A Chrome update that already mattered became more urgent on September 4: CISA added CVE-2026-85046, an actively exploited type-confusion flaw in Chromium’s V8 JavaScript engine, to its Known Exploited Vulnerabilities catalog. Google fixed the bug in Chrome 152.0.7977.82/.83 for desktop and said an exploit exists in the wild.
What changed
Google’s September 3 stable-channel update repaired CVE-2026-85046 alongside eleven other security issues. The next day, CISA added this specific flaw to its exploited-vulnerability catalog and set September 18 as the remediation deadline for organizations subject to its binding directive. CISA says a crafted HTML page can let a remote attacker execute code inside the browser sandbox.
The practical consequence
Chrome users should verify that desktop installations have reached version 152.0.7977.82 or .83, or a later build, and restart the browser so the update takes effect. Administrators should confirm deployment rather than assuming automatic updating has completed. CISA also warns that other Chromium-based browsers, including Microsoft Edge and Opera, could be affected; their fixed versions and rollout schedules must be checked with each vendor.
Limits of the advisory
Neither Google nor CISA publicly describes the observed attacks, their scale, or their targets. Google’s notice establishes in-the-wild exploitation, but it does not say that every Chromium-based browser is affected at the same version. CISA describes code execution inside the sandbox; the public notices do not establish a standalone escape from that sandbox or a complete system-compromise chain. CISA lists known ransomware use as unknown.
Benchmark status
No performance benchmark is relevant to this security update. The evidence is the vendor’s fixed release and exploitation statement plus CISA’s catalog entry; DrComps did not independently reproduce the vulnerability or the exploit.