Google has released a new Chrome security update to fix an actively exploited high-severity zero-day vulnerability in its V8 JavaScript engine, along with 11 other security flaws.
The zero-day, tracked as CVE-2026-85046, is a type confusion vulnerability discovered by security researcher Salvatore Gulizia, also known online as “Serotav.” Google confirmed that an exploit for the flaw is already being used in attacks in the wild.
The update moves Chrome to version 152.0.7977.82/.83 on Windows and macOS, while Linux users receive version 152.0.7977.82. Google is rolling out the update gradually.
Google has not released technical details about how the zero-day is being exploited, giving users and other projects time to install the security fix. Type confusion vulnerabilities can cause software to incorrectly handle objects in memory, potentially allowing attackers to corrupt memory and execute malicious code.
Because V8 handles JavaScript and WebAssembly code inside Chrome, the vulnerability could potentially be triggered through a specially crafted webpage containing malicious JavaScript. Successful exploitation could allow an attacker to execute code within Chrome’s sandboxed renderer process.
The update also fixes nine other high-severity vulnerabilities, including use-after-free and out-of-bounds memory bugs affecting Chrome components such as Crash Reporting, Network, Compositing, WebGL, CacheStorage, DevTools and Skia, as well as a V8 race condition.
CVE-2026-85046 is the sixth Chrome vulnerability confirmed to have been actively exploited this year. Previous Chrome zero-days fixed in 2026 include vulnerabilities in V8, CSS font handling, Skia, and WebGPU’s Dawn component.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Chrome users are advised to install the update as soon as it becomes available by opening Settings, selecting About Chrome, and allowing the browser to download and install the latest version. A restart is required after the update. Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera and Vivaldi should also install their respective security updates when available.
