CVE-2026-85052
LowCVSS 3.1Summary
Google Chrome prior to version 152.0.7977.82 has an out-of-bounds read vulnerability in CrashReporting. A remote attacker who compromised the renderer process could read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Risk Assessment
The vulnerability could allow an attacker to access data outside the sandbox, increasing the risk of sensitive information leakage or further privilege escalation.
Recommendation
Update Google Chrome to version 152.0.7977.82 or later, which includes the fix.
Other vulnerabilities in Google Chrome
See all- CVE-2026-85053High
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85051High
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85049High
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85048High
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85046High
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85045High
A race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The severity is rated as High.
- CVE-2026-85044Unknown
Google Chrome on Android prior to version 152.0.7977.82 has a use-after-free vulnerability in the Mobile component. A remote attacker leveraging social engineering could bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-85043Unknown
Google Chrome prior to version 152.0.7977.82 has an incomplete cleanup vulnerability in the Network component. A remote attacker could bypass system access restrictions via crafted network traffic. (Chromium security severity: High)
- CVE-2026-8581High
A use after free vulnerability in GPU in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-8577High
Integer overflow in Fonts in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Original NVD description (English source)
Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)