vCDC Alert: Google Chrome zero-day CVE-2026-85046 actively exploited

Management summary

Google has released a security update for Chrome and confirmed that an exploit for CVE-2026-85046 exists in the wild. Because browsers process untrusted internet content every day, organisations should accelerate deployment rather than wait for the next routine endpoint maintenance cycle.

What is the issue?

CVE-2026-85046 is a type-confusion vulnerability in the V8 JavaScript engine. A specially crafted web page can trigger unsafe memory handling and allow attacker-controlled code to execute inside Chrome’s sandbox. Chrome versions before 152.0.7977.82 are affected by the issue addressed in the September 2026 stable update.

Why is this dangerous and what can an attacker do?

The attack surface is very broad: a user may only need to visit a malicious or compromised website. The flaw alone should not be described as a guaranteed full takeover of the operating system because code initially runs in the browser sandbox. However, it can execute attacker-controlled code in the browser context and may be combined with another vulnerability to escape the sandbox and compromise the host.

Recommended action

Update Chrome immediately to at least 152.0.7977.82, preferably the latest stable release available. Windows and macOS received 152.0.7977.82/.83 and Linux 152.0.7977.82 in the referenced release. Ensure Chrome is actually restarted after the update and centrally verify installed versions, especially on RDS/VDI, kiosks and shared devices. If suspicious exposure is suspected, review EDR telemetry for unusual browser child processes and follow-on activity.

vCDC assessment

Priority: HIGH / IMMEDIATE UPDATE. The decisive factor is not only the technical severity but Google’s confirmation of active exploitation and Chrome’s very large deployment base.