Google Deploys Critical Chrome Zero-Day Fix Amid Active Exploitation

An emergency security patch for Chrome has been released by Google to seal a serious zero‑day vulnerability that is already being exploited in the wild. Identified as CVE‑2026‑85046, the defect lives in Chrome’s V8 JavaScript and WebAssembly engine—the central module that runs code on web pages.

The problem was initially spotted by security researchers who saw rogue sites serving payloads that caused arbitrary code execution on susceptible browsers. Since V8 underpins Chrome as well as other Chromium‑based browsers, the threat affected a wide audience. In reaction, Google pushed an emergency fix, sidestepping its normal release timetable to safeguard users promptly.

Exploiting a memory‑corruption bug in the engine’s processing of specific WebAssembly constructs, the vulnerability lets an attacker evade Chrome’s sandbox defenses. After breaching the sandbox, the malicious code executes with the user’s privileges, enabling data theft, malware installation, or system hijacking. Specialists caution that the attack chain is refined enough to function without any user interaction, heightening its danger.

Google is calling on every Chrome user to install the update right away, pointing out that the fix is already being rolled out via the browser’s automatic update system on Windows, macOS, Linux, Android, and Chrome OS. Enterprises should confirm that the newest version is in place throughout their infrastructure and keep an eye out for any irregular behavior that might signal a pre‑patch breach.

The appearance of CVE‑2026‑85046 highlights the continual difficulty of protecting intricate web platforms. Although Chrome’s rapid update cycle usually curtails risk, zero‑day attacks aimed at core execution engines persist as a serious menace. Analysts anticipate that attackers will turn their attention to other browsers or hunt for comparable flaws in related parts, urging ongoing vigilance from both vendors and users.