Chrome zero-day CVE-2026-85046 patch and CISA KEV addition

Chrome zero-day CVE-2026-85046 patch and CISA KEV addition: why this matters

This combination — an urgent vendor patch plus a KEV listing — creates a short timeline for action. For consumers and small businesses, failing to act quickly increases the chance devices will be targeted, because threats that are known to be exploited attract follow‑on attacks. The vendor fix is confirmed by Google, and CISA’s KEV entry is an official signal used by many security teams to prioritize fixes [1][2].

Confirmed facts, official announcements, and reporting

• Google announced the Stable update on Sep 3, 2026 that addresses CVE‑2026‑85046; this announcement is the vendor’s official notice and lists affected platforms and the update cadence [1].
• CISA added CVE‑2026‑85046 to its Known Exploited Vulnerabilities (KEV) catalog on Sep 4, 2026; the agency uses KEV to highlight vulnerabilities that should be fixed rapidly in critical infrastructure and enterprise settings [2].
• Independent reporting summarized the patch and its context, describing this as one of several exploited Chrome zero‑days in 2026 and emphasizing active exploitation in the wild [3].

Technical summary (confirmed)

Google describes CVE‑2026‑85046 as a type‑confusion flaw in the V8 JavaScript engine. Type‑confusion bugs can allow attackers to corrupt memory or execute arbitrary code inside the browser process. Google confirmed the issue is being exploited in the wild, which is why the update was expedited [1].

Immediate checklist for consumers (what to do right now)

• Update Chrome now: Open Chrome, go to Settings > About Chrome (or let the browser auto‑update). Apply the Stable update released Sep 3, 2026 and restart the browser. This is the primary mitigation because the vendor patch fixes the exploited flaw [1].
• Restart shared devices: If multiple people use machines in your home or small office, restart those devices after updating to ensure the patched process is running.
• Use caution with unknown links and attachments: Because the bug is exploited in the wild, avoid clicking untrusted links, opening unexpected attachments, or visiting suspicious sites until all devices are patched.
• Update other Chromium‑based browsers: Many browsers use the Chromium engine and may receive their own updates. Check your browser vendor’s advisory and update accordingly.

Actions for small businesses and IT managers

Small IT teams should treat this as high priority. CISA’s KEV listing on Sep 4, 2026 is used by many organizations to set patch windows and compliance deadlines [2]. Follow these steps.

• Verify state across the fleet: Inventory desktop and laptop endpoints running Chrome or Chromium forks. Record version numbers and update status.
• Push Chrome 152 via your management tools: Use your enterprise update mechanism (WSUS, SCCM, Intune, Jamf, or other MDM) to force or schedule the Stable update where available. Google’s Stable announcement provides the official patch details [1].
• Prioritize critical systems: If you manage higher‑risk endpoints (payment terminals, remote workstations, shared kiosk machines), update them first and then proceed to the general fleet.
• Document and report: Record remediation actions and timelines. If you are in critical infrastructure or regulated industries, using CISA KEV mapping can support compliance proof [2].

Interim mitigations (if you cannot patch immediately)

• Temporarily restrict access to potentially risky sites using web filters or allow‑listing.
• Temporarily block execution of untrusted JavaScript via content security policies on company web assets.
• Consider using a different browser that is not impacted by this specific V8 vulnerability, but verify that the alternative vendor has no related exposure.

How to confirm the patch and what to look for

After updating, confirm your Chrome version shows the patched release number. Google’s Stable announcement lists the fixed release and platforms; check that your machines match that version or later [1].

Chrome zero-day CVE-2026-85046 patch and CISA KEV addition: timeline and sources

Sep 3, 2026 — Google released the Stable‑channel update (Chrome 152) fixing CVE‑2026‑85046 and published the official release note [1] (official announcement). Sep 4, 2026 — CISA added CVE‑2026‑85046 to its Known Exploited Vulnerabilities catalog, a formal prioritization directive used by many organizations [2] (official announcement). Subsequent reporting summarized the impact and context on Sep 6, 2026 [3] (independent reporting). All dates are stated as of the original announcements.

Confirmed vs. analysis vs. estimates

• Confirmed: Google patched CVE‑2026‑85046 and noted it is exploited in the wild; CISA added the CVE to KEV [1][2].
• Independent reporting: Trade reporting noted this is another actively exploited Chrome zero‑day in 2026 and provided broader context for threat activity [3].
• Analysis/estimate: We estimate rapid exploitation interest will remain high for days after public disclosure; therefore, apply the patch promptly. This is an analyst judgment based on historical patterns, not a new vendor claim.

Which users should update, upgrade, or wait?

Practical next steps

1. Update Chrome and other Chromium browsers immediately on all devices [1].
2. If you manage a fleet, schedule an urgent patch window and force the update through your management tools.
3. Document completion and verify versions match Google’s patched release [1].
4. Monitor logs and endpoints for signs of compromise; engage an incident responder if you observe suspicious behavior.

Risk, limitations, and remaining uncertainties

While the patch eliminates the known exploit path described by Google, new exploit variants or unrelated vulnerabilities may still pose risks. CISA’s KEV listing is a prioritization signal, but it does not replace local vulnerability management processes [2]. Additionally, some Chromium‑based browsers and older operating systems may lag in receiving vendor updates; those gaps create residual exposure.

Additional resources

• Google Chrome Releases — Stable Channel Update for Desktop (official vendor announcement) [1].
• CISA — CISA Adds One Known Exploited Vulnerability to Catalog (KEV entry) [2].
• Independent reporting and analysis summarizing the patch and exploitation context [3].

Bottom line

Act now. The combination of the Chrome zero-day CVE-2026-85046 patch and CISA KEV addition compresses the window for remediation. For most users and small businesses, the fastest and most reliable step is to apply the Chrome Stable update released Sep 3, 2026 and confirm all endpoints are running the patched version [1][2].

Frequently asked questions