ZeroHour

CVE-2026-85049

mass

Use-After-Free in Google Chrome Skia Allows In-Sandbox Code Execution

CVSS 3.1
8.8 high
EPSS
<1%p22
Published
()
Modified
AI analysis

CVE-2026-85049 is a use-after-free (CWE-416) in Skia, the 2D graphics library Chrome uses to render web content, rated High with a CVSS of 8.8. A remote attacker can trigger the flaw by inducing a user to open a crafted HTML page, causing Chrome to free in-use memory during rendering. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, which limits compromise to the renderer process rather than the operating system, but still yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H). All users running Google Chrome prior to 152.0.7977.82 are affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates a 0.3% chance of exploitation within 30 days, although a related Chrome flaw (CVE-2026-85046) has been reported as a zero-day exploited in the wild.

What to do: Update Google Chrome to 152.0.7977.82 or later (via chrome://settings/help or your software distribution channel), since the fixed version is the only mitigation for this memory-safety bug. Organizations should verify deployed Chrome versions, push the update to managed browsers and endpoints, and prioritize rollout given a separate Chrome zero-day (CVE-2026-85046) is already being exploited in the wild.

Affected
Google ChromeAll versions prior to 152.0.7977.82
Estimated exposure
massmore than 1 billion Chrome users (essentially Chrome's entire install base on versions before 152.0.7977.82) — Chrome is the world's most-used browser with roughly 65% market share and billions of users, so until patched the exposure spans the bulk of that install base.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors
google
Products
chrome
Weakness
CWE-416
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In the news

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)

Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.

Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.