Google has patched a dangerous Chrome vulnerability already being exploited in real-world attacks. The company fixed 12 vulnerabilities in the browser on September 3. Most of them were rated high severity by Google. However, one flaw stood out because attackers were actively using it.
The exploited bug is tracked as CVE-2026-85046. It is a type confusion flaw in V8, Chrome’s JavaScript and WebAssembly engine. The vulnerability carries a serious CVSS score of 8.8. Essentially, it lets a remote attacker run malicious code through a crafted web page. Crucially, simply loading that page can trigger the attack with no further user action.
Understanding the flaw helps explain its danger. Type confusion happens when software misinterprets one memory object as another type. According to the researcher’s own write-up, an array meant to carry one internal map instead received another. That mismatch grants attackers arbitrary read and write access on the JavaScript heap. Consequently, they can run code inside Chrome’s sandboxed renderer process.
This marks the sixth actively exploited Chrome zero-day this year. Notably, it is the third to directly target the V8 engine. Analysts say this pattern points to organized, sustained research against the browser. After all, Chrome serves over three billion users worldwide, creating an enormous attack surface.
The update also addressed nine other high-severity vulnerabilities. These included use-after-free and out-of-bounds memory flaws across several components. Affected areas included Network, WebGL, DevTools, and the Skia graphics library. Google also patched a race condition in V8 during the update.
The fix arrives in specific Chrome builds. Users should update to versions 152.0.7977.82 or .83 immediately. Importantly, the rollout is gradual rather than instant for everyone. The threat also extends beyond Chrome alone. Every Chromium-based browser inherits this same underlying flaw. Therefore, Edge, Brave, Opera, and Vivaldi all need updating too.
US authorities have already responded formally. On September 4, the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog. This requires federal agencies to patch by September 18. For Pakistani users, the fix remains simple: update Chrome and restart it promptly.
