How to Protect Your Android Device From Chrome Zero-Day CVE-2026-85046

Google confirmed that attackers are actively exploiting a security flaw in Chrome's V8 engine. The vulnerability, tracked as CVE-2026-85046, is a type confusion bug in the JavaScript engine that lets a malicious webpage execute code inside your browser. Google rated it High severity with a CVSS score of 8.8, and it's the sixth Chrome zero-day patched in 2026 alone.

If you use Chrome on Android (or any Chromium-based browser like Edge, Brave, or Vivaldi), here's what happened, why it matters, and exactly what to do about it.

What CVE-2026-85046 Actually Does

The vulnerability lives in V8, Chrome's JavaScript and WebAssembly engine. Specifically, it's a type confusion flaw in the JIT compiler modules Maglev and TurboFan. When V8 optimizes inline calls to Array.prototype.sort, it miscalculates the element types of an array. The JIT code takes a snapshot of array elements, runs a user-controlled comparison function, then writes the snapshot back using an incorrect type assumption. This mismatch corrupts memory in a way that an attacker can exploit.

In plain terms: V8 misidentifies what kind of data it's looking at. A crafted webpage can trick the engine into treating object pointers as simple integers (or vice versa), which breaks memory safety. The result is arbitrary code execution within Chrome's renderer process.

Google hasn't released full exploit details, and they're deliberately restricting access to the technical specifics until most users have updated. What we know comes from the official advisory and NVD entry.

Step 1: Check Your Chrome Version on Android

Google Chrome

Google LLC

Google Chrome is a web browser app that helps you search, read, shop, and manage online tasks.

Communication Browser

Download (145.3 MB)

Open Chrome on your Android device.
Tap the three-dot menu in the top-right corner
Then, go to Settings. Scroll to the bottom and tap "About Chrome." You'll see the full version number listed under the application name.

The patched version is 152.0.7977.82 or higher. If your version starts with 152 but the tail is lower than .7977.82, you're still vulnerable. If you're on a version below 152 entirely, the same applies.

Write down or screenshot the version number. You'll need it for verification after updating.

Step 2: Trigger the Update Manually

Chrome on Android updates through Google Play, not through the browser itself. That catches people off guard because the "About Chrome" page on desktop shows an update button, but on mobile it doesn't.

Open the Google Play Store. Tap your profile picture in the top-right corner. Select "Manage apps and device." If Chrome appears in the list of pending updates, tap "Update" next to it. If it doesn't appear, tap "Check for updates" to force a refresh.

For users who disabled auto-update for Chrome specifically (not recommended for a browser), this is the moment to re-enable it. Go to Play Store > Manage apps > Chrome > tap the three dots > Enable auto-update.

Step 3: Restart Chrome Completely

This is the step most people skip. Downloading the update through APKPure replaces the app package on your device, but the browser process that's already running still uses the old code. Chrome won't apply the security patch until you fully restart it.

Close Chrome by swiping it away from your recent apps list. On most Android devices, swipe up from the bottom of the screen to open the app switcher, then swipe Chrome off the screen horizontally. Wait a few seconds, then reopen Chrome.

To confirm the restart worked, go back to Settings > About Chrome and verify the version number matches or exceeds 152.0.7977.82.

Step 4: Check Other Chromium Browsers

If you use Microsoft Edge, Brave, Vivaldi, or Opera on Android, they all share the same V8 engine and are equally affected. Each browser vendor pushes their own update through Play Store with a patched version of the Chromium codebase.

Update each browser individually through APKPure using the same process in Step 2. Brave users should specifically look for version 152.x or higher. Edge users should check for a similar version bump.

If you installed a Chromium browser through direct APK download rather than Play Store, check the browser's official website for the patched version and download it directly.

Step 5: Clear Browser Data After Updating

A successful exploit running inside Chrome's renderer could have stored malicious data in your browser cache, cookies, or local storage. Updating the browser fixes the vulnerability going forward, but it doesn't clean up anything an attacker might have already placed.

