CVE-2026-85045
HighCVSS 7.5Summary
A race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The severity is rated as High.
Risk Assessment
An attacker could gain control of the victim's browser and execute malicious code, potentially leading to data theft or further system compromise.
Recommendation
Immediately update Google Chrome to version 152.0.7977.82 or later.
Other vulnerabilities in Google Chrome
See all- CVE-2026-85053High
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85052Low
Google Chrome prior to version 152.0.7977.82 has an out-of-bounds read vulnerability in CrashReporting. A remote attacker who compromised the renderer process could read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85051High
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85049High
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85048High
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85046High
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85044Unknown
Google Chrome on Android prior to version 152.0.7977.82 has a use-after-free vulnerability in the Mobile component. A remote attacker leveraging social engineering could bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-85043Unknown
Google Chrome prior to version 152.0.7977.82 has an incomplete cleanup vulnerability in the Network component. A remote attacker could bypass system access restrictions via crafted network traffic. (Chromium security severity: High)
- CVE-2026-8581High
A use after free vulnerability in GPU in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-8577High
Integer overflow in Fonts in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Original NVD description (English source)
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)