Google Just Patched a Chrome Zero-Day Already Being Used in Attacks

Looks like Google is racing out another Chrome fix after finding a high-severity zero-day already being used in real attacks, so if you are still putting off that little update prompt, this is the one to grab.

BleepingComputer reports Google patched CVE-2026-85046, a type confusion bug in Chrome’s V8 JavaScript and WebAssembly engine, after researcher Salvatore Gulizia (“Serotav”) reported it. Google’s Stable Channel advisory is blunt about the risk: the company is aware an exploit for the bug exists in the wild, and it is holding back deeper technical details so people and other projects have time to update first.

Type confusion is the kind of flaw where the browser mishandles what an object really is, which can corrupt memory. In practice that can mean a nasty web page with crafted JavaScript trying to run code inside Chrome’s sandboxed renderer, which is more than enough reason to treat this like a same-day chore instead of something for next weekend.

The fix is rolling out in Chrome 152.0.7977.82/.83 on Windows and macOS, and 152.0.7977.82 on Linux, alongside patches for 11 other issues, including more high-severity memory bugs across Crash Reporting, Network, WebGL, Skia and another V8 race condition. BleepingComputer notes this is already the sixth actively exploited Chrome bug Google has fixed in 2026, which is exactly why Google is also moving Chrome to a two-week release cycle later this month to shrink that patch gap.

On a Mac or Windows PC, head to Settings, then About Chrome, wait for the download, and restart when it finishes. Edge, Brave, Opera and Vivaldi users should watch for their Chromium builds to catch up over the next couple of days, since those usually trail Google’s own Stable channel by a bit.