Billions Of Chrome Users Urged To Update Now Over $1K 0-Day Flaw

by Paul Lilly — Friday, September 04, 2026, 08:57 AM EDT

Google Chrome logos — Zero-day flaw in Chrome is under active attack - Image: Pixabay (geralt)

Google has issued an emergency security update for desktop Chrome users across Windows, Mac, and Linux to address a dozen high- and medium-severity vulnerabilities. One of them is a zero-day flaw that Google confirms is being actively exploited in the wild (again).

Tracked as CVE-2026-85046, Google lists the zero-day as a Type confusion in Chrome's V8 engine. This is when the browser engine misinterprets the data type of a variable or object in memory.

In simple terms, JavaScript engines like V8 assign memory to store different kinds of data, such as an integer, a string, or a complex program object. A type confusion bug occurs when the engine gets tricked into treating one type of memory object as if it were a completely different type.

When that happens, a malicious script can read or write outside its intended memory boundary. Attackers exploit this confusion to bypass Chrome's security sandbox to crash the browser or, even worse, remotely execute arbitrary code on the victim's system. This can happen simply by visiting a compromised webpage.

More than just a theoretical threat, Google says it is "aware that an exploit for CVE-2026-85046 exists in the wild." Reported by security researcher Salvatore Gulizia, the high-severity security flaw earned him a $1,000 payday as part of Google's bug bounty program.

Here is the full list of flaws addressed in the latest Chrome update:

High CVE-2026-85046: Type confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-04
High CVE-2026-85052: Out of bounds read in CrashReporting. Reported by Google on 2026-04-13
High CVE-2026-85043: Incomplete cleanup in Network. Reported by Google on 2026-07-10
High CVE-2026-85048: Use after free in Compositing. Reported by Ngoc Hieu on 2026-07-29
High CVE-2026-85045: Race condition in V8. Reported by Brendan Dolan-Gavitt, XBOW on 2026-08-17
High CVE-2026-85050: Out of bounds write in WebGL. Reported by Google on 2026-08-20
High CVE-2026-85053: Improper resource exposure in CacheStorage. Reported by Salvatore Gulizia (Serotav) on 2026-08-26
High CVE-2026-85042: Use after free in DevTools. Reported by Google on 2026-08-26
High CVE-2026-85049: Use after free in Skia. Reported by Google on 2026-08-27
High CVE-2026-85051: Type confusion in Compositing. Reported by Google on 2026-08-27
Medium CVE-2026-85047: Improper input validation in Transactions Platform. Reported by Google on 2026-05-16
Medium CVE-2026-85044: Use of released resource in Mobile. Reported by Google on 2026-05-28

What makes Chrome so attractive to hackers is its massive install-base. According to StatCounter, Chrome accounts for over 73% of desktop browsers, which puts the potential reach for zero-day flaws and other vulnerabilities in the billions.

Google Chrome update window — Navigate to Help > About Chrome to update - Image: HotHardware

Google's patch updates Chrome to version 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux. You should receive it automatically, though we suggest manually updating instead of waiting around. To do that, click on the three vertcial dots in the top-right corner and navigate to Help > About Google Chrome to fetch the latest update. Once complete, you will need to relaunch Chrome.

Tags: Chrome, Google, security, Zero-Day, (nasdaq:goog)

Paul Lilly

Paul is a seasoned geek who cut this teeth on the Commodore 64. When he's not geeking out to tech, he's out riding his Harley and collecting stray cats.