Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild

Google has issued an urgent security update for its Chrome browser to patch a critical zero-day vulnerability, tracked as CVE-2026-85046, which is already being actively exploited by attackers. The vulnerability resides in the V8 JavaScript and WebAssembly engine, a core component responsible for processing web content. Google has confirmed awareness of in-the-wild exploits, emphasizing the immediate need for all Chrome desktop users to update their browsers.

The flaw is described as a high-severity type confusion vulnerability within the V8 engine. Type confusion bugs arise when software misinterprets data types, which can lead to memory corruption. In the context of a web browser, such errors can be exploited by attackers who craft malicious JavaScript or web content. This can potentially result in browser crashes, sensitive data exposure, or, most critically, the execution of arbitrary code on the victim's system. The attack vector typically involves tricking users into visiting a compromised or specially designed malicious website.

While Google has not disclosed specific details regarding the attacks, the affected parties, or the threat actors involved, the confirmation of active exploitation makes this a high-priority patch. The update brings Chrome Stable to version 152.0.7977.82 for Windows and macOS, and 152.0.7977.82 for Linux. The rollout will be gradual, occurring over the coming days and weeks.

This vulnerability was reported by security researcher Salvatore Gulizia, also known by the handle Serotav, on August 4, 2026. Google acknowledged the report with a $1,000 bug bounty. The current update addresses a total of 12 security fixes, including several other high-severity issues impacting critical browser components such as WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting. Notable among these are a race condition in V8 and various use-after-free vulnerabilities.

To protect against potential exploitation, Google is intentionally limiting the public disclosure of detailed vulnerability information until a majority of users have applied the update. This strategy aims to prevent attackers from quickly reverse-engineering the patches and developing new exploit code before systems are secured. Users are strongly advised to update their Chrome browsers immediately.

Updating Chrome is a straightforward process. Users can navigate to the browser's menu, select 'Help,' and then choose 'About Google Chrome.' The browser will automatically check for and download the latest version. A relaunch of the browser is necessary to ensure the security patches are fully applied. Enterprise administrators are urged to ensure that all managed endpoints are updated to the latest stable version.

Security teams should remain vigilant and monitor network and endpoint logs for any suspicious browser-related activity. This includes tracking communications with newly registered domains or unusual prompts related to software updates, which could be indicators of exploitation attempts. Given that CVE-2026-85046 is actively exploited, any delay in patching leaves systems vulnerable to a known and dangerous attack path.

This incident underscores the persistent threat posed by zero-day vulnerabilities, particularly in widely used software like web browsers. The rapid exploitation of such flaws highlights the critical importance of timely patching and robust security practices for both individual users and organizations to mitigate the risk of cyberattacks.

This latest report from The Hacker News provides further technical details on CVE-2026-85046, including the specific CVSS score of 8.8 and the mechanism of type confusion within the V8 JavaScript engine. It also credits security researcher Salvatore Gulizia for discovering the flaw and notes the $1,000 bug bounty awarded for its responsible disclosure.