CVE-2026-85044

CVE-2026-85044 is a use-of-released-resource flaw (CWE-672) in the mobile-specific code of Google Chrome on Android, rated Medium (CVSS 6.5) with an integrity-only impact. A remote attacker must use social engineering to persuade a user to open a crafted HTML page, after which the bug allows the web origin (same-origin) policy to be bypassed. A successful attacker can act across origin boundaries in the affected browsing session; the CVSS vector indicates no direct confidentiality or availability loss. Only Chrome for Android builds prior to 152.0.7977.82 are affected; desktop Chrome and other browsers are not named in the advisory. No public proof-of-concept, KEV listing, or confirmed exploitation exists for this CVE (EPSS 0.2%), although a related Chrome zero-day (CVE-2026-85046) is reported exploited in the wild.

What to do: Update Chrome on Android to 152.0.7977.82 or later via the Google Play Store (Settings > About Chrome) on all managed and BYOD devices. Since the flaw requires social engineering and user interaction, reinforce user caution with unsolicited links; desktop Chrome is not listed as affected by this CVE. Monitor Chrome releases closely, as a related Chrome zero-day (CVE-2026-85046) is being actively exploited.