Google has released an important security update for Chrome users after fixing 12 vulnerabilities in the browser, including a serious zero-day flaw that attackers were reportedly already exploiting in real-world attacks.

The update is significant because zero-day vulnerabilities are among the most dangerous types of security bugs. They can be exploited before users have installed a patch, giving attackers a window of opportunity to target vulnerable systems.

Google has confirmed that an exploit for one of the newly fixed vulnerabilities exists and has already been used in the wild. This makes updating Chrome especially important for users who have not yet installed the latest security patch.

Which Chrome Vulnerability Was Being Exploited?

The zero-day flaw has been identified as CVE-2026-85046.

According to the information provided, the vulnerability received a severity score of 8.8, placing it in the high-risk category.

The flaw was reported to Google on August 4, 2026, by security researcher Salvatore Gulizia.

Google reportedly awarded the researcher a $1,000 bug bounty for discovering and reporting the issue.

The vulnerability was considered serious because it affected one of the core components responsible for processing code inside the Chrome browser.

The Flaw Was Found in Chrome’s V8 Engine

CVE-2026-85046 is linked to V8, Google’s JavaScript and WebAssembly engine.

V8 plays a critical role in Chrome because it allows websites and web applications to execute JavaScript code inside the browser.

Since modern websites rely heavily on JavaScript, security flaws in V8 can potentially have a broad impact.

A vulnerability in such a component may allow attackers to trigger unexpected browser behaviour if a user visits a specially crafted or malicious webpage.

Depending on the nature of the exploit, attackers may attempt to run malicious code, crash the browser or potentially gain access to information that should otherwise remain protected.

Why Zero-Day Vulnerabilities Are Particularly Dangerous

A zero-day vulnerability becomes especially risky when attackers discover how to exploit it before a patch is widely installed.

In such situations, users may remain exposed even if they have done nothing unusual other than using a vulnerable version of the browser.

Cybercriminals can potentially create malicious websites, scripts or other attack methods designed to trigger the weakness.

This is why browser companies usually move quickly when an actively exploited zero-day issue is discovered.

Once a patch is available, installing it reduces the risk of being targeted through the known vulnerability.

Google Confirms Active Exploitation

Google has confirmed that an exploit for CVE-2026-85046 exists and is being used in real-world attacks.

However, the company has not publicly disclosed who is behind the attacks.

It has also not revealed how many users, businesses or organisations may have been affected.

The exact scale and nature of the attacks therefore remain unclear.

Technology companies often limit technical details about actively exploited vulnerabilities immediately after releasing a patch.

This is done partly to give users enough time to update their software before more attackers are able to reproduce or weaponise the exploit.

Why Chrome Users Should Update Immediately

For Chrome users, installing the latest browser update is the most important security step.

Even if the browser appears to be functioning normally, an outdated version may still contain vulnerabilities that can be exploited silently.

Security updates often fix flaws that users cannot see during normal browsing.

Because Google has already confirmed active exploitation of this particular zero-day issue, delaying the update may leave a device unnecessarily exposed.

How to Check for a Google Chrome Update

Chrome users can manually check whether an update is available through the browser settings.

Open Google Chrome and go to Settings.

From there, select About Chrome.

The browser should automatically check whether a newer version is available.

If an update has already been downloaded, Chrome may show a Relaunch option.

Users should relaunch the browser after installation because some security fixes do not become fully active until Chrome restarts.

Do Not Ignore the Relaunch Button

Many people install an update but postpone restarting the browser because they have multiple tabs open.

In the case of a security patch, this can be risky.

If Chrome has downloaded the latest version but is still running the older session, the newly installed protections may not yet be fully applied.

Saving important work and relaunching the browser is therefore recommended after a security update.

Keep Automatic Updates Enabled

Chrome normally updates automatically in the background, but automatic updates can sometimes be delayed if a browser or device has not been restarted for a long time.

Users who frequently keep Chrome open continuously should occasionally check the About Chrome section to make sure they are running the latest version.

Businesses and organisations that manage large numbers of devices should also make sure security updates are being deployed properly across their systems.

The Bigger Security Lesson for Browser Users

Modern browsers are constantly being targeted because they handle sensitive activities such as email, banking, online payments, cloud services and saved login sessions.

A single browser vulnerability can therefore become an attractive opportunity for attackers.

The latest Chrome update fixing 12 security flaws, including an actively exploited zero-day vulnerability, is another reminder that browser updates are not only about new features or performance improvements.

They are also a critical part of online security.

Chrome users should check for the latest update, install it as soon as possible and restart the browser to ensure the security patches are fully applied.