Google just shipped an emergency fix for a Chrome bug that was already being used against real people. Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046, carries a CVSS score of 8.8, and has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. That's the engine that runs JavaScript, not just in Chrome, but in every browser built on Chrome's underlying Chromium code.

Here's what the bug actually does, in plain English. It's called a type confusion flaw. Per a CVE.org description quoted in the coverage, "type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page." Translation: a hacker builds a normal-looking webpage. You open it. The browser gets tricked into treating one kind of data as another. That confusion corrupts memory. From there, an attacker can run their own code inside your browser. No download needed. No sketchy link to click, beyond just loading the page. Security researcher Salvatore Gulizia, who goes by Serotav, has been credited with discovering and reporting the flaw on August 4, 2026. His reward for catching a bug this serious? A $1,000 bounty, thin compensation for a critical zero-day confirmed under active exploitation.

This is not a one-off. With this fix, Google has addressed a total of six actively exploited Chrome zero-days since the start of the year, including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. Six Chrome V8 zero-days in nine months establish V8 as a systematic, high-frequency attack surface that every Chromium-derived fleet inherits. And that word, inherits, matters more than it sounds like it should. Edge, Brave, Opera, and Vivaldi all inherit the flaw through Chromium and require the same 152.0.7977.82 build to be patched. That list includes Microsoft Edge. The browser Copilot lives inside.

So here's the concrete step. If you use Chrome, open the menu, go to Help, then About Google Chrome, and let it relaunch. That installs Chrome version 152.0.7977.82 or .83 for Windows and Apple macOS, and 152.0.7977.82 for Linux, closing the hole. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available. Do this today. Not this weekend. The bug is already being used against people right now, not theoretically.

My Take

Here's the part that made me sit up. We've already spent two posts in this newsletter on what happens when you let an AI act inside your browser on your behalf. Microsoft's Copilot had a flaw that let a single click quietly pull data out of a user's Gmail, Drive, and calendar, and it took Microsoft nearly eight months to fix it. Weeks before that, a federal appeals court ruled that when an AI browser logs into your Amazon account and buys something, that's legally treated as you doing the shopping, password and all. Both of those stories were about the AI itself going sideways. This one is different, and in some ways scarier. This bug doesn't need your Copilot or your AI browser agent to make a single mistake. It just needs you to open a crafted webpage while that AI has your accounts connected. The vulnerable engine sits underneath everything: the AI, the browser, your inbox, your calendar. All of it, running on the same compromised foundation.

There's also a fairness problem worth naming. A researcher found a critical, actively exploited hole in software billions of people rely on every single day, and he was paid $1,000 for it. That's a strange price tag for a bug serious enough to force an emergency patch across five different browsers.

The honest downside is that this cycle isn't slowing down. Six zero-days in a single engine in nine months isn't an accident. It's a pattern. And patching after the fact means you're only ever as safe as your last update. If you've handed an AI copilot or browser agent access to your email, your calendar, or your accounts, this is a good week to check exactly what permissions it has, and to stop putting off that browser update.