Google just pushed out an emergency Chrome update. There's a vulnerability being actively exploited right now. If you haven't updated your browser yet, stop reading and do it.

The vulnerability is CVE-2026-85046. It has a CVSS score of 8.8. That's high. It's a type confusion bug in V8 Chrome's JavaScript and WebAssembly engine. An attacker can run code on your machine just by tricking you into visiting a malicious webpage.

Yeah, it's that bad.

Here's what you need to know.

Quick Summary

So What's the Problem?

The bug is a type confusion flaw in V8. In effect, the engine becomes lost when trying to distinguish what type of information is being processed. That leads to memory corruption. And that leads to code execution.

Security researcher Salvatore Gulizia found the bug on August 4, 2026. He explained it as a "V8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arbitrary read/write on the JavaScript heap."

Translation: the bug tricks V8 into misclassifying an array. That gives the attacker the ability to read and write memory. From there, they can run any code they want.

Gulizia got a $1,000 bug bounty for finding it.

How the Exploit Works:

• Attacker creates a malicious webpage
• You visit it
• The page triggers the type confusion bug
• Attacker reads and writes JavaScript heap memory
• Attacker executes code on your machine

It's Happening Right Now

Google confirmed that someone is already using this exploit in the wild. Attackers are actively targeting Chrome users.

Google didn't share details about the attacks. That's standard practice. They want to give people time to update before revealing more information.

This Is the Sixth Chrome Zero-Day in 2026:

• CVE-2026-2441
• CVE-2026-3909
• CVE-2026-3910
• CVE-2026-5281
• CVE-2026-11645
• CVE-2026-85046

Six actively exploited bugs in one year. That's a lot.

How to Fix It

The Fix:

Update to Chrome version 152.0.7977.82. For macOS, it's 152.0.7977.82/.83.

How to Update:

• Open Chrome
• Click the three dots in the top right
• Go to Help > About Google Chrome
• Chrome will check for updates automatically
• Click Relaunch when it's done

Other Browsers:

If you use Edge, Brave, Opera, or Vivaldi, update those too. They all use the same V8 engine.

What This Means for You

• Attackers can run code on your computer
• You don't have to click anything
• Just visiting a bad website is enough
• It's being exploited right now

What to Do:

• Update Chrome immediately
• Don't wait
• Update other Chromium browsers

The Bottom Line

Google patched a Chrome zero-day that's being actively exploited. Update to version 152.0.7977.82 now. Don't delay.

What You Need to Know:

What You Need to Do:

• Update Chrome to 152.0.7977.82
• Restart Chrome
• Update other Chromium browsers

FAQ Section

What is CVE-2026-85046?

A type confusion bug in Chrome's V8 engine. It lets attackers run code on your machine via a malicious webpage.

Is it being exploited?

Yes. Google confirmed active exploits in the wild.

What versions are affected?

Versions before 152.0.7977.82.

How do I update?

Go to More > Help > About Google Chrome and click Relaunch.

How many Chrome zero-days this year?

Six.

What is type confusion?

When a program gets confused about what type of data it's dealing with. Leads to memory corruption.

What is V8?

Chrome's JavaScript and WebAssembly engine.

Should I update other browsers?

Yes. Edge, Brave, Opera, and Vivaldi all use V8.

Source: The Hacker News