Google Chrome patch fixes 12 vulnerabilities, including exploited zero-day

Google has released a new version of Chrome for Windows, Mac, and Linux that fixes 12 vulnerabilities. Most are rated high severity, including a flaw that is being actively exploited in real-world attacks.

The update brings Chrome to version 152.0.7977.82/.83 on Windows and Mac, and 152.0.7977.82 on Linux. Google said in a security advisory published on September 3 that the rollout will be gradual.

The exploited vulnerability, tracked as CVE-2026-85046, is a type confusion flaw in V8, Chrome’s JavaScript engine. The National Vulnerability Database describes it as allowing a remote attacker to execute arbitrary code inside the sandbox through a crafted HTML page.

Security researcher Salvatore Gulizia discovered the flaw and received $1,000 for reporting it. Google has not disclosed further details about the attacks while browser users are being protected.

This is the sixth zero-day Google has fixed in Chrome since the start of the year. The issue also affects other Chromium-based browsers, including Edge, Brave, Opera, and Vivaldi.