AI analysis
CVE-2026-85049 is a use-after-free (CWE-416) in Skia, the 2D graphics library Chrome uses to render web content, rated High with a CVSS of 8.8. A remote attacker can trigger the flaw by inducing a user to open a crafted HTML page, causing Chrome to free in-use memory during rendering. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, which limits compromise to the renderer process rather than the operating system, but still yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H). All users running Google Chrome prior to 152.0.7977.82 are affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates a 0.3% chance of exploitation within 30 days, although a related Chrome flaw (CVE-2026-85046) has been reported as a zero-day exploited in the wild.
What to do: Update Google Chrome to 152.0.7977.82 or later (via chrome://settings/help or your software distribution channel), since the fixed version is the only mitigation for this memory-safety bug. Organizations should verify deployed Chrome versions, push the update to managed browsers and endpoints, and prioritize rollout given a separate Chrome zero-day (CVE-2026-85046) is already being exploited in the wild.
Affected
| Google Chrome | All versions prior to 152.0.7977.82 |
Estimated exposure
massmore than 1 billion Chrome users (essentially Chrome's entire install base on versions before 152.0.7977.82) — Chrome is the world's most-used browser with roughly 65% market share and billions of users, so until patched the exposure spans the bulk of that install base.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.