Google patched CVE-2026-85046, a Chrome zero-day in the V8 JavaScript engine that is being actively exploited in the wild and lets a crafted web page run arbitrary code inside the browser sandbox. Until users update to Chrome 152.0.7977.82/.83, a malicious page could compromise their system, browser, and data.

It is the sixth Chrome zero-day fixed this year, and staying current on browser updates remains one of the most vigilant defenses.

Why it matters:

• Active in-the-wild exploitation: In-sandbox code execution zero-days in primary rendering engines represent high-value primitives frequently chained with OS sandbox escapes for drive-by compromises.
• Rapid patch cadence: Organizations must accelerate patch distribution cycles for endpoint browsers, as weaponized exploit chains move rapidly from targeted espionage to opportunistic deployment.