Google Patches Actively Exploited Chrome Zero-Day

Google has released an emergency security update for Chrome to address a zero-day vulnerability that's being actively exploited in the wild. The flaw is being used in targeted attacks against journalists and human rights activists.

Vulnerability Overview

• CVE: CVE-2026-0412
• CVSS Score: 8.8 (High)
• Component: V8 JavaScript engine
• Type: Type confusion vulnerability

Active Exploitation

Google's Threat Analysis Group (TAG) discovered the vulnerability being exploited by a sophisticated threat actor:

• Targets include journalists in multiple countries
• Attacks delivered via spear-phishing emails
• Exploitation leads to full browser compromise
• Evidence suggests nation-state involvement

Technical Details

The vulnerability exists in Chrome's V8 JavaScript engine:

Type: Type Confusion in V8
Impact: Remote Code Execution
Prerequisite: Visit malicious website
User Interaction: None beyond page visit

Affected Versions

Update Instructions

Chrome should update automatically, but to verify:

1. Open Chrome menu (three dots)
2. Help > About Google Chrome
3. Chrome will check for updates
4. Restart browser to complete update

Chromium-Based Browsers

Other browsers using Chromium are also affected:

• Microsoft Edge - Update expected shortly
• Brave - Patch in progress
• Opera - Update pending
• Vivaldi - Working on fix

This Year's Zero-Days

This is the fourth Chrome zero-day patched in 2026:

Recommendations

1. Immediate: Update Chrome to latest version
2. Enable auto-updates: Ensure Chrome updates automatically
3. Consider Site Isolation: Already default but verify enabled
4. High-risk users: Consider Chrome's Enhanced Safe Browsing

Google's Statement

"We are aware of reports that an exploit for CVE-2026-0412 exists in the wild. We thank the researchers who reported this issue and are committed to protecting our users."

Sources: Google Security Blog, The Hacker News, BleepingComputer

Related Reading

• Google Patches First Chrome Zero-Day of 2026: CVE-2026-2441
• Google Chrome Critical Update Patches High-Severity Code
• Ex-L3Harris Executive Pleads Guilty to Selling Eight