GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

NCSC-2026-0341

Vulnerability from csaf_ncscnl - Published: 2026-09-04 13:20 - Updated: 2026-09-04 13:20
Summary
Kwetsbaarheden verholpen in Google Chrome
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Google heeft meerdere kwetsbaarheden verholpen in Google Chrome, specifiek in versies voor 152.0.7977.82.
Interpretaties: De kwetsbaarheden bevinden zich in verschillende componenten van Google Chrome, waaronder DevTools, Network, V8 JavaScript engine en Transactions Platform op iOS. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal vervaardigde HTML-pagina's aan te bieden, wat kan leiden tot het uitvoeren van willekeurige code buiten de sandboxomgeving, het omzeilen van toegangsbeperkingen, het lezen van geheugen buiten de sandbox, en het compromitteren van de isolatie van webcontent. De kwetsbaarheden zijn specifiek van toepassing op Google Chrome en zijn verschillende componenten, inclusief versies op Android en iOS. Google geeft aan dat voor CVE-2026-85046 publieke PoC beschikbaar is.
Oplossingen: Google heeft updates uitgebracht om de kwetsbaarheden in Google Chrome te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-125: Out-of-bounds Read
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-416: Use After Free
CWE-459: Incomplete Cleanup
CWE-672: Operation on a Resource after Expiration or Release
CWE-787: Out-of-bounds Write
CWE-825: Expired Pointer Dereference
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CVE-2026-85042

A use-after-free vulnerability in Google Chrome DevTools before version 152.0.7977.82 allowed remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page, posing a high security risk.

9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85043

A high-severity vulnerability in Google Chrome before version 152.0.7977.82 involved incomplete cleanup in the Network component, allowing remote attackers to bypass system access restrictions via crafted network traffic.

CWE-459 - Incomplete Cleanup
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85044

A medium-severity vulnerability in Google Chrome on Android before version 152.0.7977.82 allowed remote attackers to bypass the web origin policy via a crafted HTML page exploiting released resource handling on mobile devices.

CWE-672 - Operation on a Resource after Expiration or Release
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85045

A race condition vulnerability in the V8 engine of Google Chrome prior to version 152.0.7977.82 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85046

A type confusion vulnerability in the V8 engine of Google Chrome prior to version 152.0.7977.82 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85047

Google Chrome on iOS versions before 152.0.7977.82 contains a medium-severity vulnerability in its Transactions Platform due to improper input validation, allowing remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages.

9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85048

Google Chrome versions prior to 152.0.7977.82 contain a high severity use-after-free vulnerability in the Compositing component that allows remote code execution via crafted HTML content.

8.3 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85049

A use-after-free vulnerability in the Skia component of Chromium-based Chrome prior to version 152.0.7977.82 allows remote code execution within the sandbox via crafted HTML, rated as high severity.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85050

Google Chrome for Android versions prior to 152.0.7977.82 contain a high-severity out of bounds write vulnerability in WebGL that allows remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages.

9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85052

Google Chrome before version 152.0.7977.82 contains a high-severity out-of-bounds read vulnerability in the CrashReporting component that allows remote attackers with renderer process access to read memory outside the sandbox via crafted HTML pages.

