Google rushes out Chrome fix after hackers exploit V8 flaw in the wild
A type confusion bug in Chrome's JavaScript engine is already being used in real attacks. Update your browser now.
Key points
- Google shipped a Chrome update on Thursday patching 12 security flaws, one of which criminals are already exploiting.
- The actively exploited bug, CVE-2026-85046, sits in V8, the part of Chrome that runs website code.
- Google rates the flaw high severity with a CVSS score of 8.8 out of 10.
- Users are safe once Chrome updates to version 152.0.7977.82 or later.
- Google has not said who is behind the attacks or how many people have been hit.
Google has pushed out an emergency Chrome update after discovering that attackers were already using one of the flaws to break into people's browsers.
The patched bug is tracked as CVE-2026-85046. It carries a severity score of 8.8 out of 10, which puts it firmly in the "fix today" category.
In plain terms, the flaw lets a booby-trapped web page run code on your computer that it should not be allowed to run. All the victim has to do is visit the wrong site.
What exactly is broken?
The bug lives in V8, the engine inside Chrome that reads and runs the JavaScript code found on nearly every website. It is what makes modern web pages interactive.
Google's advisory calls it a "type confusion" bug. That means V8 can be tricked into treating one kind of data as if it were another kind, and that mix-up hands the attacker a foothold inside the browser.
From there, a well-crafted attack can run instructions on the visitor's machine. Think of it as the website whispering commands the browser was never meant to obey.
Is this actually being used against people?
Yes. Google confirmed it is aware of an exploit for CVE-2026-85046 "existing in the wild," the phrase the company uses when real attackers, not just researchers, are abusing a flaw.
The advisory, first reported by The Hacker News, does not name the group behind the attacks or the targets. That silence is normal at this stage. Google usually holds back detail until most users have updated, so attackers cannot reverse-engineer the fix and hit the stragglers.
Zero-days in V8, meaning flaws the maker did not know about until they were already being exploited, are a favourite of both commercial spyware vendors and state-backed hacking crews. Both groups value them because a single malicious link can be enough to break in.
Which version fixes it?
The patched build is Chrome 152.0.7977.82 or later on desktop. Google is also shipping fixes for the 11 other flaws bundled into the same release.
| Detail | Value |
|---|---|
| CVE | CVE-2026-85046 |
| Component | V8 JavaScript engine |
| Bug class | Type confusion |
| CVSS score | 8.8 (high) |
| Fixed in | Chrome 152.0.7977.82 |
| Exploited in the wild | Yes |
What should ordinary users do?
Update Chrome. That is the whole job.
Open Chrome, click the three dots in the top right, choose Help, then About Google Chrome. The browser will check for updates and download the fix. Restart Chrome when it asks. The same advice applies to other browsers built on Chromium, including Microsoft Edge, Brave, Opera and Vivaldi, once their makers ship matching updates in the coming days.
If you manage a family member's laptop, do it for them. Zero-days in the browser are one of the most reliable ways criminals get onto home machines, because the victim only has to click a link in an email or a message.
Businesses running Chrome across a fleet of laptops should push the update through their management tools today rather than waiting for the usual patch cycle. Google's own numbering suggests this is the browser's response to an ongoing campaign, not a routine tidy-up.
