A flaw in Chrome's JavaScript engine is already being exploited

On 3 September 2026 Google released Chrome 152.0.7977.82 and .83 for Windows and macOS, and 152.0.7977.82 for Linux. The release fixes twelve security issues. Chief among them is CVE-2026-85046, a type confusion flaw in V8, the engine that runs JavaScript and WebAssembly in the browser. Google rates the flaw high severity and says an exploit exists in the wild. According to the CVE record, a remote attacker can execute arbitrary code inside the browser sandbox through a crafted HTML page.

What this means for you if you manage the browsers in your organisation

A V8 flaw is triggered by a web page, and the user needs to do nothing more than open it. The code runs inside the sandbox, which is meant to keep it away from the rest of the machine, but the sandbox is the first obstacle and not the last. Flaws like this are often combined with a second flaw to get further out. What Google is saying is that someone is already using this one, and then the time from release to rollout is what counts.

What separates organisations here is not whether Chrome updates itself, but whether every installation actually does. Machines outside the central software catalogue, browsers that are never restarted, and embedded Chromium components in other applications are the usual gaps. Our advice is to measure the rollout rather than assume it. Pull a report of version per machine the day after, and follow up the stragglers.

Berigo recommends

• Confirm that the managed rollout of Chrome 152.0.7977.82 or later has completed on Windows, macOS and Linux.
• Find machines where Chrome is installed outside the software catalogue, and bring them under management.
• Ask users to restart the browser, since a downloaded update does nothing until they do.
• Check other applications built on Chromium, and which V8 version they run.
• Pull a version report the day after the rollout, and follow up the exceptions.