ZeroHour

CVE-2026-85053

mass

CacheStorage Resource Exposure in Google Chrome Allows Sandboxed Code Execution

CVSS 3.1
8.8 high
EPSS
<1%p22
Published
()
Modified
AI analysis

CVE-2026-85053 is an improper resource exposure flaw (CWE-668) in the CacheStorage component of Google Chrome, affecting all versions prior to 152.0.7977.82. A remote attacker can trigger it by getting a user to load a crafted HTML page, where mishandled resource exposure in CacheStorage allows the attacker to execute arbitrary code inside the browser sandbox. Exploitation gains code execution within the sandbox on the victim's device; the CVSS 8.8 vector (network, low complexity, user interaction required) reflects high confidentiality, integrity, and availability impact. Effectively all Chrome users running versions before 152.0.7977.82 are exposed, across desktop and mobile installations. No public proof-of-concept or confirmed exploitation of this specific flaw is known (not in CISA KEV; EPSS 0.3%), although a related Chrome zero-day (CVE-2026-85046) has been reported exploited in the wild.

What to do: Update Chrome to 152.0.7977.82 or later via chrome://settings/help or your enterprise update-management channel, and verify fleet-wide versions using endpoint or EDR browser-version reporting. Until patched, avoid opening untrusted links, since exploitation requires user interaction with a crafted HTML page. Given related in-the-wild Chrome exploitation (CVE-2026-85046), prioritize this update even though no public PoC exists for this flaw.

Affected
Google ChromeAll versions prior to 152.0.7977.82
Estimated exposure
mass≈3 billion+ users (Chrome holds roughly 65% of global browser market share) — Chrome is the world's most widely used browser at approximately 65% of global market share, implying a user base in the low billions, and every release before 152.0.7977.82 is affected.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors
google
Products
chrome
Weakness
CWE-668
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In the news

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)

Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.

Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.