In September 2026, Google confirmed that attackers were exploiting a high-severity Chrome V8 flaw, CVE-2026-85046. Google shipped a desktop fix on September 3. The headline calling it Chrome’s “sixth zero-day of 2026” was true only as a dated snapshot: Google’s September 8 release notice then confirmed exploitation of another Chrome vulnerability, CVE-2026-87491. That changing timeline is why a reader needs an update check, not a frozen annual count.
What to do: open chrome://settings/help, let Chrome check and install updates, then choose Relaunch if offered. Confirm the browser has reopened and reports an up-to-date version. If your organization manages Chrome, follow its update policy and ask IT when relaunch is controlled centrally.
What CVE-2026-85046 was—and what is confirmed
Google described the issue as a type confusion in V8, Chrome’s JavaScript engine, rated High by Chromium. In plain terms, the engine mishandled a type distinction while processing content. Google’s release notice says it was aware of an exploit in the wild. The public notice does not identify a victim count or describe the campaigns, so this article does not infer either.
Google’s September 3 Stable Channel notice gave these initial desktop fixed builds: 152.0.7977.82 for Linux; 152.0.7977.82/.83 for Windows and macOS. Treat those numbers as the minimum patch floor for that specific issue, not as the version you should try to install today. Chrome’s Stable version moved on afterward; Google’s October 6 notice listed 155.0.8059.39 for Linux and 155.0.8059.39/.40 for Windows and Mac. The latest offered build for your platform is the practical target.
Why “sixth zero-day” quickly became old news
The September 3 CVE-2026-85046 notice was described in reporting as the sixth actively exploited Chrome zero-day patched in 2026. Five days later, Google’s September 8 Stable Channel post said it was aware of exploitation for CVE-2026-87491. Counting “zero-days this year” therefore depends on the date of the count and what a source includes. It is a poor safety checklist: the count can age while the browser version you run remains the actionable fact.
There is another trap in version-tracking stories. A staged rollout or release-channel feed describes availability across a population; it cannot tell an individual reader whether their installation downloaded the package or restarted into it. That is why we removed the previous post’s claimed rollout percentages and its unsupported assertion that one platform had already fully switched. A local version check is the appropriate individual check.
Check and finish the update
- In Chrome, select the three-dot menu, then Help → About Google Chrome, or enter
chrome://settings/helpin the address bar. - Wait for the update check and download to finish. If Chrome offers Relaunch, use it and restore your tabs if needed. A downloaded update may not become the running browser until it restarts.
- Open the same page again and confirm Chrome says it is up to date. Record the full version number if this is a work device or you need to report it to IT.
- If updating fails, restart the device once, check that the device has internet access and sufficient storage, then retry. On a managed device, avoid bypassing company controls; report the version and error to the administrator.
Do not compare a Chrome number directly with another Chromium-based browser’s number. Edge, Brave, and other vendors distribute their own builds and may use different version sequences and update schedules. Check that browser’s own update page and vendor security notice. On Android, update Chrome through Google Play and check the app’s version in Chrome settings; ChromeOS devices receive browser components through ChromeOS updates.
What this report can and cannot tell you
| Question | Evidence-backed answer |
|---|---|
| Was CVE-2026-85046 exploited? | Google said it was aware of exploitation in the wild. |
| What desktop builds fixed it initially? | Google’s September 3 release notice lists the platform-specific 152.0.7977.82/.83 builds above. |
| Can the old release snapshot show my current exposure? | No. Check the version installed on your own device and restart if asked. |
| How many people were affected, or which sites were used? | The cited public release notice does not provide those details. |
| Does the CVE count tell me whether I am safe? | No. Counts are time-bound summaries; installed, supported, patched software is the useful check. |
Sources and update note
Checked on October 13, 2026. Product version numbers and advisories change; use the live vendor update screen before acting.
- Google Chrome Stable Channel update, September 3, 2026 — CVE-2026-85046, fixed desktop builds, and Google’s in-the-wild exploitation notice.
- Google Chrome Stable Channel update, September 8, 2026 — a separate in-the-wild exploitation notice for CVE-2026-87491.
- Google Chrome Releases, October 2026 — October 6 Stable desktop version listing.
- CISA Known Exploited Vulnerabilities Catalog — a prioritization resource for organizations; its statutory directive applies to U.S. federal agencies, not a personal consumer deadline.
Image credits
- Apps-Google-Chrome-App-List-icon by Ctec, CC BY-SA 4.0, via Wikimedia Commons.
- Photo by Deepanker Verma on Pexels.
- Photo by Rahul Pandit on Pexels.