Google has issued an emergency security update for Chrome 152, patching yet another actively exploited zero-day vulnerability. This marks the sixth Chrome zero-day of 2026, and it’s being used in real-world attacks right now. If you browse the web with Chrome — and most people do — this one needs your attention immediately.

What’s the Vulnerability?

Tracked as CVE-2026-85046, this is a high-severity type confusion vulnerability in Chrome’s V8 JavaScript and WebAssembly engine. Type confusion bugs occur when the program incorrectly assumes an object is of one type when it is actually another. In a JavaScript engine like V8, this can be exploited to perform arbitrary read and write operations on memory.

The vulnerability was reported by security researcher Salvatore Gulizia, who received a $1,000 bug bounty. Google’s advisory confirms that an exploit exists in the wild.

How It Works

Type confusion in V8 can be triggered by a crafted HTML page. When a victim visits the malicious page, the exploit can:

• Read sensitive data from browser memory
• Write arbitrary data to memory locations
• Potentially achieve remote code execution

Because Chrome runs with sandbox protections, attackers would likely chain this with a second sandbox escape vulnerability for maximum impact. But the fact that it’s already being exploited means someone has figured out how to weaponize it.

Affected Versions

All Chrome users on Windows, macOS, and Linux are affected prior to the following versions:

• Windows and macOS: 152.0.7977.82/.83
• Linux: 152.0.7977.82

Six Zero-Days and Counting

This is the sixth Chrome zero-day patched in 2026. The previous five were CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. That’s roughly one zero-day every six weeks — a pace that should concern anyone who relies on Chrome for daily work. While Google has responded quickly to each, the frequency highlights the growing complexity of securing a modern browser engine.

What You Should Do

This is straightforward:

1. Update Chrome immediately. Go to Settings > About Chrome, or type chrome://settings/help in the address bar. Chrome will check for updates and prompt you to relaunch.
2. Relaunch the browser. The update doesn’t take effect until you restart Chrome.
3. Verify the version. After relaunch, check that you’re on version 152.0.7977.82 or later.
4. Restart all browser instances. If you have multiple Chrome windows or profiles open, close and reopen all of them.

Broader Context

This patch comes amid a record-breaking Patch Tuesday season. Microsoft’s August 2026 update fixed 398 CVEs, the second-largest in history. AI-assisted vulnerability discovery is accelerating the pace of findings, and while defenders get more CVEs to patch, attackers are getting faster at weaponizing them. The window between disclosure and exploitation is shrinking.

Chrome’s auto-update mechanism is one of the best in the industry — if users allow it to work. Don’t delay the restart. Every minute you postpone is a window for attackers.