Google has released a Chrome security update after confirming that an exploit for CVE-2026-85046 exists in the wild. The flaw is in V8, Chrome’s JavaScript engine, so a crafted web page can be the delivery surface. Because Google rolls updates out gradually, seeing an update notice is not enough: install it, relaunch Chrome, and verify the version shown in the browser.
Which browser versions include the fix?
For Chrome on desktop, Google lists 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux. Chrome for Android is updated to 152.0.7977.82 and carries the same security fixes as the corresponding desktop release unless Google notes otherwise.[1][2]
| Browser | What to verify |
|---|---|
| Chrome desktop | Windows/macOS: 152.0.7977.82 or .83; Linux: 152.0.7977.82 |
| Chrome for Android | 152.0.7977.82 |
| Opera desktop | 135.0.5973.92 explicitly fixes CVE-2026-85046[4] |
| Vivaldi desktop | Vivaldi 8.2 with Chromium 152.0.7977.112[5] |
| Edge and Brave | Do not infer protection from Chrome’s number; install a vendor update that explicitly incorporates the fix |
The version boundary is vendor-specific. At the time of publication, Microsoft’s official Edge security notes listed Stable 152.0.4191.62 from September 2 but did not name CVE-2026-85046.[6] Brave’s release page listed desktop 1.94.119 with Chromium 152.0.7977.76, also from September 2.[7] Users of those browsers should check for a newer vendor release rather than treating Chrome’s update as proof that their browser is fixed.
What CVE-2026-85046 can do
CVE-2026-85046 is a high-severity type confusion vulnerability in V8. CISA says a remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. Google says it is aware that an exploit exists in the wild, and CISA added the issue to its Known Exploited Vulnerabilities catalog on September 4.[1][3]
Those facts establish active exploitation, but they do not establish a named campaign, victim count, credential theft, or a sandbox escape. Simply finding an older Chrome version does not prove that a device was compromised. The update closes the known browser-level path; it cannot tell you whether an exploit ran earlier or remove an unknown follow-on payload.
How to update Chrome and verify the build
- Open Chrome’s menu and choose Help → About Google Chrome.
- Let Chrome download the available update, then choose Relaunch.
- Open About Google Chrome again. Confirm that the displayed version meets the fixed build for your operating system.
- If the version is still older, repeat the check. On a managed device, contact the administrator if policy prevents the update.
On Android, update Chrome from Google Play and then check the app version in Chrome’s settings or the system app-information page. Never install an “emergency Chrome update” offered by a pop-up or an unrelated download site.
What Chromium-browser users should do
Chrome, Edge, Brave, Opera, and Vivaldi share Chromium code, but they do not share identical public version numbers or release timing. Opera and Vivaldi have published releases that cross the fixed Chromium boundary. Edge and Brave users should use their own browser’s update control and vendor release notes. Do not try to install a Chrome package into another browser.
This is also distinct from the earlier Chrome CVE-2026-11645 zero-day. Both incidents make the same operational point: the browser must be restarted and the installed build checked after an emergency update.
If you used an older build
Update first. There are no public campaign-specific indicators in the cited advisories, so a browser-history entry alone is not evidence of exploitation. If a site downloaded a suspicious file, do not open it; you can submit that file to the Gridinsoft Online Virus Scanner from a safe device.
Escalate the check if you also see an unexpected extension, an unrecognized download, a new account-session alert, or endpoint-security detection after browsing. Preserve the download list and relevant history, inspect installed extensions, and run an endpoint scan. If an active compromise is suspected, disconnect the affected device and review account sessions from a clean one. For managed fleets, inventory installed browser builds and enforce the vendor update; CISA’s September 18 due date applies to US federal civilian agencies, not as a universal consumer deadline.[3]
