CVE-2026-85052: Out of bounds read in Google Chrome

An out-of-bounds read vulnerability exists in the CrashReporting feature of Google Chrome before version 152.0.7977.82. A remote attacker who has already compromised the renderer process can exploit this by delivering a crafted HTML page to read memory outside the sandbox. The CVSS v3.1 base score is 3.1, indicating low impact, with confidentiality impact limited to partial information disclosure. No integrity or availability impacts are noted. The vulnerability does not require privileges but does require user interaction. No known exploits in the wild have been reported. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation level.

The vulnerability allows partial information disclosure through an out-of-bounds read in the CrashReporting component. It requires that the attacker has already compromised the renderer process and involves user interaction. There is no impact on integrity or availability. The low CVSS score reflects limited impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html for current remediation guidance. Users should update to version 152.0.7977.82 or later once confirmed as fixed. Until then, no specific mitigation beyond updating is available.