Update Chrome Now: Google Patches an Exploited Zero-Day

What is the Chrome zero-day update?

The Chrome zero-day update fixes CVE-2026-85046, a high-severity type-confusion vulnerability in V8, the Chrome engine that handles JavaScript and WebAssembly. Google says an exploit for the vulnerability exists in the wild, which means the company knows the flaw has been used outside a controlled research setting.

Google released the security update on September 3, 2026, through Chrome Stable version 152.0.7977.82 for Linux and versions 152.0.7977.82/.83 for Windows and macOS. Google’s Chrome Stable release advisory lists CVE-2026-85046 among 12 security fixes. The practical response is to install the available update rather than waiting for Chrome’s staged rollout to reach every device automatically.

A zero-day is a security flaw that attackers can exploit before all users have had time to install a fix. The immediate concern is not whether a Chrome user noticed suspicious behavior, because security vulnerabilities often do not produce a visible warning. The important step is confirming that the installed browser version is no longer affected.

Which Chrome versions are affected by CVE-2026-85046?

Chrome versions earlier than 152.0.7977.82 are affected by CVE-2026-85046, according to the Canadian Center for Cyber Security. The advisory also confirms that CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 4, 2026, which signals that the flaw has been identified as actively exploited.

The version numbering differs slightly by operating system. Windows and macOS receive Chrome 152.0.7977.82 or 152.0.7977.83, while Linux receives Chrome 152.0.7977.82. The government security advisory identifies versions before 152.0.7977.82 as affected, so users should check the full version number instead of assuming that Chrome is current because the browser opened normally.

Chrome Stable updates roll out over days and weeks, according to Google. That rollout approach can mean two computers do not receive the update at the same moment. Checking Chrome manually is therefore the most sensible approach for users who want the security fix immediately.

How do you update Chrome and activate the security fix?

To update Chrome for CVE-2026-85046, open Chrome’s Settings menu and go to About Chrome, then restart the browser after the update finishes. The restart matters because the updated browser version does not fully take effect until Chrome closes and reopens.

1. Open Google Chrome on your Windows, macOS, or Linux computer.
2. Select the three-dot menu, then open Settings.
3. Open the About Chrome page to trigger the browser update check.
4. Install the available Chrome update if the page offers one.
5. Restart Chrome after installation completes.
6. Return to About Chrome and confirm the displayed version is 152.0.7977.82 or newer.

The manual update path is Settings > About Chrome, and a browser restart is required for the patch to take effect. Consumer update guidance confirms that users can trigger the update from Chrome’s About Chrome page. Stop and contact your organization’s IT support if Chrome is managed by an employer or school and the update option is unavailable.

Browser updates also work best when users avoid delaying restarts for long periods. A Chrome window left open after the update downloads may still be running the older browser version. Users concerned about broader web privacy should also understand how browser fingerprinting works, because software patching and privacy controls address different online risks.

Why is the V8 vulnerability considered serious?

CVE-2026-85046 is serious because Google classifies the vulnerability as high severity and says an exploit exists in the wild. The flaw affects V8, Chrome’s JavaScript and WebAssembly engine, which is a core browser component used to process web content.

A type-confusion vulnerability occurs when software handles one kind of data as though it were another kind. Google has not publicly provided further technical detail about the active exploitation in the release advisory. That limited disclosure is normal while users are still patching, but it also means users should not wait for a fuller technical explanation before updating.

The most important point is that the active-exploitation statement changes the urgency of an ordinary browser update. Chrome users do not need to determine whether they encountered a malicious site before applying the fix. Installing the current version reduces exposure to the disclosed vulnerability on the device.

What other Chrome security issues does version 152 fix?

Chrome version 152 fixes 12 security issues, including CVE-2026-85046 and several other high-severity vulnerabilities. Google lists a V8 race condition, an out-of-bounds write in WebGL, improper resource exposure in CacheStorage, a use-after-free issue in DevTools, a use-after-free issue in Skia, and type confusion in Compositing.

The additional fixes matter because a browser update is not limited to one named zero-day. Chrome processes websites, web applications, graphics, stored site data, and developer tools through multiple components, so the release addresses security issues across several areas of the browser.

Google lists Salvatore Gulizia, known as Serotav, as the reporter of CVE-2026-85046 on August 4, 2026, and lists a $1,000 reward for the report. Responsible disclosure rewards encourage researchers to report vulnerabilities to vendors so fixes can reach users. The practical action remains the same: update Chrome rather than treating the other listed flaws as less relevant.

How should Chrome users prioritize this update?

Chrome users should treat this as a high-priority browser update because the affected vulnerability is listed as high severity and has been added to CISA’s Known Exploited Vulnerabilities catalog. The catalog addition does not describe every affected user or attack method, but it provides an additional government-confirmed indicator that the vulnerability requires prompt attention.

Users who use Chrome for email, work portals, banking, shopping, school systems, or personal accounts should install the update as soon as the About Chrome page makes it available. The browser is often connected to important accounts, which makes timely software maintenance a basic part of account and device security.

Chrome updates do not replace careful account security practices. Users should still use unique passwords and available sign-in protections for important services. The recent move toward stronger account sign-in controls illustrates why browser security and account security need to work together rather than being treated as alternatives.

What should organizations and managed-device users do?

Organizations using managed Chrome devices should verify that deployed browser versions meet the fixed version threshold and ensure users restart Chrome after the update installs. Google says the Stable release rollout occurs over days and weeks, so administrators may need to confirm update availability across different systems rather than assuming all endpoints receive the release simultaneously.

Managed-device users should not attempt to bypass organizational update controls if Chrome does not offer the update directly. A workplace, school, or other managed environment may use centralized software policies, and support staff can confirm the approved update path. The appropriate stop line is the organization’s IT or security team when the browser remains below the fixed version after a normal update attempt.

Security teams should also distinguish this Chrome event from unrelated network-device vulnerabilities. For example, organizations handling critical UniFi security updates need separate remediation plans because browser updates and network-device updates use different management systems and affect different parts of the environment.

FAQ

Do I need to restart Chrome after updating?

Chrome requires a restart after the update installs for the security fix to take effect. Reopen Chrome and check Settings > About Chrome to confirm that the browser is running version 152.0.7977.82 or a newer available release.

Is CVE-2026-85046 being exploited?

CVE-2026-85046 is being exploited in the wild, according to Google’s September 3, 2026 security release. The Canadian Center for Cyber Security also confirms that CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 4.

What is Chrome V8?

Chrome V8 is the browser engine that handles JavaScript and WebAssembly. CVE-2026-85046 is a type-confusion vulnerability in V8, which is why Chrome users should install the current Stable update promptly.

Which Chrome version fixes the zero-day?

Chrome version 152.0.7977.82 fixes the disclosed zero-day on Linux, while Windows and macOS receive version 152.0.7977.82 or 152.0.7977.83. Chrome versions earlier than 152.0.7977.82 are affected, according to the government advisory.

Can I update Chrome manually?

Chrome users can update manually by opening Settings > About Chrome, which triggers the browser update check. Restart Chrome after the installation finishes because the updated version does not take effect until the browser relaunches.