Google has patched a critical Chrome vulnerability actively exploited by hackers, addressing 12 security issues in the latest update.
Summary
- Google has acknowledged the exploitation of CVE-2026-85046.
- The latest Chrome update resolves 12 security vulnerabilities.
- No confirmed links to cryptocurrency theft have been established.
Google has acted swiftly to patch a significant vulnerability in its Chrome browser, which was found to be actively exploited by cybercriminals.
This specific flaw affects the V8 engine, which handles JavaScript and WebAssembly execution in Chrome. Details regarding the hackers, their targets, and the full extent of the exploit remain undisclosed.
In a security notice released on Thursday, Google confirmed, "We are aware that an exploit for CVE-2026-85046 exists in the wild." The company expressed gratitude to the security researchers who assisted in identifying and mitigating potential threats before they reached users.
The fix is included in Chrome versions 152.0.7977.82 and 152.0.7977.83 for Windows and Mac, and 152.0.7977.82 for Linux. Google plans to roll out this update gradually over the coming days and weeks.
CVE-2026-85046 is classified as a type-confusion vulnerability, a condition where software misinterprets data types, potentially leading to memory errors. Google has not yet confirmed if this flaw allows for remote code execution.
Security researcher Salvatore Gulizia, known as Serotav, initially reported this issue on August 4, earning a $1,000 bug bounty from Google.
This update includes 12 security fixes, with nine categorized as high severity and two as medium severity. However, some details are being withheld until a majority of users and affected third-party projects have applied the necessary patches.
Further information about the exploit's specifics has yet to be released by Google.
Risks to Cryptocurrency Users
While Google has not connected CVE-2026-85046 to cryptocurrency threats, past incidents have shown that browser wallets, trading extensions, and exchange accounts can be vulnerable.
In November 2025, a malicious Chrome extension was discovered that illicitly drained SOL transfers from users. Additionally, a Singapore entrepreneur reported a malware attack in December that stole over $14,000 from his cryptocurrency wallets, suspected to involve stolen authentication tokens and a previous Chrome zero-day exploit. No link to CVE-2026-85046 has been confirmed. More recently, fraudulent Firefox wallet extensions have been identified that aim to capture wallet credentials.
