CVE-2026-85051: 
vulnerability analysis and mitigation

CVE-2026-85051 is a type confusion vulnerability in the Compositing component of Google Chrome that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. It affects all versions of Google Chrome prior to 152.0.7977.82 and was reported internally by Google on 2026-08-27. The vulnerability was publicly disclosed on September 3, 2026, alongside a stable channel update. It carries a CVSS v3.1 base score of 8.8 (High) (Chrome Releases, GitHub Advisory).

The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type / 'Type Confusion'), occurring within Chrome's Compositing subsystem — the component responsible for rendering and layering visual elements on screen. When processing a specially crafted HTML page, the compositing engine accesses an object or resource using a type incompatible with how it was originally allocated, enabling memory corruption that can be leveraged for arbitrary code execution. Exploitation requires user interaction (visiting a malicious page) but no authentication or special privileges. The Chromium issue tracker entry is tracked under issue 553449113 (Chrome Releases, GitHub Advisory).

Successful exploitation allows a remote attacker to execute arbitrary code within the Chrome browser sandbox, achieving high confidentiality, integrity, and availability impact on the affected browser process. While the sandbox limits direct host OS access, sandbox escape chained with this vulnerability could lead to full system compromise. All users running Google Chrome versions prior to 152.0.7977.82 on Windows, Mac, and Linux are affected (Chrome Releases, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit or evidence of active in-the-wild exploitation specifically for CVE-2026-85051. The EPSS score is approximately 0.321–0.337%, indicating a relatively low near-term exploitation probability. Notably, a separate vulnerability in the same Chrome update (CVE-2026-85046, type confusion in V8) was confirmed by Google to have an active in-the-wild exploit, but CVE-2026-85051 was not similarly flagged. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog (Chrome Releases, GitHub Advisory).

Google has released a patch in Chrome stable channel version 152.0.7977.82 (Linux) and 152.0.7977.82/.83 (Windows and Mac). Users and administrators should update Chrome immediately to this version or later. Enterprise environments should deploy the patched version via their standard update management process, and automatic updates should be enabled where possible. No configuration-based workaround is available; patching is the only remediation (Chrome Releases).

The September 3, 2026 Chrome update received broad coverage due to the simultaneous disclosure of CVE-2026-85046, a V8 type confusion zero-day confirmed exploited in the wild, which drew significant attention to the entire release. Security outlets including HotHardware and CyberPress reported on the update, urging users to patch immediately. The CIS issued an advisory noting multiple vulnerabilities in the release could allow arbitrary code execution. CVE-2026-85051 itself was not individually highlighted in major commentary, as attention was focused on the actively exploited CVE-2026-85046 (Chrome Releases, CIS Advisory).