Google Chrome CVE-2026-85043

Requires the victim to be running Chrome older than 152.0.7977.82 and the attacker to be able to deliver crafted network traffic that Chrome's Network component processes (per CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required). The concrete limiting factor is reachability: the attacker needs a path to send the malformed traffic to the target's browser networking layer (malicious/compromised server response or a network man-in-the-path position). The impact is bounded to bypassing system access restrictions with no integrity change (I:N); exploitation ceases once the browser is updated to the patched version.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H = 9.1) describes a network-reachable, unauthenticated, no-interaction bypass with high confidentiality and availability impact - headline-critical. However EPSS is only 0.22% (12th percentile) and CISA SSVC records Exploitation: none with Technical Impact: partial, which is more conservative than a full-compromise reading; SSVC's Automatable: yes indicates that if an exploit existed it could be scripted at scale. There is no KEV listing and no public PoC, so this is a real patch priority for a ubiquitous product but not an active-exploitation emergency. One caveat worth verifying with the vendor: the description says the trigger is "crafted network traffic" and rates I:N (no integrity impact), which fits an access-restriction/resource-cleanup bypass rather than code execution - the high score is driven by C:H/A:H, and the concrete exploit path is not detailed in the sparse Chrome release note.

A remote attacker positioned to deliver crafted responses to a victim's Chrome instance - for example via a malicious or compromised web endpoint or a man-in-the-path network position - sends specially formed network traffic that exploits the incomplete-cleanup condition in the Network stack, causing Chrome to retain residual state and bypass an enforced access restriction. No user interaction or authentication is required per the CVSS vector. No public PoC exists at time of analysis.