Google has patched an actively exploited Chrome zero-day, and the fix has been available since 3 September. The flaw is tracked as CVE-2026-85046, a type confusion bug in V8, the JavaScript engine inside Chrome. In its release note for that day’s Stable update, Google states: “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”
The patched builds are 152.0.7977.82 and .83 for Windows and Mac, and 152.0.7977.82 for Linux. That release contains 12 security fixes in total. If your browser is sitting on an older build, this is one worth applying today rather than waiting for it to happen on its own.
What the Chrome zero-day does
CISA, the US cybersecurity agency, added CVE-2026-85046 to its Known Exploited Vulnerabilities catalogue on 4 September. Its entry describes a type confusion flaw that lets a remote attacker execute arbitrary code inside the sandbox using a crafted HTML page. In plain terms, visiting a malicious page is enough to trigger it. US federal agencies have been given until 18 September to patch, which is a reasonable signal of how seriously the bug is being treated.
The bug was reported by researcher Salvatore Gulizia on 4 August and earned a $1,000 bounty. Google’s release note adds that access to bug details and links may be kept restricted until a majority of users are updated with a fix. Assume the worst and update.
How to update Chrome
Chrome downloads updates in the background, but it only finishes installing them when you restart the browser. Plenty of people never close Chrome. If that is you, the patched version may already be on disk while you keep running the vulnerable one.
- Open Chrome and select More (the three dots, top right).
- Go to Help > About Google Chrome.
- Chrome checks for updates on this page. Select Relaunch to apply one.
- Confirm the version number shown is 152.0.7977.82 or higher.
If there is no Relaunch button, Google’s support page says you are on the latest version available to you. That is not the same as being patched: Google says the 3 September release rolls out over the coming days and weeks. If About shows a build below 152.0.7977.82 and offers no Relaunch, the update has not reached your machine yet, so check again rather than assuming you are covered. Your tabs and windows reopen automatically after the restart, though Incognito windows do not. On Linux, Chrome is updated through your package manager instead. On a Chromebook, you update Chrome by updating ChromeOS itself.
Edge users need to check too
Because Edge is built on Chromium, it inherits the same V8 flaw. Microsoft’s Edge security release notes list Stable version 152.0.4191.62, dated 2 September, and state that the update contains a fix for CVE-2026-85046. CISA’s entry names Chrome, Edge and Opera, and adds that the list is not limited to those, so update any other Chromium-based browser you use as well.
To update Edge, open Settings and more > Help and feedback > About Microsoft Edge, or type edge://settings/help in the address bar. If an update is waiting, select Download and install, then Restart.
None of this takes more than a minute. The uncomfortable part is that browser makers rely on you restarting, and many of us go weeks without doing so. Chrome’s move to a two-week release cycle makes patches arrive faster, but it does not close that gap. Restarting your browser is still the step only you can take.
Sources: Google Chrome Releases, Microsoft Edge security release notes, CISA Known Exploited Vulnerabilities catalog
