Chrome V8 zero-day CVE-2026-85046 exploited — patch now

Google shipped an emergency Chrome update for a zero-day in the V8 JavaScript engine, CVE-2026-85046, that is already being exploited in the wild. A type-confusion bug in the engine that runs on nearly every desktop means a single malicious web page can lead to code execution on the visitor’s machine.

What the flaw is

CVE-2026-85046 is a type confusion in V8, the engine Chrome and every Chromium-based browser use to run JavaScript. Type confusion lets an attacker trick the engine into treating a chunk of memory as the wrong kind of object, which is a reliable primitive for gaining control of execution. Google confirmed active exploitation and pushed an out-of-band desktop update, which is the strongest signal a vendor gives that this is being used right now.

Because the trigger is just JavaScript on a page, the delivery is a drive-by: the victim only has to open a booby-trapped site or a malicious ad. No click, no download, no warning.

Why a browser zero-day is everyone’s problem

The browser is the single most-exposed application on every endpoint in your company. A working V8 exploit is the first link in a chain: land code in the browser, escape the sandbox, then pivot to the rest of the machine and the network behind it. That is exactly the kind of end-to-end path we model in a red team assessment, and the endpoint detection side of it is what a managed detection and response (MDR) service exists to catch.

What to do now

• Force-update Chrome and every Chromium browser (Edge, Brave, Opera) across the fleet today, then relaunch to apply. Do not rely on users to restart.
• Roll it through your vulnerability management process so you can prove coverage, not hope for it.
• Watch endpoints for post-exploitation behaviour, the domain where a managed SOC earns its keep.
• If you see signs an endpoint was compromised through the browser, treat it as an incident and call in data breach response.

The takeaway

Browser zero-days are not rare events, they are a recurring tax on every organisation. The teams that shrug them off are the ones that patch endpoints fast, monitor what runs after a page loads, and periodically test whether a foothold on one laptop can reach anything that matters. If you have never tested that path, start with a penetration test.