Google has issued an emergency update for its Chrome browser after the discovery of a Chrome zero-day vulnerability that the company says is already being exploited in the wild. Researcher Salvatore Gulizia discovered the bug and reported it to Google; Chrome has approximately 3.6 billion users worldwide.
“Google is aware that an exploit for CVE-2026-85046 exists in the wild,” Google said in an advisory about the issue.
Chrome zero-day details
The update for Windows, macOS and Linux includes 12 security fixes for the flaw, identified as CVE-2026-85046. Google said it did not provide specific details about the security vulnerability in order to give users time to update their browser. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” the company added.
It is understood the security issue could be exploited by tricking someone into visiting an HTML page containing malicious code, which could potentially give attackers control of the affected browser tab. That control could allow attackers to crash the system, execute malicious code, or steal sensitive data.
No details were provided about who is exploiting the security flaw, how many people have fallen victim to it, or who is being targeted.
Related findings by Google researchers
Earlier this year, researchers at Google Threat Intelligence Group (GTIG) reported the first evidence of hackers using artificial intelligence to create a zero-day vulnerability. In a report in May the researchers wrote: “For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.” They added, “The criminal threat actor planned to use it in a mass exploitation event but our proactive counter discovery may have prevented its use.”
Google has advised Chrome users to protect themselves against the latest zero-day exploit by updating their web browser through Settings > About Chrome and installing any updates available.
