Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute… (CVE-2026-85048)

CVE-2026-85048 is a use-after-free vulnerability in the Compositing subsystem of Google Chrome versions before 152.0.7977.82. Exploitation requires prior compromise of the renderer process and involves a crafted HTML page that enables code execution beyond the sandbox restrictions. The vulnerability is classified as CWE-416 (Use After Free) and carries a high impact on confidentiality, integrity, and availability (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No known exploits in the wild have been reported, and no patch links or vendor advisories are provided in the data.

Successful exploitation allows an attacker with control over the renderer process to execute arbitrary code outside the sandbox, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction (UI:R) and a high attack complexity (AC:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users and administrators should monitor official Google Chrome security advisories for updates. Until a fix is available, limiting exposure to untrusted web content and maintaining updated security controls is advisable.