Chrome Zero-Day CVE-2026-85046: Update Your Browser Now
Google has released a Chrome update for an actively exploited V8 flaw. Desktop users should restart into the fixed build, while people using other Chromium-based browsers should watch for their vendor's update.
The short version
What you need to know
- Google's stable-channel notice lists CVE-2026-85046 as a high-severity type-confusion flaw in Chrome's V8 engine and includes it among 12 security fixes.
- The fixed desktop versions are 152.0.7977.82/.83 for Windows, 152.0.7977.82 for Linux and 152.0.7977.82/.83 for macOS, with rollout occurring over the coming days and weeks.
- A VPN can protect traffic on an untrusted network, but it cannot patch Chrome, inspect a malicious page safely or stop code that exploits the browser. Updating and relaunching are the relevant actions.
What did Google patch?
Google released a desktop Chrome update containing 12 security fixes. Its advisory identifies CVE-2026-85046 as a high-severity type-confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chrome.
The Hacker News reports that Google acknowledged an exploit for CVE-2026-85046 exists in the wild. Google has restricted detailed bug information while users update, so the public notices do not establish who was targeted, how broad the attacks are or which sites may have delivered them.
Which Chrome versions contain the fix?
Google lists Chrome 152.0.7977.82/.83 for Windows and macOS, and 152.0.7977.82 for Linux. The update is rolling out rather than reaching every device at the same moment.
Open Chrome's menu, choose Help and then About Google Chrome. Let the update complete and select Relaunch. Simply leaving an updated browser package waiting in the background is not the same as running the new version, so confirm the version after Chrome restarts.
What Chromium users should check
Microsoft Edge, Brave, Opera, Vivaldi and other Chromium-based browsers share parts of the underlying engine but ship updates on their own schedules. Check the browser's official update page and installed version rather than assuming a Chrome release has already protected every Chromium browser.
Managed-device users should follow their organisation's deployment process and report a browser that cannot update. Avoid unofficial installers or search adverts promising an emergency patch; use the browser's built-in updater or the vendor's typed, official address.
Where a VPN helps — and where it does not
A reputable VPN can encrypt supported traffic between your device and the VPN provider, reducing local-network snooping on hotel, airport or café Wi-Fi. That network layer remains useful, but it is separate from code running inside the browser.
A VPN cannot repair V8, make a crafted page harmless, remove malware or determine whether Chrome has relaunched into a fixed build. Keep the browser and operating system updated, remove extensions you do not need and treat unexpected download or update prompts as suspicious.
VPN Rocks view
An actively exploited browser flaw is a patch-now event, not a reason to buy another security product. The highest-value step is to verify the installed version after restarting, then repeat that check across other browsers and devices you actually use.
Privacy tools work in layers. A VPN can limit network visibility, while browser updates close implementation flaws. Confusing those jobs leaves a gap even when both products are otherwise reputable.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.
