CVE-2026-85048: Use after free in Google Chrome

This vulnerability involves a use-after-free flaw in the Compositing subsystem of Google Chrome versions before 152.0.7977.82. Exploitation requires that the attacker has already compromised the renderer process and can then execute arbitrary code outside the sandbox by delivering a specially crafted HTML page. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution outside the sandbox, potentially leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability with high severity. There are no known exploits in the wild at the time of publication.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official fixes once available.