Executive brief
Google Chrome's Network component failed to properly clean up resources, allowing a remote attacker to bypass system access restrictions through specially crafted network traffic. This could enable an attacker to gain unauthorized access to restricted system resources or escalate privileges on an affected machine.
Technical details
CVE-2026-85043 is an incomplete cleanup vulnerability in the Network component of Google Chrome. The vulnerability allows a remote attacker to bypass system access restrictions by sending crafted network traffic. The attack requires network connectivity to the victim's system but does not require user interaction or authentication. Successful exploitation could result in circumvention of security controls. A patch is available in Chrome version 152.0.7977.82 and later.
Affected products
- Google Chrome prior to 152.0.7977.82
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in Chrome 152.0.7977.82 for Windows/Mac and Linux