Chrome CVE-2026-85046: update now, then check the version
Google patched an actively exploited V8 bug in Chrome 152.0.7977.82/.83. Update on your computer, relaunch, and confirm chrome://version before you assume you are done.
Michael Narehood
If you use Google Chrome on your own computer, update it today. Do not wait for “whenever Chrome feels like it.”
On September 3, 2026, Google’s Stable Channel Update for Desktop shipped Chrome 152.0.7977.82/.83 for Windows and Mac, and 152.0.7977.82 for Linux. The release includes about a dozen security fixes. One of them, CVE-2026-85046, is High severity, and Google says an exploit already exists in the wild. That is the difference between a routine browser bump and a same-day “get this done” update.
What CVE-2026-85046 is
Google describes CVE-2026-85046 as type confusion in V8, Chrome’s JavaScript and WebAssembly engine. Severity is High. Salvatore Gulizia (Serotav) reported it on 2026-08-04. Google’s advisory states it is aware that an exploit for CVE-2026-85046 exists in the wild.
Practically: a crafted web page can hit the bug while you browse. You do not need a shady email attachment for that class of risk. A link, an ad, or a compromised site is enough if Chrome is still on the old build.
Security Affairs noted this as the sixth actively exploited Chrome zero-day of 2026. That is useful calendar context only. For the CVE wording and fixed builds, prefer Google’s own Stable update post above.
Fixed builds and how to verify
Target builds from the September 3 Stable note:
- Windows / Mac: 152.0.7977.82 or 152.0.7977.83
- Linux: 152.0.7977.82
Google rolls Stable out over coming days and weeks. Chrome can download an update while you keep browsing on the old process. The new code does not protect you until you relaunch and the new build is actually running.
Verification is not “Chrome said it updated.” Open chrome://version in the address bar and read the version line. You want at least 152.0.7977.82 (or .83 on Windows/Mac). If the number is older, you are not done.
Do this now
- Open Chrome on the computer you actually use for the web.
- Go to Help → About Google Chrome (on Mac: Chrome → About Google Chrome). Let it check for updates and finish the download.
- Relaunch when prompted. Do not click “Later” and walk away. Tabs can wait; this fix should not.
- Confirm with
chrome://version. Look for 152.0.7977.82 or .83 (Linux: .82). - Repeat on other computers you use, including a laptop that stays open for days and a shared family PC if anyone else browses there.
- If you also use Edge, Brave, or another Chromium browser, update those separately. They ship their own builds. Updating Chrome does not update Edge.
Do not do this
- Do not assume a computer restart alone applied the new Chrome build if
chrome://versionis still behind. - Do not wait until next weekend when Google has already said an exploit exists in the wild.
- Do not confuse “update downloaded” with “new Chrome is running.” Leaving old windows open keeps the old build alive.
- Do not skip the version check because the About page looked green. The address-bar check is the proof.
A note on “Chrome updates itself”
Chrome usually downloads updates in the background. That habit is good. It is not the same as “I am already patched for this CVE.” After a High severity fix with an exploit in the wild, take two minutes, force the check, relaunch, and read chrome://version. Then go back to your tabs.
Bottom line
CVE-2026-85046 is a High V8 type confusion bug with an exploit in the wild, fixed in Chrome 152.0.7977.82/.83 (Linux .82). Update Chrome on your computer, relaunch so the new process actually runs, verify with chrome://version, and do the same for any other Chromium browser you use. That is the whole job for today.
