Google has released an urgent security update for Chrome after confirming that a high-severity vulnerability is already being exploited in the wild.
The flaw, tracked as CVE-2026-85046, affects Chrome’s V8 JavaScript engine. Google patched it as part of a September 3 update containing 12 security fixes. If you use Chrome on Windows, macOS or Linux, now is a good time to make sure your browser has actually updated.
What happened?
Google’s Chrome team says CVE-2026-85046 is a high-severity type confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome.
More importantly, Google says it is aware that an exploit for CVE-2026-85046 exists in the wild. That moves this beyond a theoretical security weakness: attackers have a working way to exploit the vulnerability.
The vulnerability was reported to Google on August 4 by security researcher Salvatore Gulizia, also known as Serotav.
Which versions of Chrome are safe?
Google’s September 3 Stable Channel update moved Chrome to:
- Windows and macOS: 152.0.7977.82/.83
- Linux: 152.0.7977.82
Google says the update is rolling out over the coming days and weeks. Android’s corresponding Chrome 152.0.7977.82 release also carries the same security fixes unless otherwise noted by Google.
If your desktop version is older than the patched builds above, it should be updated as soon as possible.
Why is CVE-2026-85046 dangerous?
Security advisories describe the vulnerability as a type confusion issue that can allow a remote attacker to execute arbitrary code inside Chrome’s sandbox through specially crafted HTML content.
In practical terms, vulnerabilities of this type can potentially be triggered when a user encounters malicious web content. Google has restricted access to detailed bug information while users receive the patch, a common practice intended to reduce the amount of useful technical information available to attackers before most devices are protected.
The UK’s NHS England Digital security advisory gives CVE-2026-85046 a CVSS 3.1 score of 8.8 and recommends applying Google’s update as soon as possible.
How to update Google Chrome
Chrome normally updates automatically, but an available update may still require the browser to be restarted before the new version is running.
- Open Google Chrome.
- Open the three-dot menu in the upper-right corner.
- Select Help, then About Google Chrome.
- Allow Chrome to check for and install available updates.
- Relaunch Chrome when prompted.
After Chrome restarts, check the About Chrome page again and confirm that your version is at least 152.0.7977.82/.83 on Windows or macOS, or 152.0.7977.82 on Linux.
What about Edge, Brave and other Chromium browsers?
Chrome’s V8 engine and Chromium code also underpin several other browsers. Users of Microsoft Edge, Brave, Opera, Vivaldi and other Chromium-based browsers should make sure their browser is fully updated as vendors incorporate relevant Chromium security fixes into their own releases.
The exact version numbers will differ from Chrome, so users should rely on the update mechanism and security advisories provided by their browser vendor rather than looking for Chrome’s version number.
Google fixed 12 Chrome security issues
CVE-2026-85046 is the standout issue because Google has confirmed an exploit exists in the wild, but it is not the only vulnerability fixed in this release.
Google says the update contains 12 security fixes, including other high-severity issues affecting components such as CrashReporting, Network, Compositing, V8, WebGL, CacheStorage, DevTools and Skia.
What should Chrome users do?
The important action is simple: update Chrome and restart it.
Automatic browser updates are useful, but they do not always mean the patched browser is already running. If Chrome has been left open for days with many tabs, a restart may still be needed to complete the update.
Because Google has confirmed active exploitation, this is one of those updates worth checking manually rather than assuming it will eventually take care of itself.
Source: Google Chrome Releases, September 3, 2026; NHS England Digital security advisory, September 4, 2026.
