AI analysis
CVE-2026-85042 is a use-after-free vulnerability (CWE-416) in the DevTools component of Google Chrome, affecting all versions prior to 152.0.7977.82. An attacker triggers the flaw by convincing a user to open a crafted HTML page, which corrupts memory in the DevTools code path. Successful exploitation allows a remote attacker to execute arbitrary code outside the Chrome sandbox, meaning code runs with the privileges of the browser process rather than being confined to a renderer — a significant escalation given the browser's usual sandbox protections. All Chrome users running builds earlier than 152.0.7977.82 are affected until they update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days; a related Chrome zero-day (CVE-2026-85046) has been reported exploited in the wild, but no in-the-wild exploitation of this specific flaw has been confirmed.
What to do: Update Chrome to 152.0.7977.82 or later immediately and verify the version at chrome://settings/help; organizations should enforce the update via managed browser policies. Because exploitation requires user interaction (visiting a crafted page), caution around untrusted web content is a reasonable interim mitigation. Given that a related Chrome zero-day (CVE-2026-85046) is being actively exploited, watch for a public PoC or KEV listing for this flaw as well.
Affected
| google chrome | all versions prior to 152.0.7977.82 |
Estimated exposure
masshundreds of millions to billions of users potentially exposed pre-patch (Chrome's global install base) — Chrome is the world's most widely used desktop browser with a reported user base in the billions, and the flaw spans every build before 152.0.7977.82, so exposure is limited mainly by auto-update lag rather than adoption.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.