Google has issued an emergency update for Chrome to fix CVE-2026-85046, a high-severity type confusion vulnerability in V8 — the JavaScript and WebAssembly engine at the heart of every Chrome browser. The flaw was reported by researcher Salvatore Gulizia (online handle “Serotav”) and is already being exploited in real attacks. A malicious webpage embedding specially crafted JavaScript can trigger the bug, potentially enabling remote code execution inside Chrome’s sandboxed renderer process. The patch batch also addresses 11 other security issues.
V8 type confusion bugs are among the most reliably weaponized browser flaws: a page you visit is all an attacker needs to trigger the vulnerability, no download or extra action required. Google has not publicly disclosed details about the exploit chain to give users time to update.
How to check if you’re affected
Affected versions are any Chrome release before the latest stable update. Open Chrome, go to Settings → Help → About Google Chrome, and wait for the browser to check for and install updates, then relaunch. The updated version number will appear on that page once installed.