Google and Microsoft have released browser updates for CVE-2026-85046, a high-severity vulnerability in Chromium's V8 JavaScript engine that is already being exploited in the wild. Google fixed it in Chrome 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux. Microsoft says Edge Stable 152.0.4191.62 also contains the fix.
For most businesses, the practical action is straightforward: allow Chrome and Edge to update, then restart the browser so the patched version is actually running. Managed devices should be checked through the organisation's normal patching and endpoint-management process.
Because exploitation has already been observed, this is more urgent than a routine browser update.
What is CVE-2026-85046?
CVE-2026-85046 is a type-confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Chromium-based browsers. Google rates the issue as high severity and has restricted detailed bug information while users receive the fix.
A type-confusion flaw can cause software to treat one kind of object as another, potentially leading to memory corruption and unintended code execution. The important point for ordinary businesses is not the internal mechanics: it is that Google has confirmed a working exploit exists in the wild.
Google published the patched Chrome build on 3 September 2026 in its Chrome Releases security update.
Is the Chrome and Edge zero-day being actively exploited?
Yes. Google explicitly states that it is aware of an exploit for CVE-2026-85046 being used in the wild. Microsoft repeats that warning in its Edge security release notes.
Neither vendor has published detailed exploitation instructions, which is normal while a security update is still rolling out. That means businesses should not wait for more technical details before updating.
The vulnerability is important because web browsers routinely process untrusted content from websites, adverts and embedded scripts. When a browser flaw is already being exploited, delaying the update increases unnecessary exposure.
Which Google Chrome version fixes CVE-2026-85046?
Google's fixed Stable-channel versions are:
- Windows: Chrome 152.0.7977.82 or 152.0.7977.83
- macOS: Chrome 152.0.7977.82 or 152.0.7977.83
- Linux: Chrome 152.0.7977.82
Google says the update is rolling out over the following days and weeks, so a device may not receive it at exactly the same time as another. Where possible, businesses should check rather than assume the update has landed.
Users can check Chrome by opening Menu > Help > About Google Chrome. Chrome should check for updates automatically; restart the browser when prompted.
Which Microsoft Edge version fixes CVE-2026-85046?
Microsoft Edge Stable 152.0.4191.62, released on 2 September 2026, contains the fix for CVE-2026-85046. Microsoft then released Edge Stable 152.0.4191.66 on 4 September with the latest Chromium security updates.
Microsoft's own Edge security release notes state that the Chromium team reported an exploit in the wild and that the Edge update contains the fix.
Users can check Edge by opening Settings and more > Help and feedback > About Microsoft Edge. Edge should update automatically, but the browser normally needs to restart before the new build is fully active.
What should businesses do now?
- Check Chrome and Edge versions. Prioritise laptops and desktops used for normal web browsing, Microsoft 365 and cloud applications.
- Allow the update to install. Do not postpone a browser restart for days simply because tabs are still open.
- Restart the browser. Downloading an update is not the same as running the patched build.
- Review managed devices centrally. If your organisation uses RMM, Intune or another endpoint-management platform, confirm browser updates are reaching devices rather than relying entirely on users.
- Check other Chromium-based browsers separately. A shared Chromium vulnerability does not mean every browser receives the same fixed version at the same time; follow the browser vendor's own advisory.
- Investigate suspicious activity. If a device behaved unexpectedly before it was patched, follow your incident-response process rather than assuming the browser update reverses a compromise.
This is the same principle we recommend for endpoint protection: good security depends on timely patching, monitoring and a clear response process, not one control in isolation.
Need help checking browser patching across your business?
KES can help verify Chrome and Edge versions across managed devices, confirm updates are deploying correctly and investigate anything suspicious on affected computers.
What if Chrome or Edge is managed by your IT provider?
Managed browsers may receive updates through device policies, RMM tools, Intune or normal vendor auto-update services. That is useful, but the result still needs verifying.
An endpoint can appear online and healthy while a user has left a browser open for days without restarting it. IT teams should therefore check the installed browser build and, where practical, prompt or schedule a restart if the patched version is waiting to activate.
Businesses that already use managed endpoint monitoring are in a better position to confirm coverage quickly. Our guide to what an endpoint means in cyber security explains why browser patching is part of the wider device-security picture.
What happens if you do nothing?
A vulnerable browser remains exposed to a flaw for which exploitation has already been observed. Installing the update does not guarantee that every past attack attempt is detectable, but leaving the browser unpatched removes a protection the vendors have already made available.
If there are signs of compromise — unexpected security alerts, unknown software, unusual account activity or suspicious browser behaviour — isolate the affected device from the network and follow a structured response. Our step-by-step cyberattack response guide explains the first actions to take.
Quick answers
Is CVE-2026-85046 a real zero-day?
Yes. Google says an exploit exists in the wild, which means attackers were using the vulnerability before or around the time the fix became broadly available.
Does Microsoft Edge need updating as well as Chrome?
Yes if you use Edge. Microsoft Edge is Chromium-based and Microsoft released Edge Stable 152.0.4191.62 with the CVE-2026-85046 fix.
Is restarting the browser necessary?
Yes. Chrome and Edge normally need to restart before an installed browser update is fully running.
Should businesses uninstall Chrome or Edge?
No. The appropriate response is to install the vendor's fixed version and keep browsers managed and updated.
Does this affect every Chromium browser?
The underlying flaw is in Chromium's V8 engine, but each browser vendor controls its own release schedule. Check the advisory for any other Chromium-based browser you use rather than assuming it has already been fixed.
The important point
This is an actively exploited browser vulnerability with fixes already available. Businesses do not need to understand V8 internals or wait for more exploit details. They need to confirm Chrome and Edge have updated and restarted.
Browser updates are easy to overlook because they happen quietly in the background. A quick version check across business devices is worthwhile when a vendor confirms active exploitation.
Sources
- Google Chrome Releases: Stable Channel Update for Desktop — 3 September 2026.
- Microsoft Learn: Release notes for Microsoft Edge security updates — Edge fix released 2 September 2026 and further security update released 4 September.
- BleepingComputer: Google warns of new Chrome zero-day flaw exploited in attacks — 4 September 2026.
Browser versions and rollout timing can change quickly. Check the vendor's current release notes if you are reviewing this article after the dates above.
