If you have not restarted Chrome in a few days, do it now. Google shipped an emergency patch on September 3 for a security flaw that attackers were already using against real targets before the fix ever went out.
What the Flaw Actually Does
The vulnerability, tracked as CVE-2026-85046, is a high-severity type confusion bug in V8, the JavaScript and WebAssembly engine that renders nearly every website you open in Chrome. A crafted HTML page can trick V8 into mishandling memory object types, giving an attacker arbitrary read/write access inside the browser sandbox. The attack surface is unusually wide: no file download, no extra click, and no software installation required, just a visit to a malicious or compromised web page.
The Government Deadline That Signals How Serious This Is
The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog within a day, giving Federal Civilian Executive Branch agencies until September 18 to patch. That KEV deadline is legally binding only for federal agencies, but security teams across the private sector routinely treat KEV additions as a de facto industry standard, since the catalog only includes fewer than one percent of all known CVEs — specifically the ones confirmed under active real-world attack.
This Is Chrome’s Sixth Zero-Day of the Year
CVE-2026-85046 marks the sixth actively exploited Chrome zero-day Google has patched since January 2026, and notably the third of those six to target the V8 engine specifically. Google’s structural defense is the V8 Sandbox, an isolation layer that has been active since Chrome 123, which forces attackers to chain together a separate sandbox-bypass exploit on top of a V8 bug — raising the difficulty bar, but clearly not high enough to stop determined, well-resourced attackers from finding a path through.
How to Actually Fix It
The patch ships in Chrome 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux and Android. To confirm you are protected, open Chrome, go to the three-dot menu, then Help, then About Google Chrome — the app checks for updates automatically on that screen, and you just need to hit Relaunch once it finishes. If you use a Chromium-based browser like Microsoft Edge, Brave, Opera, or Vivaldi, check for an update there too, since those browsers typically ship their own patch shortly after Google’s.
Bottom Line
Chrome runs on roughly 69% of the world’s devices, according to StatCounter, which is exactly why a bug like this gets patched, disclosed, and federally flagged within 24 hours rather than sitting quietly. Google has deliberately withheld deeper technical details on the exploit to avoid handing other attackers a blueprint, so the responsible move here is simple: don’t wait for the browser to auto-update on its own schedule, force the relaunch today.
FAQ
How do I know if my Chrome is already updated?
Open the three-dot menu, go to Help, then About Google Chrome. If your version number is 152.0.7977.82 or higher (or .83 on Windows/macOS), you already have the fix.
Am I at risk if I only browse trusted websites?
The risk isn’t limited to obviously sketchy sites. A legitimate website can be compromised and used to serve malicious code without the site owner’s knowledge, which is why patching promptly matters even for careful browsers.
Does this affect Chrome on mobile?
Yes, Android is included in the patched versions. Check for updates through the Google Play Store if your Chrome app hasn’t updated automatically.
