Two critical Chrome flaws put users at risk on malicious websites

Update September 4, 2026

Shortly after this article was published, Google released another Chrome update that patches an actively exploited flaw in the V8 JavaScript engine, tracked as CVE-2026-85046.

Google rates the vulnerability as high severity and says an exploit already exists in the wild. An attacker could use a crafted HTML page to execute arbitrary code inside the Chrome sandbox. Because it is already being exploited, HKCERT rates the overall risk as extremely high.

After installing the latest update, Chrome should be at version 152.0.7977.82/.83 on Windows and Mac, or 152.0.7977.82 on Linux.

Chrome is rolling out an update for its desktop browser. The update includes 26 security fixes, two of which Google rates as critical use-after-free vulnerabilities.

Two critical Chrome flaws put users at risk on malicious websites

Other newsrooms on this story

Related reading

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Update Chrome now: Critical bugs could let attackers run code

Google warns of new Chrome zero-day flaw exploited in attacks

Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now

Chrome 146 Zero-Days: The Skia and V8 Attack Surface, 2026 Edition