Google rushes out Chrome fix after hackers exploit V8 flaw in the wild

Key points

• Google shipped a Chrome update on Thursday patching 12 security flaws, one of which criminals are already exploiting.
• The actively exploited bug, CVE-2026-85046, sits in V8, Chrome's engine for running JavaScript and WebAssembly.
• Google rates the flaw high severity with a CVSS score of 8.8 out of 10.
• Users are safe once Chrome updates to version 152.0.7977.82 or later.
• Google hasn't said who is behind the attacks or how many people have been hit.

Google has pushed out an emergency Chrome update after discovering that attackers were already using one of the flaws to break into people's browsers.

The patched bug is tracked as CVE-2026-85046. It carries a severity score of 8.8 out of 10, which puts it firmly in the "fix today" category.

In plain terms, the flaw lets a booby-trapped web page run code on your computer that it shouldn't be allowed to run. All the victim has to do is visit the wrong site.

What exactly is broken?

The bug lives in V8, the engine inside Chrome that reads and runs JavaScript and WebAssembly code. It's what makes modern web pages interactive.

Google's advisory calls it a "type confusion" bug. That means V8 can be tricked into treating one kind of data as if it were another, and that mix-up hands the attacker a foothold inside the browser. From there, a well-crafted attack can run instructions on the visitor's machine.

Is this actually being used against people?

Yes. Google confirmed it's aware of an exploit for CVE-2026-85046 "existing in the wild," the phrase the company uses when real attackers, not just researchers, are abusing a flaw.

The advisory, first reported by The Hacker News, doesn't name the group behind the attacks or the targets. That silence is normal at this stage. Google usually holds back detail until most users have updated, so attackers can't reverse-engineer the fix and hit the stragglers.

Zero-days in V8, meaning flaws the maker didn't know about until they were already being exploited, are a favourite of both commercial spyware vendors and state-backed hacking crews. A single malicious link can be enough to break in. We first covered this CVE on 4 September 2026, and it's also the third Chrome security story we've run in the past month alone.

Which version fixes it?

The patched build is Chrome 152.0.7977.82 or later on desktop. Google is also shipping fixes for the 11 other flaws bundled into the same release.

Should you worry?

Only if you haven't updated yet.

Open Chrome, click the three dots in the top right, choose Help, then About Google Chrome. The browser will check for updates and download the fix. Restart when it asks. The same advice applies to Chromium-based browsers like Microsoft Edge and Brave once their makers ship matching updates.

If you manage a family member's laptop, do it for them. Zero-days in the browser are one of the most reliable ways criminals get onto home machines, because the victim only has to click a link in an email or a message.

Businesses running Chrome across a fleet of devices should push the update through their management tools today rather than waiting for the usual patch cycle. The real concern here isn't the patch itself, it's the gap between when Google confirmed active exploitation and when most users actually restart their browser.