Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-85052)

CVE-2026-85052 is an out-of-bounds read vulnerability in the CrashReporting feature of Google Chrome before version 152.0.7977.82. A remote attacker with control over the renderer process can exploit this flaw to read memory outside the sandbox boundary by delivering a specially crafted HTML page. The vulnerability is identified as CWE-125 (Out-of-bounds Read) and is rated low severity with a CVSS 3.1 base score of 3.1, reflecting limited impact on confidentiality and no impact on integrity or availability.

The vulnerability allows an attacker who has already compromised the renderer process to read memory beyond intended boundaries, potentially exposing sensitive information. However, the impact is limited to information disclosure (confidentiality) with no integrity or availability impact. The CVSS vector indicates the attack requires network access, high attack complexity, no privileges, and user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted content and consider applying any recommended mitigations from the vendor once published.