Chrome Zero-Day and WordPress Mass Attack: Patch Today

An actively exploited Chrome zero-day and a mass WordPress attack campaign are targeting UK businesses right now. CISA has confirmed active exploitation of CVE-2026-85046, a type confusion vulnerability in Chrome’s V8 JavaScript engine that requires no user interaction beyond visiting a malicious webpage. Over 440,000 exploit attempts have been documented against WordPress sites running vulnerable versions of Super Forms and Elementor Pro plugins. Both issues have patches available, but the gap between patch availability and patch deployment is where incidents happen. This episode walks through the specific actions required today: restarting Chrome browsers across all devices to force update installation, and applying WordPress plugin updates for CVE-2026-14894 and CVE-2026-32475. Corrine explains why small business size offers no protection against automated scanning campaigns, how to verify patches with IT providers, and why documented patch management provides both regulatory defence under UK GDPR Article 32 and commercial differentiation during client procurement.

Chapters

• Intro CISA confirms active exploitation of a Chrome zero-day. Over 440,000 WordPress exploit attempts documented. Both require immediate patching action today.
• Your Browser Is Being Exploited Right Now CVE-2026-85046 in Chrome’s V8 engine is on CISA’s Known Exploited Vulnerabilities catalogue. Attackers exploit it through malicious webpages with no visible warning. Affects all Chromium-based browsers. Requires browser restart to apply available patches. Verification needed across all devices and browsers including Edge, Opera, and Brave.
• CTA Request to follow, review, and share the podcast.
• WordPress Sites Are Under Mass Attack 440,000 exploit attempts targeting CVE-2026-14894 in Super Forms and CVE-2026-32475 in Elementor Pro. Both allow arbitrary PHP file upload and code execution. Automated scanners are hitting all WordPress installations indiscriminately. Successful compromise enables phishing hosting, malware distribution, and data exfiltration. Immediate plugin updates required.
• The Pattern Behind Both Stories The gap between patch availability and patch application is where incidents occur. Window between disclosure and active exploitation has collapsed. Routine patch management is an operational requirement, not a technical sophistication issue. NCSC guidance identifies patching as highly effective vulnerability management.
• How This Gives You an Edge Rapid response to threat intelligence is a competitive differentiator in regulated-sector procurement. Timestamped patch documentation provides evidence for GDPR compliance and insurance claims. Requires process, not certification.
• Making the Case to Your Board Cost asymmetry: patching takes seconds, breaches cost days. Automated attacks do not discriminate by company size. UK GDPR Article 32 requires appropriate technical measures; ignoring available patches creates regulatory exposure with the ICO.
• Outro Action summary: restart Chrome on all devices and apply all WordPress plugin updates today. Document completion with timestamps for regulatory and insurance purposes.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.wordfence.com/threat-intel/vulnerabilities/
• https://www.ncsc.gov.uk/collection/vulnerability-management