Chrome Users Should Update Their Browser Now After Google Confirms Active Hack
source: decrypt
Anyone using Google Chrome on a Windows, Mac, Linux, or Android device should update the browser immediately, after Google confirmed that attackers were already exploiting a security flaw before a fix was available.
As SecurityWeek reported, the vulnerability is the sixth actively exploited Chrome flaw patched so far in 2026.
The affected vulnerability, tracked as CVE-2026-85046, is a type confusion flaw in V8, Chrome’s JavaScript and WebAssembly engine.
Security researcher Salvatore Gulizia, who goes by “Serotav” online, reported the flaw to Google and received a $1,000 bug bounty reward, according to BleepingComputer.
Google’s advisory acknowledged that an exploit was in active use before the patch shipped. Attackers got there first. The company has not disclosed who carried out the attacks or which users were targeted.
What the Flaw Does
Type confusion vulnerabilities occur when software misidentifies one category of data as another, which can allow an attacker to corrupt memory.
In Chrome’s case, Forbes reported that a remote attacker could execute arbitrary code inside the browser’s security sandbox simply by directing a user to a maliciously constructed webpage.
BleepingComputer noted the flaw could be triggered by a specially crafted HTML page containing malicious JavaScript. One bad link is enough.
Google has withheld further technical details to give users and projects that depend on Chrome time to apply the fix before attackers develop additional methods.
Which Version Includes the Fix
The patched release is Chrome 152.0.7977.82/83 for Windows and macOS, and version 152.0.7977.82 for Linux. That same version number applies to Android, where the updated app was rolling out through Google Play.
The September 3 advisory from Google’s Srinivas Sista noted that automatic updates would reach users on other platforms over the coming days and weeks, Forbes reported.
Beyond the zero-day, the update also resolves 11 additional vulnerabilities.
Nine of those carry a high-severity rating, SecurityWeek reported, covering use-after-free flaws, out-of-bounds memory issues, a race condition in V8, and problems in components including Crash Reporting, Compositing, WebGL, CacheStorage, DevTools, and Skia.
Two medium-severity weaknesses involving improper input validation were also fixed.
How to Update Chrome Now
Users do not need to wait for the automatic rollout. Opening Chrome’s three-dot menu, selecting Help, and then About Google Chrome will prompt the browser to check for and download the latest version. A restart is required once the download finishes. Do it now.
BleepingComputer also recommended that users of Chromium-based browsers, including Brave, Opera, Vivaldi, and Microsoft Edge, check for updates, though patches for those products may take a few extra days to arrive.
This is the sixth zero-day Chrome has had to patch in 2026. Previous fixes addressed flaws in V8, the Skia graphics library, CSS font feature values, and the Dawn WebGPU component, among others.
