CVE-2026-85045

CVE-2026-85045 is a race condition (CWE-367, a time-of-check-to-time-of-use flaw) in the V8 JavaScript engine used by Google Chrome. An attacker triggers it by persuading a user to open a specially crafted HTML page, in which a timing window during V8's handling of an object leaves stale state that the attacker can leverage. Successful exploitation lets a remote attacker execute arbitrary code inside Chrome's renderer sandbox (but not escape it), yielding code execution at the browser's sandboxed privilege level; CVSS 3.1 rates this 7.5 High with a network vector, high attack complexity, and required user interaction. All Google Chrome installations running versions prior to 152.0.7977.82 are affected, which given Chrome's ubiquity means effectively every unpatched desktop and mobile Chrome deployment worldwide. No public proof-of-concept is known, the flaw is not on the CISA KEV catalog, and EPSS estimates a ~0.2% chance of exploitation within 30 days, though related reporting describes a sibling Chrome zero-day (CVE-2026-85046) exploited in the wild, signaling active attacker interest in this V8 code.

What to do: Update Google Chrome to 152.0.7977.82 or later on all endpoints and enforce the minimum version centrally (MDM/GPO/Intune/EDR), prioritizing internet-facing and high-risk users. Because the related Chrome zero-day CVE-2026-85046 was reportedly exploited in the wild and was addressed in the same release, treat this patch cycle as urgent. Also verify browser versions in any Chromium-based derivatives in your fleet, which typically pick up the V8 fix on their own release schedules.