Chrome zero-day CVE-2026-85046 actively exploited via V8 type confusion

Affected Systems

Google Chrome versions prior to 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux). Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) also affected pending vendor updates.

Exploitation Status

Actively exploited in the wild. Exploit confirmed by Google. Technical details withheld. Likely triggered via malicious JavaScript in crafted HTML pages targeting V8 engine type confusion flaw.

Business Impact

Remote code execution possible within Chrome's sandboxed renderer process via drive-by compromise. Users visiting attacker-controlled or compromised websites are at risk. This is the sixth Chrome zero-day exploited in 2026, indicating sustained targeting of browser vulnerabilities. Immediate patching required to prevent compromise of endpoints running Chrome or Chromium-based browsers.

Urgency

🔴 Immediate

Recommended Actions

• Update Chrome immediately to version 152.0.7977.82 or later via Settings > About Chrome, then restart the browser to apply fixes.
• Deploy Chrome updates via enterprise management tools (e.g., Google Update for Business, SCCM, Intune) to ensure fleet-wide coverage within 24 hours.
• Monitor for updates to Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply patches as vendors release them over the next 2-3 days.
• Review web proxy and endpoint logs for suspicious JavaScript execution or renderer process crashes around the time of exploitation (correlate with threat intel on CVE-2026-85046).
• Consider blocking access to high-risk or untrusted websites until patching is complete, especially for high-value targets or unmanaged endpoints.