Google pushes emergency Chrome update to fix actively exploited V8 zero‑day and dozen other bugs

Google has issued an emergency update for its Chrome browser after confirming that a high‑severity zero‑day flaw in the V8 JavaScript engine is being weaponised by attackers. The patch, rolled out to all supported Chrome channels, also addresses eleven additional vulnerabilities that were disclosed alongside the primary issue.

The V8 vulnerability, rated as critical by Google’s internal security team, allows remote code execution by tricking a user into visiting a malicious web page. Because V8 powers the JavaScript execution layer in Chrome and other Chromium‑based browsers, the flaw could be leveraged to run arbitrary code on any system running an unpatched version of the browser.

Chrome commands a dominant share of the desktop and mobile web‑browser market, making any widespread exploit a significant threat to both individual users and enterprise networks. Zero‑day exploits—vulnerabilities that are unknown to the vendor until they are already being used—are relatively rare, and the fact that this one is confirmed to be active in the wild raises the urgency of the patch.

Google’s response has been swift: the fix is being pushed automatically through Chrome’s built‑in update mechanism, and users are urged to restart their browsers as soon as the update is applied. The company has also released the patch for its beta, dev and extended‑stable branches, ensuring that developers and organizations that lock to specific release channels receive protection without delay.

The issue was first highlighted by security outlet BleepingComputer, which reported that researchers had observed exploitation attempts targeting the V8 engine. While the specific threat actors have not been identified, the pattern of activity suggests a focused campaign aimed at harvesting credentials or installing additional malware on compromised machines.

Security experts emphasize that timely application of browser updates is one of the most effective defenses against web‑based attacks. Enterprises with managed devices should verify that automatic updates are enabled and consider deploying the patch through centralized management tools. Users on older operating systems or those who have disabled automatic updates remain especially vulnerable.

Google has pledged to publish a detailed advisory outlining the technical specifics of the flaw and the remediation steps taken. The incident underscores the ongoing arms race between browser developers and malicious actors, and it is likely to prompt further scrutiny of the V8 codebase. Analysts expect that additional patches may follow as the company continues to audit the engine for similar weaknesses.