CVE-2026-85047
published 2026-09-03CVE-2026-85047: Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary…
PriorityP355critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.46%
39.0th percentile
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 152.0.7977.82 | 152.0.7977.82 | |
| chrome | >= 152.0.7977.82 < 152.0.7977.82 | 152.0.7977.82 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
vendor_paloalto·2026-10-14·CVSS 9.6
CVE-2026-85042 [CRITICAL] PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-de
Red Hat
chromium-browser: Improper input validation in Transactions Platform
vendor_redhat·2026-09-03·CVSS 9.6
CVE-2026-85047 [CRITICAL] CWE-20 chromium-browser: Improper input validation in Transactions Platform
chromium-browser: Improper input validation in Transactions Platform
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
An improper input validation flaw was found in the Transactions Platform component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/513790581
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Chrome
Stable Channel Update for Desktop: CVE-2026-85051
vendor_chrome·2026-09-03·CVSS 9.6
CVE-2026-85051 [HIGH] Stable Channel Update for Desktop: CVE-2026-85051
Stable Channel Update for Desktop
CVE-2026-85051: Type confusion in Compositing. Reported by Google on 2026-08-27 [N/A][ 513790581 ] Medium CVE-2026-85047: Improper input validation in Transactions Platform
Reported by Google on 2026-05-16 [N/A][ 517482830 ] Medium CVE-2026-85044: Use of released resource in Mobile
Severity: high
VulDB
Google Chrome up to 152.0.7977.75 Transactions Platform input validation
vuldb·2026-09-03·CVSS 9.6
CVE-2026-85047 [CRITICAL] Google Chrome up to 152.0.7977.75 Transactions Platform input validation
A vulnerability was found in Google Chrome and classified as critical. Affected is an unknown function of the component Transactions Platform. Executing a manipulation can lead to improper input validation.
The identification of this vulnerability is CVE-2026-85047. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted H
ghsa_unreviewed·2026-09-03
CVE-2026-85047 [CRITICAL] CWE-20 Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted H
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
No detection rules found.
No public exploits indexed.
2026-09-03
Published