3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
CVE-2026-85053

A high-severity vulnerability in Google Chrome before version 152.0.7977.82 allowed remote code execution within the sandbox via improper resource exposure in CacheStorage triggered by a crafted HTML page.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Chrome
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Google heeft meerdere kwetsbaarheden verholpen in Google Chrome, specifiek in versies voor 152.0.7977.82.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden bevinden zich in verschillende componenten van Google Chrome, waaronder DevTools, Network, V8 JavaScript engine en Transactions Platform op iOS. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal vervaardigde HTML-pagina\u0027s aan te bieden, wat kan leiden tot het uitvoeren van willekeurige code buiten de sandboxomgeving, het omzeilen van toegangsbeperkingen, het lezen van geheugen buiten de sandbox, en het compromitteren van de isolatie van webcontent. De kwetsbaarheden zijn specifiek van toepassing op Google Chrome en zijn verschillende componenten, inclusief versies op Android en iOS.\n\nGoogle geeft aan dat voor CVE-2026-85046 publieke PoC beschikbaar is.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Google heeft updates uitgebracht om de kwetsbaarheden in Google Chrome te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
        "title": "CWE-367"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "Incomplete Cleanup",
        "title": "CWE-459"
      },
      {
        "category": "general",
        "text": "Operation on a Resource after Expiration or Release",
        "title": "CWE-672"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Expired Pointer Dereference",
        "title": "CWE-825"
      },
      {
        "category": "general",
        "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
        "title": "CWE-843"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Google Chrome",
    "tracking": {
      "current_release_date": "2026-09-04T13:20:15.365981Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0341",
      "initial_release_date": "2026-09-04T13:20:15.365981Z",
      "revision_history": [
        {
          "date": "2026-09-04T13:20:15.365981Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Chrome"
          }
        ],
        "category": "vendor",
        "name": "Google"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-85042",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "A use-after-free vulnerability in Google Chrome DevTools before version 152.0.7977.82 allowed remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page, posing a high security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85042 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85042.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85042"
    },
    {
      "cve": "CVE-2026-85043",
      "cwe": {
        "id": "CWE-459",
        "name": "Incomplete Cleanup"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incomplete Cleanup",
          "title": "CWE-459"
        },
        {
          "category": "description",
          "text": "A high-severity vulnerability in Google Chrome before version 152.0.7977.82 involved incomplete cleanup in the Network component, allowing remote attackers to bypass system access restrictions via crafted network traffic.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85043 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85043.json"
        }
      ],
      "title": "CVE-2026-85043"
    },
    {
      "cve": "CVE-2026-85044",
      "cwe": {
        "id": "CWE-672",
        "name": "Operation on a Resource after Expiration or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Operation on a Resource after Expiration or Release",
          "title": "CWE-672"
        },
        {
          "category": "description",
          "text": "A medium-severity vulnerability in Google Chrome on Android before version 152.0.7977.82 allowed remote attackers to bypass the web origin policy via a crafted HTML page exploiting released resource handling on mobile devices.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85044 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85044.json"
        }
      ],
      "title": "CVE-2026-85044"
    },
    {
      "cve": "CVE-2026-85045",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "other",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "title": "CWE-367"
        },
        {
          "category": "description",
          "text": "A race condition vulnerability in the V8 engine of Google Chrome prior to version 152.0.7977.82 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85045 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85045.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85045"
    },
    {
      "cve": "CVE-2026-85046",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
          "title": "CWE-843"
        },
        {
          "category": "description",
          "text": "A type confusion vulnerability in the V8 engine of Google Chrome prior to version 152.0.7977.82 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85046 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85046.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85046"
    },
    {
      "cve": "CVE-2026-85047",
      "notes": [
        {
          "category": "description",
          "text": "Google Chrome on iOS versions before 152.0.7977.82 contains a medium-severity vulnerability in its Transactions Platform due to improper input validation, allowing remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85047 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85047.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85047"
    },
    {
      "cve": "CVE-2026-85048",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "Google Chrome versions prior to 152.0.7977.82 contain a high severity use-after-free vulnerability in the Compositing component that allows remote code execution via crafted HTML content.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85048 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85048.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85048"
    },
    {
      "cve": "CVE-2026-85049",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "other",
          "text": "Expired Pointer Dereference",
          "title": "CWE-825"
        },
        {
          "category": "description",
          "text": "A use-after-free vulnerability in the Skia component of Chromium-based Chrome prior to version 152.0.7977.82 allows remote code execution within the sandbox via crafted HTML, rated as high severity.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85049 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85049.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85049"
    },
    {
      "cve": "CVE-2026-85050",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Google Chrome for Android versions prior to 152.0.7977.82 contain a high-severity out of bounds write vulnerability in WebGL that allows remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85050 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85050.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85050"
    },
    {
      "cve": "CVE-2026-85052",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "Google Chrome before version 152.0.7977.82 contains a high-severity out-of-bounds read vulnerability in the CrashReporting component that allows remote attackers with renderer process access to read memory outside the sandbox via crafted HTML pages.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85052 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85052.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85052"
    },
    {
      "cve": "CVE-2026-85053",
      "notes": [
        {
          "category": "description",
          "text": "A high-severity vulnerability in Google Chrome before version 152.0.7977.82 allowed remote code execution within the sandbox via improper resource exposure in CacheStorage triggered by a crafted HTML page.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85053 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85053.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-85053"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.