Google has patched a high-severity vulnerability in Chrome after confirming that attackers were already exploiting it in the wild.

The flaw, tracked as CVE-2026-85046, affects V8, the engine Chrome uses to run JavaScript and WebAssembly. Because V8 processes code from every website a user visits, bugs in it are attractive targets for attackers who can trigger them simply by luring a victim to a malicious web page. Google has not identified the attackers, their victims, or what the exploit can do.

"Google is aware that an exploit for CVE-2026-85046 exists in the wild," the company said in a security notice published Thursday. "We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel."

The patch is included in Chrome 152.0.7977.82 and 152.0.7977.83 for Windows and Mac, and version 152.0.7977.82 for Linux. Google said the update "will roll out over the coming days/weeks." Users can check their version and apply pending updates through Chrome's settings menu, and Chromium-based browsers such as Edge, Brave, and Opera typically integrate the same V8 fixes on their own release schedules.

CVE-2026-85046 is a type-confusion bug. Such flaws occur when software treats data as the wrong type, causing memory errors or other unexpected behavior. Google has not said whether the bug can be used to run code remotely.

Security researcher Salvatore Gulizia, also known as Serotav, reported the flaw on Aug. 4 and received a $1,000 bug bounty from Google. V8 flaws have repeatedly drawn bounties under Google's reward program, and in-the-wild Chrome zero-days are disclosed several times in a typical year.

The Chrome update includes 12 security fixes in total, nine of them high-severity and two medium-severity. Google is withholding some details until most users—and affected third-party projects—have installed the patches, and has not said when it will publish more information about the exploit.

Browser-based crypto theft

While Google has not tied CVE-2026-85046 to attacks on cryptocurrency users, browser wallets, exchange accounts, and trading extensions have been targeted through other methods. Crypto holders are a frequent focus of such campaigns because browser extensions and wallets can grant direct access to funds once compromised.

In November 2025, researchers found that a malicious Chrome extension added hidden SOL transfers to users' swaps.

A month later, a Singapore entrepreneur said malware disguised as a game drained more than $14,000 from his browser-connected wallets. He believed the attack involved stolen authentication tokens and an earlier Chrome zero-day; however, no link to CVE-2026-85046 has been reported.

More recently, in August, researchers uncovered dozens of fake Firefox wallet extensions that stole wallet credentials.