ZeroHour

CVE-2026-85042

mass

Use-after-free in Google Chrome DevTools enables sandbox-escaping code execution

CVSS 3.1
9.6 critical
EPSS
<1%p26
Published
()
Modified
AI analysis

CVE-2026-85042 is a use-after-free vulnerability (CWE-416) in the DevTools component of Google Chrome, affecting all versions prior to 152.0.7977.82. An attacker triggers the flaw by convincing a user to open a crafted HTML page, which corrupts memory in the DevTools code path. Successful exploitation allows a remote attacker to execute arbitrary code outside the Chrome sandbox, meaning code runs with the privileges of the browser process rather than being confined to a renderer — a significant escalation given the browser's usual sandbox protections. All Chrome users running builds earlier than 152.0.7977.82 are affected until they update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days; a related Chrome zero-day (CVE-2026-85046) has been reported exploited in the wild, but no in-the-wild exploitation of this specific flaw has been confirmed.

What to do: Update Chrome to 152.0.7977.82 or later immediately and verify the version at chrome://settings/help; organizations should enforce the update via managed browser policies. Because exploitation requires user interaction (visiting a crafted page), caution around untrusted web content is a reasonable interim mitigation. Given that a related Chrome zero-day (CVE-2026-85046) is being actively exploited, watch for a public PoC or KEV listing for this flaw as well.

Affected
google chromeall versions prior to 152.0.7977.82
Estimated exposure
masshundreds of millions to billions of users potentially exposed pre-patch (Chrome's global install base) — Chrome is the world's most widely used desktop browser with a reported user base in the billions, and the flaw spans every build before 152.0.7977.82, so exposure is limited mainly by auto-update lag rather than adoption.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors
google
Products
chrome
Weakness
CWE-416
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

In the news

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)

Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.

Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.