Google rolls out emergency patch for sixth active Chrome zero‑day of 2026

Google released a critical security update for its Chrome browser, addressing twelve separate vulnerabilities, including a high‑severity zero‑day in the V8 JavaScript engine that has been observed in the wild. The actively exploited flaw, catalogued as CVE‑2026‑85046, carries a CVSS score of 8.8 and could allow attackers to execute arbitrary code on a victim's machine simply by luring them to a malicious web page.

The update, made available to all supported Chrome versions, neutralises the V8 exploit by correcting the memory‑handling error that attackers were leveraging to gain code execution privileges. Google’s security advisory notes that the vulnerability was being used in targeted campaigns, underscoring the urgency of the patch.

This marks the sixth Chrome zero‑day reported to be actively exploited in 2026, highlighting a trend of increasingly sophisticated attacks against the world’s most popular web browser. Chrome’s market dominance makes it a lucrative target for threat actors seeking to reach a broad audience, and the V8 engine—responsible for running JavaScript—has repeatedly been a focal point for vulnerability research.

Google’s response follows its long‑standing practice of rapid vulnerability disclosure and remediation. The company’s Vulnerability Reward Program incentivises security researchers to report flaws, and many of the patches in the latest update stem from such coordinated disclosures. By issuing a blanket update rather than a phased rollout, Google aims to minimise the window of exposure for users who might otherwise remain vulnerable.

Security experts advise users to apply the update without delay, as the exploit does not require any user interaction beyond visiting a compromised site. Organizations are also urged to enforce automatic updates across managed devices and to monitor network traffic for signs of anomalous JavaScript activity that could indicate an ongoing exploitation attempt.

Looking ahead, analysts expect that the pressure on browser vendors will continue to rise as attackers refine techniques that bypass traditional defenses. Google has pledged to bolster Chrome’s sandboxing mechanisms and to accelerate the integration of mitigations such as Control Flow Guard and hardware‑based isolation, aiming to reduce the attack surface for future zero‑day discoveries.