Actively exploited Chrome zero‑day and 11 other high‑severity bugs fixed in version 152
Google’s September 2026 Chrome update (152.0.7977.82/.83) patches an actively exploited V8 zero‑day and eleven other high‑severity bugs, and should be applied immediately.
Enterprises that rely on the Chrome browser face a new, actively exploited security risk. Google has pushed version 152.0.7977.82 (and .83 for Windows and macOS) as part of a staged rollout to close the gap.
Why the update matters now
The most urgent flaw, CVE‑2026‑85046, is a type‑confusion error in Chrome’s V8 JavaScript engine. Security researchers have confirmed that malicious HTML pages can trigger the bug, allowing remote code execution inside Chrome’s sandboxed renderer. In practice, an attacker could run arbitrary code on any machine that loads the crafted page.
What was fixed
The release also addresses nine other high‑severity issues across Chrome components. The table below lists every vulnerability covered by the update, the component affected, and the month the fix was released.
| CVE | Component | Issue type | Patch month |
|---|---|---|---|
| CVE‑2026‑85046 | V8 engine | type‑confusion (actively exploited) | September 2026 |
| CVE‑2026‑11645 | V8 engine | out‑of‑bounds read/write (exploited in the wild) | June 2026 |
| CVE‑2026‑2441 | CSSFontFeatureValuesMap | iterator invalidation | February 2026 |
| CVE‑2026‑3909 | Skia 2D graphics library | out‑of‑bounds write | March 2026 |
| CVE‑2026‑3910 | V8 engine | inappropriate implementation | March 2026 |
| CVE‑2026‑5281 | Dawn (WebGPU) | use‑after‑free | April 2026 |
| , | Crash Reporting | use‑after‑free / out‑of‑bounds memory | September 2026 |
| , | Network | use‑after‑free / out‑of‑bounds memory | September 2026 |
| , | Compositing | use‑after‑free / out‑of‑bounds memory | September 2026 |
| , | WebGL | use‑after‑free / out‑of‑bounds memory | September 2026 |
| , | CacheStorage | use‑after‑free / out‑of‑bounds memory | September 2026 |
| , | DevTools | use‑after‑free / out‑of‑bounds memory | September 2026 |
| , | V8 race condition | race condition | September 2026 |
The dash entries represent the nine additional high‑severity bugs mentioned in the release notes; the exact CVE numbers were not disclosed, but the components and issue types are confirmed.
How to apply the update
Chrome users should open Settings > About Chrome. The browser will check for updates, download version 152.0.7977.82 (or .83 on Windows/macOS), and prompt for a restart. Restarting the browser completes the installation.
Impact on Chrome‑based browsers
Browsers built on Chromium, such as Microsoft Edge, Brave, Opera and Vivaldi, receive the same patches a few days after Chrome. Administrators should monitor those browsers and apply updates as soon as they appear.
What to watch for
- Verify that the version number shown in Help > About Google Chrome matches 152.0.7977.82 or .83.
- Re‑scan critical web applications after the update to ensure no regression.
- Keep an eye on threat‑intel feeds for any new exploits targeting older Chrome versions.
Terms used in this article
- V8 engine, Chrome’s JavaScript and WebAssembly execution engine.
- Type‑confusion, A programming error where the program treats data as the wrong type, leading to memory corruption.
- Use‑after‑free, An error where a program accesses memory after it has been released.
- Out‑of‑bounds, Accessing memory outside the intended range.
- Race condition, A flaw that occurs when two operations compete for the same resource in an unexpected order.
