Google has shipped a new Chrome desktop release that closes 12 security holes, and one of them was already being used in attacks before the fix arrived. Hong Kong's HKCERT, relaying Google's advisory, rates the release "Extremely High Risk" on the strength of that single bug.
The flaw is tracked as CVE-2026-85046. According to the advisory, a remote attacker can exploit it to run arbitrary code inside Chrome's sandbox using a crafted HTML page. In plain terms, simply loading a booby-trapped web page is enough to get an attacker's code running inside the browser, in the walled-off area Chrome uses to contain untrusted web content.
A sandbox is a wall, not a vault
Code landing inside the sandbox is not the same as code landing on your desktop. The sandbox exists precisely so that a compromised web page cannot immediately reach your files, and an attacker who gets that far usually still needs a second bug to break out. That is the containment Google's advisory describes, and it is worth being precise about, because it is also the containment that every attacker chaining browser exploits is trying to defeat.
Neither Google's release note nor the bulletin relaying it says who is exploiting the flaw, against whom, or since when. No CVSS score is published for any of the 12 issues, and no affected-version detail is given beyond the release numbers below. Anyone telling you more than that about this specific bug is filling in blanks the vendor left empty.
Eleven more fixes, and no scorecard
The other 11 identifiers in the release are CVE-2026-85042, CVE-2026-85043, CVE-2026-85044, CVE-2026-85045, CVE-2026-85047, CVE-2026-85048, CVE-2026-85049, CVE-2026-85050, CVE-2026-85051, CVE-2026-85052 and CVE-2026-85053. Taken together, the advisory says the set can lead to remote code execution, denial of service, elevation of privilege, security restriction bypass and information disclosure. It does not break down which flaw does which, so treat that as a description of the batch rather than of any one entry.
Restart Chrome, or you are still on the old build
The fixed builds are Chrome 152.0.7977.82 or later on Linux, and 152.0.7977.82 or .83 or later on Windows and macOS. Chrome downloads updates in the background but only swaps in the new binary when the browser is relaunched, so a machine that has been left open for a week may show the update as ready and still be running the vulnerable build. Check the version under Help then About Google Chrome, then close and reopen every window. Managed fleets should confirm the rollout rather than assume it, since a browser nobody restarts is a browser nobody patched.
Details come from Google's Chrome Releases advisory, relayed in HKCERT's security bulletin. Google's note is where any further technical detail will appear, and the company routinely withholds it until most users have updated.
This is the second Chrome update in under two weeks to fix a flaw that a single web page can reach. The late-August 152 release patched a critical sandbox escape with no sign of exploitation attached to it. This one arrives with that sign attached, which is the difference between a patch you schedule and a patch you apply today.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.