Google has rushed out a Chrome update to fix a security flaw that hackers were already using in real attacks. Tracked as CVE-2026-85046, the bug is a “type confusion” issue inside V8, the engine Chrome uses to run JavaScript and WebAssembly on every website you visit.
In plain terms, the flaw tricks Chrome into treating one type of data as another, which can corrupt memory and let an attacker run malicious code just by getting you to open a booby-trapped webpage. Google confirmed an exploit for the bug already exists in the wild, though it hasn’t shared who’s behind it or who’s been targeted.
This is the sixth actively exploited Chrome zero-day Google has had to patch in 2026 alone. Security researcher Salvatore Gulizia (known online as “Serotav”) reported the issue and was awarded a $1,000 bug bounty for the find.
The fix arrived as part of a broader update that also patches nine other high-severity bugs across Chrome’s networking, graphics, and developer tools components. The safe versions are 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux and Android.
How to update Chrome right now:
- Open Chrome and click the three-dot menu in the top-right corner.
- Go to Help > About Google Chrome.
- Chrome will automatically check for updates and start downloading the fix.
- Click Relaunch to finish installing it.
Chrome usually updates itself in the background, but if you haven’t relaunched your browser in a while, now’s a good time — this one’s worth doing today rather than waiting.