Google has released a Chrome security update after confirming that an exploit for CVE-2026-85046 exists in the wild. The flaw is in V8, Chrome’s JavaScript engine, so a crafted web page can be the delivery surface. Because Google rolls updates out gradually, seeing an update notice is not enough: install it, relaunch Chrome, and verify the version shown in the browser.
September 20 update: a second V8 fix and BlueMoon
Chrome users should install the latest available release, not stop at the September 4 versions listed below. Google’s September 8 desktop release fixed the exploited CVE-2026-87491: 153.0.8010.36/.37 on Windows and macOS, and 153.0.8010.36 on Linux. These are historical minimums for that fix, not a claim that they are today’s latest builds.[8]
Proofpoint’s September 9 investigation links CVE-2026-85046 and CVE-2026-87491 to BlueMoon, used by four espionage groups. Browser code execution leads to a V8 sandbox escape, then a Windows-version check. On certain older Windows builds, CVE-2026-85880 enables further privilege escalation and payload execution. This is not a universal Windows compromise.[9]
The revealing gap: upstream Chromium fixes existed before stable browser updates reached users. Proofpoint suspects attackers adapted those patches; AI-assisted development remains unproven. Update both browser and Windows, and investigate suspicious endpoint activity separately: patching cannot establish whether an earlier attack succeeded.
Original September 4 version boundaries for CVE-2026-85046
For Chrome on desktop, Google lists 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. Chrome for Android is updated to 152.0.7977.82 and carries the same security fixes as the corresponding desktop release unless Google notes otherwise.[1][2]
| Browser | What to verify |
|---|---|
| Chrome desktop | Windows/macOS: 152.0.7977.82 or .83; Linux: 152.0.7977.82 |
| Chrome for Android | 152.0.7977.82 |
| Opera desktop | 135.0.5973.92 explicitly fixes CVE-2026-85046[4] |
| Vivaldi desktop | Vivaldi 8.2 with Chromium 152.0.7977.112[5] |
| Edge and Brave | Do not infer protection from Chrome’s number; install a vendor update that explicitly incorporates the fix |
The version boundary is vendor-specific. At the time of publication, Microsoft’s official Edge security notes listed Stable 152.0.4191.62 from September 2 but did not name CVE-2026-85046.[6] Brave’s release page listed desktop 1.94.119 with Chromium 152.0.7977.76, also from September 2.[7] Users of those browsers should check for a newer vendor release rather than treating Chrome’s update as proof that their browser is fixed.
What CVE-2026-85046 can do
CVE-2026-85046 is a high-severity type confusion vulnerability in V8. CISA says a remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. Google says it is aware that an exploit exists in the wild, and CISA added the issue to its Known Exploited Vulnerabilities catalog on September 4.[1][3]
The initial Google and CISA advisories established active exploitation without naming a campaign or confirming a sandbox escape. The later BlueMoon findings above add campaign context; they do not establish a victim count or prove that every outdated browser was attacked. Simply finding an older Chrome version does not prove that a device was compromised. The update closes the known browser-level path; it cannot tell you whether an exploit ran earlier or remove an unknown follow-on payload.
How to update Chrome and verify the build
- Open Chrome’s menu and choose Help → About Google Chrome.
- Let Chrome download the available update, then choose Relaunch.
- Open About Google Chrome again. Confirm that the displayed version is the latest available for your operating system; the older version boundaries below are historical.
- If the version is still older, repeat the check. On a managed device, contact the administrator if policy prevents the update.
On Android, update Chrome from Google Play and then check the app version in Chrome’s settings or the system app-information page. Never install an “emergency Chrome update” offered by a pop-up or an unrelated download site.
What Chromium-browser users should do
Chrome, Edge, Brave, Opera, and Vivaldi share Chromium code, but they do not share identical public version numbers or release timing. Opera and Vivaldi have published releases that cross the fixed Chromium boundary. Edge and Brave users should use their own browser’s update control and vendor release notes. Do not try to install a Chrome package into another browser.
This is also distinct from the earlier Chrome CVE-2026-11645 zero-day. Both incidents make the same operational point: the browser must be restarted and the installed build checked after an emergency update.
If you used an older build
Update first. Use the campaign evidence in the later Proofpoint report when investigating a suspected targeted attack; a browser-history entry alone is not evidence of exploitation. If a site downloaded a suspicious file, do not open it; you can submit that file to the Gridinsoft Online Virus Scanner from a safe device.
Escalate the check if you also see an unexpected extension, an unrecognized download, a new account-session alert, or endpoint-security detection after browsing. Preserve the download list and relevant history, inspect installed extensions, and run an endpoint scan. If an active compromise is suspected, disconnect the affected device and review account sessions from a clean one. For managed fleets, inventory installed browser builds and enforce the vendor update; CISA’s September 18 due date applies to US federal civilian agencies, not as a universal consumer deadline.[3]
References
- Google Chrome Releases. Stable Channel Update for Desktop. Accessed September 20, 2026.
- Google Chrome Releases. Chrome for Android Update. Accessed September 20, 2026.
- CISA. Known Exploited Vulnerabilities Catalog. Accessed September 20, 2026.
- Opera Desktop. Opera 135.0.5973.92 Stable update. September 4, 2026. Accessed September 20, 2026.
- Vivaldi. Minor update for Vivaldi Desktop 8.2. September 4, 2026. Accessed September 20, 2026.
- Microsoft Learn. Release notes for Microsoft Edge Security Updates. Accessed September 20, 2026.
- Brave. Brave Release Notes. Accessed September 20, 2026.
- Google Chrome Releases. Stable Channel Update for Desktop. September 8, 2026. Accessed September 20, 2026.
- M. Kelly et al. Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain. Proofpoint, September 9, 2026. Accessed September 20, 2026.
