” That’s the entire technical disclosure. No details on who’s behind it, which campaigns are using it, or what the end goal looks like.
That silence is deliberate, not evasive. Publishing exploit specifics before most users have patched would hand a working blueprint to every other attacker who hadn’t already figured it out. A sandbox escape like this one is also rarely the whole attack; it’s usually the first link in a chain, paired with a second bug that breaks out of the sandbox entirely and onto the operating system itself. Patching Chrome closes off that first link before anyone can build the rest of the chain around it.
Which Chrome Version You Need (and How to Check It Fast)
Open chrome://settings/help (or Settings > About Chrome) and compare what you see against the table below. If your version number is lower, Chrome is already downloading the fix in the background; you just need to hit relaunch.
| Platform | Patched Version | What To Do |
|---|---|---|
| Windows | 152.0.7977.82 / .83 | Update in Settings, then relaunch |
| macOS | 152.0.7977.82 / .83 | Update in Settings, then relaunch |
| Linux | 152.0.7977.82 | Update via package manager or Settings |
| Edge, Brave, Opera, Vivaldi | Varies by vendor | Check each browser’s own update page over the next few days |
Chrome updates itself quietly in the background for most people, but the fix only kicks in after you relaunch. A browser window you haven’t closed in three weeks is still quietly running the vulnerable code underneath, no matter how new the installer file sitting in your Downloads folder is.
Your Other Browsers Aren’t Automatically Covered
Edge, Brave, Opera, and Vivaldi aren’t Chrome, but they’re all built on Chromium and use the same V8 engine underneath, so they inherit this exact flaw. Each of those companies has to build, test, and ship its own patch on its own schedule, which is why security researchers have noted those browsers can trail Chrome’s fix by a few days.
That gap matters more than it used to, because browsers increasingly act on your behalf instead of just displaying pages. Chrome’s own Gemini Auto Browse feature already lets the browser fill out forms and click through sites on its own for Android users on AI Pro or Ultra plans. A sandbox bug is riskier in a browser that’s been handed more autonomy, so if you’re using any Chromium-based browser with AI features switched on, check its update page directly rather than assuming it’s covered by Chrome’s fix.
Why This Is Chrome’s Sixth Zero-Day Patch of 2026
CVE-2026-85046 joins a list that already includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645, all patched earlier this year after Google confirmed active exploitation for each one. Six in a single year is a noticeably faster pace than Chrome’s typical annual count, and it says less about Chrome specifically than about how valuable browsers have become as targets.
Your browser is the one piece of software that touches nearly everything you do online, which makes a working exploit against it worth real money to whoever finds one first. It’s the same dynamic that made Windows 11’s own patch problems this month a headache for a different reason: operating systems and browsers are both under constant pressure to ship fixes fast, and fast fixes occasionally break something else on the way out the door. The difference here is that skipping this particular update is far riskier than installing it.
Frequently Asked Questions
Is my Chrome browser actually at risk from CVE-2026-85046?
Only if you haven’t restarted Chrome since the September 4, 2026 patch went out. Chrome auto-updates in the background, but the fix doesn’t take effect until you close and reopen the browser.
How do I check if I’ve already got the patched version?
Go to chrome://settings/help, or click the three-dot menu, then Help, then About Google Chrome. If you’re on 152.0.7977.82 or later, you’re safe; if not, Chrome will start updating the moment you open that page.
Does this affect Chrome on my Android phone or iPhone?
Google’s advisory focused on Windows, Mac, and Linux desktop builds. Mobile Chrome updates through the App Store or Google Play on its own schedule, so make sure automatic app updates are turned on and check for a pending Chrome update manually if you’re unsure.
Should I switch browsers because of zero-days like this?
Not really. Every major browser engine, including Firefox’s and Safari’s, has had comparable memory-safety bugs; switching just moves you to a different vendor’s patch schedule. Keeping automatic updates on and actually restarting your browser regularly matters far more than which browser you pick.
None of this means you need to panic about every browser update notification from now on, but this particular one is worth treating differently: it’s a live, confirmed exploit rather than routine maintenance. Close your tabs, let Chrome restart, and spend thirty seconds checking that your other Chromium-based apps are current too. That’s the entire fix, and it’s a lot cheaper than finding out later what the attackers were actually doing with it.
Leave a Reply