Google Issues Emergency Patch for Actively Exploited Chrome Zero-Day

Google has rolled out an urgent security update for its Chrome browser to close a critical zero‑day flaw that attackers are already leveraging in the wild. The vulnerability, catalogued as CVE‑2026‑85046, resides in Chrome's V8 JavaScript and WebAssembly engine, the core component that executes web‑page code.

Security researchers first identified the issue after observing malicious sites delivering payloads that triggered arbitrary code execution on vulnerable browsers. Because V8 powers not only Chrome but also other Chromium‑based browsers, the risk extended to a broad user base. Google’s response was to issue an emergency patch, bypassing the usual release schedule to protect users as quickly as possible.

The flaw allows an attacker to bypass Chrome's sandbox protections by exploiting a memory‑corruption bug in the engine's handling of certain WebAssembly constructs. Once the sandbox is broken, the malicious code can run with the same privileges as the user, potentially stealing data, installing malware, or hijacking the system. Experts warn that the exploit chain is sophisticated enough to operate without user interaction, making it particularly dangerous.

Google has urged all Chrome users to apply the update immediately, noting that the patch is already distributed through the browser's automatic update mechanism on Windows, macOS, Linux, Android, and Chrome OS. Organizations are advised to verify that the latest version is deployed across their networks and to monitor for any anomalous activity that could indicate a compromise prior to the patch.

The emergence of CVE‑2026‑85046 underscores the ongoing challenges of securing complex web platforms. While Chrome’s frequent update cadence generally limits exposure, zero‑day exploits that target core execution engines remain a persistent threat. Analysts expect that threat actors will shift focus to other browsers or look for similar weaknesses in related components, prompting continued vigilance from both vendors and users.