AI analysis
CVE-2026-85048 is a use-after-free vulnerability in the Compositing component of Google Chrome in versions prior to 152.0.7977.82. An attacker can trigger the flaw by inducing a user to load a crafted HTML page; the bug is exploitable after the attacker has already compromised the Chrome renderer process, and the memory corruption then lets them escape it. Successful exploitation yields arbitrary code execution outside the Chrome sandbox, with high impact on confidentiality, integrity, and availability of the underlying system (CVSS 3.1: 8.3, High). Anyone running an affected Chrome build is exposed, with no privileges required on the target beyond user interaction with attacker-controlled web content. As of now, there is no known public proof-of-concept and the flaw is not in CISA's KEV catalog, with a low EPSS score of 0.3%, though a sibling Chrome zero-day (CVE-2026-85046) was reported exploited in the wild, suggesting urgent patching is warranted.
What to do: Update Google Chrome to 152.0.7977.82 or later immediately — go to Settings > About Chrome (or chrome://settings/help) to force the update and restart the browser, then verify the fixed version at chrome://version. Given the sibling CVE-2026-85046 is actively exploited, organizations should push this update through their patch management with high priority and confirm no fleet endpoints remain on pre-152.0.7977.82 builds.
Affected
| Google Chrome | prior to 152.0.7977.82 |
Estimated exposure
masshundreds of millions of users plausibly affected (Chrome install base is ~3B+; vulnerable installs persist until auto-update completes) — Chrome's global user base is on the order of billions with roughly two-thirds browser market share, so the population of desktop installs not yet on the fixed 152.0.7977.82 release at any given moment likely reaches the hundreds of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.