Google Deploys Chrome Patch to Close Actively Exploited V8 Zero-Day

Google announced on Thursday that it has issued a security update for its Chrome browser, addressing a total of twelve flaws, one of which is a high‑severity zero‑day that is currently being leveraged by attackers in the wild.

The most critical issue, catalogued as CVE-2026-85046, is a type‑confusion vulnerability in V8, Chrome’s JavaScript engine. With a CVSS rating of 8.8, the bug allows malicious code to manipulate memory structures, potentially leading to arbitrary code execution on affected systems.

V8 powers the execution of JavaScript across virtually every website visited with Chrome. Exploits that target this component typically involve crafted web pages that, when loaded, can run malicious scripts without the user’s knowledge. Because the vulnerability is actively exploited, threat actors can gain control of a victim’s browser session and, by extension, the underlying operating system.

In response, Google pushed the fix through all of Chrome’s release channels—stable, beta, and development—ensuring that automatic updates will deliver the patch to most users within hours. Enterprise administrators are also able to deploy the update via managed policies, reducing the window of exposure for corporate environments.

Chrome commands a dominant share of the global desktop browser market, making any unpatched weakness a significant risk to a broad user base. The rapid rollout mirrors Google’s historical approach to critical flaws, such as the 2021 “Spectre”‑related patches and the 2023 “ZeroLogon” remediation, underscoring the company’s commitment to a swift remediation cycle.

Security researchers who first observed the active exploitation reported the issue to Google under a coordinated disclosure framework. According to the advisory, the vulnerability was discovered in early September and confirmed to be in use by threat groups before the public announcement, prompting an accelerated patch timeline.

Users are advised to verify that their Chrome installation is up to date, either by checking the browser’s “About Chrome” screen or by allowing automatic updates to run. Organizations should prioritize the rollout across managed devices and consider additional mitigations, such as restricting script execution from untrusted sources.

Google has indicated that it will continue to monitor for related activity and stands ready to issue further updates if additional weaknesses are uncovered. The incident highlights the ongoing arms race between browser developers and attackers, reinforcing the importance of timely patch adoption and layered security strategies.