Go to Chrome > Settings > Privacy and security > Clear browsing data.
Select "Cached images and files" and "Cookies and site data."
Choose "All time" as the time range. Tap "Clear data."

This will log you out of websites and reset cached content, which is a minor inconvenience. Given that this vulnerability was actively exploited, the trade-off is worth it.

How the Attack Actually Reaches You

The exploit requires one thing: loading a malicious webpage in a vulnerable browser. That's it. No file download, no app install, no permissions grant. Just visiting a page.

Attackers have several delivery channels for getting you to load a malicious page:

Phishing emails with links that look legitimate

Malicious advertisements on otherwise legitimate websites (malvertising)

Social media messages with shortened or disguised links

Compromised legitimate websites that inject malicious scripts into their pages

The last one is particularly concerning because you can't avoid it through caution alone. A website you trust could be compromised and serve the exploit without the site owner's knowledge.

Tips for Staying Protected Going Forward

Enable automatic updates in Play Store. Chrome should always be on the latest version. Go to Play Store > profile > Settings > Network preferences > Auto-update apps > Over any network. This ensures browser patches arrive without your intervention.

Turn on Enhanced Protection in Chrome. Go to Chrome > Settings > Privacy and security > Safe Browsing. Select "Enhanced protection." This mode uses real-time URL checks and deeper file analysis, which adds a layer against malicious pages.

Check chrome://version, not just the About page. If you want to be thorough, type chrome://version in the address bar. The full version string appears at the top. Confirm every digit matches the patched version.

Keep your Android system updated too. Chrome's sandbox limits what an attacker can do even if they exploit V8, but sandbox escapes sometimes depend on OS-level weaknesses. System updates close those gaps.

Troubleshooting Common Update Issues

Chrome doesn't show an update in the Play Store. Google rolls out updates in stages. If the patched version hasn't reached your device yet, it may take a few days. You can sideload the APK from a trusted source if the delay is unacceptable, but most users should just wait.

The update installs but the version number doesn't change. You probably didn't restart Chrome. Close it from the recent apps list and reopen. If it still shows the old version, your device may have multiple Chrome installations (stable, beta, dev). Make sure you're checking the right one.

Play Store shows "App not installed" or an error code. Clear the Play Store cache: Settings > Apps > Google Play Store > Storage > Clear cache. Then retry the update. If storage space is the issue, free up at least 200MB and try again.

You're on a work-managed device. Managed Android devices may restrict updates to approved rollouts. Contact your IT administrator and reference CVE-2026-85046. Managed Chrome deployments should update through the Google Admin console, which may follow a slower rollout schedule.

Google Chrome

Google LLC

Google Chrome is a web browser app that helps you search, read, shop, and manage online tasks.

Communication Browser

Download (145.3 MB)

Why This Vulnerability Matters for Android Users

Chrome on Android runs the same V8 engine as its desktop counterpart. The same type confusion bug, the same exploit path, and the same patch apply. The attack surface is actually broader on mobile because people are more likely to tap links from emails, messages, and social media on their phones than on a desktop.

The sandbox in Chrome limits the damage to the browser process. An attacker who exploits CVE-2026-85046 gets code execution inside the renderer, not full device control. But "just the renderer" still means access to your cookies, saved passwords, session tokens, and any data a website you're logged into exposes through its API. That's enough to hijack accounts.

Google's $1,000 bounty for this finding has drawn some criticism as low for a zero-day with active exploitation. The researcher, Salvatore Gulizia (Serotav), reported it on August 4, 2026, and Google patched it roughly a month later. The relatively quick turnaround suggests Google treated it with urgency despite the modest payout.

CVE-2026-85046 is the sixth Chrome zero-day of 2026, and the fact that attackers were already using it means the threat isn't theoretical. Update Chrome through APKPure, restart the app, verify the version reads 152.0.7977.82 or higher, and clear your browsing data. If you use Edge, Brave, or another Chromium browser, apply the same steps. Enabling automatic updates and Enhanced Protection reduces the chance that the next zero-day catches you off guard.