Critical Chrome 0-Day CVE-2023-XXXX Actively Exploited

Key Takeaways

• Google has issued an urgent security update for Chrome, addressing a critical zero-day vulnerability, CVE-2026-85046.
• The flaw, a type confusion issue in the V8 JavaScript engine, is currently being exploited in real-world attacks.
• All desktop users of Chrome on Windows, macOS, and Linux are affected and must update immediately.
• The fix is included in Chrome Stable version 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux.

Emergency Chrome Update Addresses Actively Exploited Zero-Day

Google has deployed an emergency security patch for its Chrome browser, targeting a critical zero-day vulnerability, identified as CVE-2026-85046, that is currently under active exploitation by malicious actors. The update is crucial for all desktop users to mitigate immediate threats.

Details of the Vulnerability

The newly patched vulnerability, CVE-2026-85046, is categorized as a high-severity type confusion flaw within Chrome’s V8 JavaScript and WebAssembly engine. This engine is responsible for processing web content, making it a prime target for attackers seeking to compromise browser integrity.

Type confusion vulnerabilities arise when a software program misinterprets the data type of a piece of information, leading to unexpected memory handling errors. In a browser context, such errors can be particularly dangerous. Exploiting this flaw could allow an attacker to craft specialized JavaScript or web content that manipulates Chrome’s memory operations.

Depending on the specific exploit chain, successful exploitation could result in various severe consequences, including browser crashes, unauthorized data exposure, or even the execution of arbitrary code within the browser’s process. The primary vector for such an attack typically involves a victim simply navigating to a malicious or compromised website. Attackers may also leverage phishing emails, malicious advertisements, social media messages, or compromised legitimate websites to deliver exploit links.

Security researcher Salvatore Gulizia, known as Serotav, discovered and reported the vulnerability to Google on August 4, 2026, for which they received a $1,000 bug bounty reward.

The Security Patch and Broader Fixes

The emergency update elevates Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS users, and 152.0.7977.82 for Linux users. Google has indicated that the rollout will proceed incrementally over the coming days and weeks.

This Chrome update encompasses a total of 12 security fixes. Beyond the critical zero-day, several other high-severity issues have been addressed across vital browser components. These include a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws impacting Compositing, DevTools, and Skia, and another type confusion issue within Compositing, along with vulnerabilities in Network, CacheStorage, and CrashReporting.

Google has opted to restrict public access to detailed information about some of these vulnerabilities. This strategic decision aims to minimize the window of opportunity for threat actors to reverse-engineer the patches and develop new exploit code before a substantial portion of the user base has updated their browsers.

What You Should Do

• Update Chrome Immediately: Open your Chrome browser, navigate to the menu (three dots), select “Help,” then “About Google Chrome.” The browser will automatically check for and download the latest update.
• Relaunch Browser: After the update downloads, relaunch Chrome to ensure all security fixes are fully applied.
• Enterprise Management: For organizations, ensure all managed endpoints running Chrome are updated to version 152.0.7977.82 or later.
• Monitor for Suspicious Activity: Security teams should actively monitor endpoint telemetry and web-filtering logs for any indicators of suspicious browser activity, particularly those related to phishing campaigns utilizing newly registered domains or deceptive update prompts.
• Do Not Delay: Given the active exploitation of CVE-2026-85046, delaying this update leaves systems vulnerable to known attack vectors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.