Google warns of new Chrome zero-day flaw exploited in attacks
Google Chrome addresses actively exploited zero-day flaw in V8 engine.
Run Chrome?
Get an email when a reviewed story names Chrome, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Google has released an update for Chrome to fix a high-severity zero-day vulnerability, CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine that has been exploited in the wild. This is the sixth actively exploited bug Google has patched in Chrome this year, highlighting ongoing threats to browser security. Users are urged to update their browsers promptly.
The lesson from this incident
Full lessonGoogle patched CVE-2026-85046, a high-severity type confusion flaw in Chrome's V8 JavaScript engine that was actively exploited before a fix was available, making it a zero-day vulnerability. This marks the sixth actively exploited Chrome vulnerability patched this year, underscoring that browsers are a persistent and high-value attack surface. Because zero-days are exploited before patches exist, the only defense after disclosure is rapid update deployment. Organizations that delay browser updates — even by days — leave users exposed to drive-by attacks, credential theft, and malware installation simply by visiting a compromised website.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-85046
- cve — CVE-2026-11645
- cve — CVE-2026-2441
- cve — CVE-2026-3909
- cve — CVE-2026-3910
- cve — CVE-2026-5281