CVE-2026-85044
UnknownSummary
Google Chrome on Android prior to version 152.0.7977.82 has a use-after-free vulnerability in the Mobile component. A remote attacker leveraging social engineering could bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Risk Assessment
The vulnerability could allow an attacker to bypass origin policy, potentially leading to unauthorized access to data or actions in the context of another site.
Recommendation
Update Google Chrome on Android to version 152.0.7977.82 or later, which includes the fix.
Other vulnerabilities in Google Chrome
See all- CVE-2026-85053High
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85052Low
Google Chrome prior to version 152.0.7977.82 has an out-of-bounds read vulnerability in CrashReporting. A remote attacker who compromised the renderer process could read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85051High
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85049High
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85048High
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85046High
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85045High
A race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The severity is rated as High.
- CVE-2026-85043Unknown
Google Chrome prior to version 152.0.7977.82 has an incomplete cleanup vulnerability in the Network component. A remote attacker could bypass system access restrictions via crafted network traffic. (Chromium security severity: High)
- CVE-2026-8581High
A use after free vulnerability in GPU in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-8577High
Integer overflow in Fonts in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Original NVD description (English source)
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)