Google has patched its sixth actively exploited Chrome zero-day of 2026, and this one landed on a U.S. government “attackers are already using this” list within a day of the fix shipping. If you use Chrome on Windows, Mac, or Linux, here’s what happened, why it matters, and how to make sure you’re actually protected.
What Happened
On September 3, 2026, Google published a Stable Channel update moving Chrome to version 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux. The release fixed 12 security issues in total. One of them, tracked as CVE-2026-85046, stood out: Google’s own advisory stated it was aware that an exploit for the flaw already existed in the wild, and the company withheld technical details about the bug to slow down further abuse while users update.
What Is CVE-2026-85046?
The vulnerability is a type confusion bug in V8, the engine that runs JavaScript and WebAssembly inside Chrome — essentially the part of the browser that executes code on nearly every website you visit. Type confusion happens when the browser misreads one kind of data as another, which can corrupt memory and, in the worst case, let an attacker run their own code inside Chrome’s sandbox simply by getting a victim to load a specially crafted webpage. It carries a CVSS severity score of 8.8, rated High. Security researcher Salvatore Gulizia (known online as Serotav) reported the bug to Google on August 4, 2026, and received a $1,000 bug bounty for the disclosure.
Why This One Got Extra Attention
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026, giving federal civilian agencies until September 18 to apply the patch. That directive technically only binds U.S. government agencies, but security teams generally treat a KEV listing as a signal that a flaw is being actively used against real targets, not just a theoretical risk. It’s also part of a pattern: Chrome has now had six actively exploited zero-days patched this year — in February, March (two flaws), April, June, and September — and every single one carried the same 8.8 severity rating, spread across V8, the Skia graphics library, and the Dawn WebGPU component.
How to Make Sure You’re Protected
Chrome updates itself automatically in the background, but the fix only takes effect after you relaunch the browser. To check your status:
- Click the three-dot menu in the top-right corner of Chrome.
- Go to Help > About Google Chrome.
- Chrome will show your current version and automatically download any pending update.
- Click “Relaunch” once it appears — the update won’t apply until you do.
Confirm your version reads 152.0.7977.82 or later (152.0.7977.83 on Windows and Mac is also current). If you use a Chromium-based browser like Microsoft Edge, Brave, or Opera, check that browser’s own update page separately — they typically ship their own patches shortly after Google’s fix, but the exact timing for each one isn’t something Google controls or confirms.
Final Thoughts
None of this requires special technical knowledge to fix — it’s a routine update, not a reason to panic. But with Google confirming real-world exploitation and a federal patch deadline attached, it’s worth the ten seconds it takes to check your Chrome version today rather than waiting for the browser to update on its own schedule.
FAQ
What is CVE-2026-85046?
A high-severity (CVSS 8.8) type confusion vulnerability in Chrome’s V8 JavaScript engine that Google confirms has been exploited in the wild.
Is this the first Chrome zero-day in 2026?
No — it’s the sixth actively exploited zero-day Google has patched in Chrome since the start of 2026.
How do I know if I’m protected?
Open Chrome’s menu, go to Help > About Google Chrome, and confirm your version is 152.0.7977.82 or later after relaunching the browser.
Do I need to do anything besides update?
No. Google withheld technical exploit details specifically so that updating is the complete fix for regular users.
