In early September 2026, Google patched a Chrome zero-day (CVE-2026-85046), a type confusion flaw in the V8 engine that is being actively exploited and can lead to remote code execution through a crafted web page. Because Chrome is used across nearly every organisation, updating browsers promptly is a simple but important defence.
What happened
In early September 2026, Google released a security update for Chrome that fixed several vulnerabilities, including one that was already being exploited in the wild. That zero-day, tracked as CVE-2026-85046, is a type confusion flaw in V8, the JavaScript and WebAssembly engine at the heart of Chrome. Google confirmed that an exploit exists in the wild, though, as is common, it did not detail how the attacks were being carried out or by whom.
The practical meaning is straightforward. A flaw in the engine that runs code on every web page can, when exploited through a specially crafted page, allow an attacker to run their own code on the victim’s machine. And because Chrome is used almost everywhere, this is a flaw that touches nearly every organisation.
Why browser flaws matter
It is easy to think of the browser as just an application, but it is more than that. The browser is where most people meet the internet, and it routinely runs untrusted code, every website you visit executes scripts in your browser. That makes the browser a uniquely exposed piece of software, and a serious flaw in it a serious problem.
A vulnerability like this one does not require the victim to download a file or install anything. Visiting a malicious or compromised web page can be enough. That low bar for exploitation, combined with how universally browsers are used, is what makes browser zero-days worth acting on quickly.
What the flaw allows
CVE-2026-85046 is described as a type confusion vulnerability in V8 that allows a remote attacker to execute arbitrary code via a crafted HTML page. In plain terms, an attacker who can get a victim to load a malicious page can potentially run code on that victim’s device. Google has noted the flaw allows this within the browser’s sandbox, but any reliable code execution triggered simply by visiting a page is dangerous and a priority to patch.
Because it is being actively exploited, this is not a theoretical risk to schedule for later. Attackers are already using it, so the window to patch has closed.
Why zero-days in common software deserve fast action
There is a pattern worth internalising: the more widely used a piece of software is, the more valuable a flaw in it becomes, and the faster you should act. Chrome is among the most widely used software in the world, so a working exploit against it is extremely valuable to attackers and worth deploying at scale.
This is why browser updates, which many organisations treat as routine background events, deserve attention when a zero-day is involved. The update is the fix, and applying it promptly across every device closes the door. Delaying leaves a known, actively exploited hole open on machines your staff use all day.
Immediate actions
Responding to this is simple, which is part of the point:
- Update Chrome to the latest version across every device in the organisation
- Verify the update has actually applied, since browsers do not always restart to complete an update
- Include all Chrome-based browsers in your check, as many share the same underlying engine
- Make sure your browser update process reaches remote and less-managed devices too
The fix is easy. The risk is in assuming it happened automatically when a browser has not been restarted, or in forgetting the devices outside your core fleet.
Why browser and endpoint patch management belongs in your programme
This incident is a reminder that browser and endpoint patching is a real part of your security posture, not an afterthought. Zero-days in everyday software appear regularly, and the organisations that handle them well are the ones with a reliable process for getting updates onto every device quickly.
Pairing prompt patching with monitoring adds a further layer. If a device is compromised through a browser flaw before it is patched, monitoring for the resulting behaviour, unusual processes, unexpected connections, gives you a chance to catch it. Prevention and detection together are what keep a fast-moving browser zero-day from turning into an incident.
If you want help ensuring updates reach every device and watching for compromise, see our managed detection and response services, or arrange a penetration test to understand your real exposure.
For the authoritative details, confirm against the official Google Chrome release notes and the CISA Known Exploited Vulnerabilities catalogue.
Frequently asked questions
What is CVE-2026-85046?
It is an actively exploited Chrome zero-day, a type confusion flaw in the V8 engine that powers Chrome. Exploited through a crafted web page, it can allow a remote attacker to execute code on the victim’s device, which is why Google prioritised a fix.
How does it get exploited?
Through a crafted or compromised web page. When a victim loads the page, the flaw in the browser’s engine is triggered, potentially allowing the attacker to run code. No download or installation by the victim is required, which lowers the bar for exploitation.
What should I do?
Update Chrome to the latest version across every device immediately, and verify the update has applied by restarting the browser. Include all Chrome-based browsers and make sure the update reaches remote and less-managed devices too.
Why do browser zero-days matter?
Because the browser is used by everyone and routinely runs untrusted code from every website visited. A serious flaw can be triggered simply by loading a page, and the universal use of browsers means a working exploit can be deployed very widely.
