Two critical Chrome flaws put users at risk on malicious websites
September 2, 2026 · Malwarebytes · Severity: CRITICAL
Google has released an urgent Chrome update addressing 26 security fixes, including two critical use-after-free vulnerabilities and an actively exploited flaw in the V8 engine (CVE-2026-85046). Attackers can exploit these flaws via crafted HTML pages to execute arbitrary code, making immediate patching essential for all users. 📌 **Analyst Note:** This is critical because the V8 flaw is already being exploited in the wild, and the use-after-free vulnerabilities allow code execution without user interaction, putting millions of Chrome users at immediate risk.
Update September 4, 2026
Shortly after this article was published, Google released another Chrome update that patches an actively exploited flaw in the V8 JavaScript engine, tracked as CVE-2026-85046.
Google rates the vulnerability as high severity and says an exploit already exists in the wild. An attacker could use a crafted HTML page to execute arbitrary code inside the Chrome sandbox. Because it is already being exploited, HKCERT rates the overall risk as extremely high.
After installing the latest update, Chrome should be at version 152.0.7977.82/.83 on Windows and Mac, or 152.0.7977.82 on Linux.
Chrome is rolling out an update for its desktop browser. The update includes 26 security fixes, two of which Google rates as critical use-after-free vulnerabilities.
How to update Chrome
If you don’t want to wait for the rollout to reach you, manually updating is easy.
The easiest option is to allow Chrome to update automatically. But you can end up lagging behind if you never close your browser or if something goes wrong with the update.
To update manually, click the More menu (three dots), then go to Settings > About Chrome. If an update is available, Chrome will start downloading it automatically. Restart Chrome to complete the update, and you’ll be protected against these vulnerabilities.
You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.
Technical details
Let’s look at the two critical vulnerabilities. Both are use-after-free (UAF) vulnerabilities. A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.
The first, tracked as CVE-2026-84353, was found in Shared Tab Groups and could allow a remote attacker using social engineering to execute arbitrary code outside the browser sandbox via a crafted HTML page. Here, social engineering likely means an attacker would have to lure you to a malicious website or open an email in HTML format.
The other critical vulnerability, tracked as CVE-2026-84352, was found in WebGL. WebGL, short for Web Graphics Library, is a browser technology that lets websites display interactive 2D and 3D graphics. The vulnerability could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without requiring additional exploitation steps.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Key Takeaways
- Google released an emergency Chrome update to patch CVE-2026-85046, a high-severity V8 JavaScript engine flaw that is already being actively exploited in the wild by attackers.
- The two critical use-after-free vulnerabilities in Chrome could allow attackers to execute arbitrary code on users' systems simply by visiting a malicious website, posing severe risks.
- Users must update Chrome to version 152.0.7977.82/.83 on Windows and Mac or 152.0.7977.82 on Linux immediately to protect against these actively exploited flaws.