CVE-2026-85049
Use after free in Skia
CVE-2026-85049: Use after free in Skia. Not in the CISA KEV catalog. High advisory severity (CVSS 8.8, Red Hat). 2 advisories from Palo Alto and Red Hat.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-85049 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 8.8 (Red Hat)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H(Red Hat)
- Weakness
- CWE-825
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-85049; bulletin-wide values are not repeated here.
Is CVE-2026-85049 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-85049 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-85049?
The tracked advisories that cover only this CVE do not list a fixed release yet. That does not mean no fix exists; check each vendor source below.
Vendor advisory comparison
Palo Alto
1 advisory- Advisory severityHigh
High [CVE-2026-102299 +448] PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
PAN-SA-2026-0013Source published
This bulletin covers 449 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026)
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Prisma Browser < 152.8.5.83
- Source-reported fixed versions
- Prisma Browser >= 155.16.5.40
- Mitigation guidance
- Upgrade to a fixed release: Prisma Browser >= 155.16.5.40.
- Workarounds
- No known workarounds exist for this issue.
Red Hat
1 advisory- Advisory severityHigh8.8
High [CVE-2026-85049] Use after free in Skia
CVE-2026-85049Source published Source updated
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
- Affected products in this advisory
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
2 more entries in the full advisory.
- Source-reported affected versions
- < 152.0.7977.82
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.