Chrome and Edge Zero-Day: Update Your Browsers Now

Google released an urgent security update for Chrome on 4 September 2026 to fix CVE-2026-85046, a high-severity flaw in V8 — the JavaScript engine at the heart of the browser. The vulnerability is being actively exploited in the wild, and the US government’s cyber authority CISA added it to its Known Exploited Vulnerabilities catalogue on the same day. That combination — active exploitation and a government-level warning — puts this in the category of patches that should not wait.

This is Chrome’s sixth zero-day vulnerability patched in 2026 alone, which reflects just how heavily targeted modern browsers have become.

Which browsers are affected?

Chrome is built on an open-source project called Chromium, and CVE-2026-85046 affects the V8 engine shared by all Chromium-based browsers. That means this is not just a Chrome problem:

• Google Chrome
• Microsoft Edge
• Brave
• Opera
• Vivaldi

If your team uses any of these — and most businesses use at least Chrome or Edge as their primary browser — this update applies to you.

What is a V8 type confusion flaw?

V8 is the engine that runs JavaScript inside your browser — the code that powers interactive websites, web apps, and cloud tools like Microsoft 365. A type confusion vulnerability occurs when the software misidentifies one piece of data as a different type, allowing attackers to corrupt memory and ultimately run their own code on the affected machine.

In plain terms: visiting a single malicious webpage can trigger the exploit with no further action from the user. No file to open, no password to enter. Attackers can deliver it through a phishing link, a compromised advert on an otherwise legitimate site, or a hacked web page. The CVSS severity score is 8.8 out of 10.

Why this matters to your business

Chrome and Edge are the two dominant browsers used in UK businesses. Almost every cloud application your team relies on — Microsoft 365, your accounting software, CRM, HR portals — runs inside the browser. A successful exploit gives an attacker a foothold inside that session, which they can use to steal login tokens, capture credentials, or work their way deeper into your systems.

The good news is that patching this is genuinely straightforward — it is a browser update, not a complex system change. The risk is that browsers often update quietly in the background and staff do not always restart them promptly. A browser running Chrome version 152.0.7977.81 or earlier is still vulnerable even if an update has downloaded but not yet been applied.

This is exactly the kind of gap that our managed IT support catches: we monitor endpoint software versions and push updates centrally, so a delayed restart on one device does not leave your business exposed.

What to check right now

The patched version of Chrome is 152.0.7977.82 or later. You can check yours in seconds:

• Google Chrome: click the three-dot menu in the top right > Help > About Google Chrome. Chrome will check for updates automatically and show you the installed version.
• Microsoft Edge: click the three-dot menu > Help and feedback > About Microsoft Edge. Install any pending update and restart the browser.
• Other Chromium browsers (Brave, Opera, Vivaldi): check for updates via each browser’s settings or Help menu.
• Mobile devices: Chrome on Android and iOS also receives security updates; check Google Play or the App Store for a pending update.
• Staff who work from home or use personal devices: remind them to check and update too. A patching policy that only covers office machines leaves a gap.

The update should take less than a minute to apply. The browser will prompt you to relaunch once the download is complete.

The bigger picture: browsers as a patching blind spot

Operating systems and servers tend to get the most attention when it comes to IT maintenance and patching. Browsers are updated far more frequently — and exploited just as aggressively — but are often left to staff to manage themselves. Six actively exploited Chrome zero-days in a single year is a clear signal that browser patching deserves the same systematic approach as everything else.

At System Force, browser versioning is part of our standard endpoint checks. If you are not sure whether your devices are running current, patched browser versions, our IT security team can audit your estate and set up automated update enforcement so you do not have to rely on every staff member clicking “Restart to update.”

If you would like help ensuring your team’s browsers and endpoints are kept up to date, get in touch or call 01452 701355 for a no-obligation chat.