AI analysis
CVE-2026-85053 is an improper resource exposure flaw (CWE-668) in the CacheStorage component of Google Chrome, affecting all versions prior to 152.0.7977.82. A remote attacker can trigger it by getting a user to load a crafted HTML page, where mishandled resource exposure in CacheStorage allows the attacker to execute arbitrary code inside the browser sandbox. Exploitation gains code execution within the sandbox on the victim's device; the CVSS 8.8 vector (network, low complexity, user interaction required) reflects high confidentiality, integrity, and availability impact. Effectively all Chrome users running versions before 152.0.7977.82 are exposed, across desktop and mobile installations. No public proof-of-concept or confirmed exploitation of this specific flaw is known (not in CISA KEV; EPSS 0.3%), although a related Chrome zero-day (CVE-2026-85046) has been reported exploited in the wild.
What to do: Update Chrome to 152.0.7977.82 or later via chrome://settings/help or your enterprise update-management channel, and verify fleet-wide versions using endpoint or EDR browser-version reporting. Until patched, avoid opening untrusted links, since exploitation requires user interaction with a crafted HTML page. Given related in-the-wild Chrome exploitation (CVE-2026-85046), prioritize this update even though no public PoC exists for this flaw.
Affected
| Google Chrome | All versions prior to 152.0.7977.82 |
Estimated exposure
mass≈3 billion+ users (Chrome holds roughly 65% of global browser market share) — Chrome is the world's most widely used browser at approximately 65% of global market share, implying a user base in the low billions, and every release before 152.0.7977.82 is affected.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.