A newly discovered security flaw in Google Chrome and other Chromium-based browsers is being actively exploited by attackers right now, and the US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its list of known exploited vulnerabilities.

• What it is: A "type confusion" bug in the V8 JavaScript engine used by Chrome, Microsoft Edge, Brave and other Chromium-based browsers (CVE-2026-85046)
• Who is affected: Anyone running an outdated version of Chrome, Edge or another Chromium-based browser on Windows, Mac or Linux
• What the risk is: Attackers can exploit the flaw simply by getting a user to visit a malicious web page, potentially allowing remote code execution
• What to do: Chrome and Edge update automatically in most cases, but a restart is required to apply the fix. Check your browser's "About" menu to confirm you are on the latest version

We recommend restarting your browser today to make sure the update has been applied, and reminding staff to restart rather than simply leaving browser windows open indefinitely.