CVE-2026-85051: Type confusion in Google Chrome

CVE-2026-85051 is a type confusion vulnerability affecting the Compositing component in Google Chrome versions before 152.0.7977.82. This flaw enables remote attackers to execute arbitrary code inside the sandbox environment by using a specially crafted HTML page. The vulnerability is rated high severity with a CVSS v3.1 score of 8.8, indicating it is exploitable over the network with low attack complexity and no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability. The vendor advisory is linked but does not explicitly state if a patch is available or if the issue is mitigated.

Successful exploitation allows remote code execution within the sandboxed environment of Google Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. The attack requires user interaction (visiting a crafted HTML page) but no prior privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html for current remediation guidance. Until official confirmation, users should update to the latest Chrome version once available to mitigate this vulnerability.