CVE-2026-85051
published 2026-09-03CVE-2026-85051: Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…
PriorityP354high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.45%
38.2th percentile
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 152.0.7977.82 | 152.0.7977.82 | |
| chrome | >= 152.0.7977.82 < 152.0.7977.82 | 152.0.7977.82 | |
| chrome_desktop | — | — | |
| paloalto | prisma_browser | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
vendor_paloalto·2026-10-14·CVSS 9.6
CVE-2026-85042 [CRITICAL] PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-de
Chrome
Stable Channel Update for Desktop: CVE-2026-85051
vendor_chrome·2026-09-03·CVSS 9.6
CVE-2026-85051 [HIGH] Stable Channel Update for Desktop: CVE-2026-85051
Stable Channel Update for Desktop
CVE-2026-85051: Type confusion in Compositing. Reported by Google on 2026-08-27 [N/A][ 513790581 ] Medium CVE-2026-85047: Improper input validation in Transactions Platform
Reported by Google on 2026-05-16 [N/A][ 517482830 ] Medium CVE-2026-85044: Use of released resource in Mobile
Severity: high
GHSA
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
ghsa_unreviewed·2026-09-03
CVE-2026-85051 [HIGH] CWE-843 Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB
Google Chrome up to 152.0.7977.75 Compositing type confusion
vuldb·2026-09-03·CVSS 8.8
CVE-2026-85051 [HIGH] Google Chrome up to 152.0.7977.75 Compositing type confusion
A vulnerability was found in Google Chrome. It has been rated as critical. This affects an unknown part of the component Compositing. This manipulation causes type confusion.
This vulnerability is tracked as CVE-2026-85051. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85043 CVE-2026-85044 CVE-2026-85045 CVE-2026-85046 CVE-2026-85048 CVE-2026-85049 CVE-2026-85051 CVE-2026-85052 CVE-2026-85053 chromium: various flaws [fedora-all]
bugzilla·2026-09-27·CVSS 9.1
CVE-2026-85043 [CRITICAL] CVE-2026-85043 CVE-2026-85044 CVE-2026-85045 CVE-2026-85046 CVE-2026-85048 CVE-2026-85049 CVE-2026-85051 CVE-2026-85052 CVE-2026-85053 chromium: various flaws [fedora-all]
CVE-2026-85043 CVE-2026-85044 CVE-2026-85045 CVE-2026-85046 CVE-2026-85048 CVE-2026-85049 CVE-2026-85051 CVE-2026-85052 CVE-2026-85053 chromium: various flaws [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (C
Bugzilla
CVE-2026-85043 CVE-2026-85044 CVE-2026-85045 CVE-2026-85046 CVE-2026-85048 CVE-2026-85049 CVE-2026-85051 CVE-2026-85052 CVE-2026-85053 chromium: various flaws [epel-all]
bugzilla·2026-09-27·CVSS 9.1
CVE-2026-85043 [CRITICAL] CVE-2026-85043 CVE-2026-85044 CVE-2026-85045 CVE-2026-85046 CVE-2026-85048 CVE-2026-85049 CVE-2026-85051 CVE-2026-85052 CVE-2026-85053 chromium: various flaws [epel-all]
CVE-2026-85043 CVE-2026-85044 CVE-2026-85045 CVE-2026-85046 CVE-2026-85048 CVE-2026-85049 CVE-2026-85051 CVE-2026-85052 CVE-2026-85053 chromium: various flaws [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chr
Bugzilla
CVE-2026-85051 chromium-browser: Google Chrome: Arbitrary code execution via type confusion in Compositing
bugzilla·2026-09-03·CVSS 8.8
CVE-2026-85051 [HIGH] CVE-2026-85051 chromium-browser: Google Chrome: Arbitrary code execution via type confusion in Compositing
CVE-2026-85051 chromium-browser: Google Chrome: Arbitrary code execution via type confusion in Compositing
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
2026-09-03
Published