{
    "document": {
        "category": "csaf_security_advisory",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "nl",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            },
            {
                "category": "description",
                "text": "Google heeft meerdere kwetsbaarheden verholpen in Google Chrome, specifiek in versies voor 152.0.7977.82.",
                "title": "Feiten"
            },
            {
                "category": "description",
                "text": "De kwetsbaarheden bevinden zich in verschillende componenten van Google Chrome, waaronder DevTools, Network, V8 JavaScript engine en Transactions Platform op iOS. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal vervaardigde HTML-pagina's aan te bieden, wat kan leiden tot het uitvoeren van willekeurige code buiten de sandboxomgeving, het omzeilen van toegangsbeperkingen, het lezen van geheugen buiten de sandbox, en het compromitteren van de isolatie van webcontent. De kwetsbaarheden zijn specifiek van toepassing op Google Chrome en zijn verschillende componenten, inclusief versies op Android en iOS.\n\nGoogle geeft aan dat voor CVE-2026-85046 publieke PoC beschikbaar is.",
                "title": "Interpretaties"
            },
            {
                "category": "description",
                "text": "Google heeft updates uitgebracht om de kwetsbaarheden in Google Chrome te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
                "title": "Oplossingen"
            },
            {
                "category": "general",
                "text": "medium",
                "title": "Kans"
            },
            {
                "category": "general",
                "text": "high",
                "title": "Schade"
            },
            {
                "category": "general",
                "text": "Out-of-bounds Read",
                "title": "CWE-125"
            },
            {
                "category": "general",
                "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
                "title": "CWE-367"
            },
            {
                "category": "general",
                "text": "Use After Free",
                "title": "CWE-416"
            },
            {
                "category": "general",
                "text": "Incomplete Cleanup",
                "title": "CWE-459"
            },
            {
                "category": "general",
                "text": "Operation on a Resource after Expiration or Release",
                "title": "CWE-672"
            },
            {
                "category": "general",
                "text": "Out-of-bounds Write",
                "title": "CWE-787"
            },
            {
                "category": "general",
                "text": "Expired Pointer Dereference",
                "title": "CWE-825"
            },
            {
                "category": "general",
                "text": "Access of Resource Using Incompatible Type ('Type Confusion')",
                "title": "CWE-843"
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "Nationaal Cyber Security Centrum",
            "namespace": "https://www.ncsc.nl/"
        },
        "references": [
            {
                "category": "external",
                "summary": "Reference",
                "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html"
            }
        ],
        "title": "Kwetsbaarheden verholpen in Google Chrome",
        "tracking": {
            "current_release_date": "2026-09-04T13:20:15.365981Z",
            "generator": {
                "date": "2025-08-04T16:30:00Z",
                "engine": {
                    "name": "V.A.",
                    "version": "1.3"
                }
            },
            "id": "NCSC-2026-0341",
            "initial_release_date": "2026-09-04T13:20:15.365981Z",
            "revision_history": [
                {
                    "date": "2026-09-04T13:20:15.365981Z",
                    "number": "1.0.0",
                    "summary": "Initiele versie"
                }
            ],
            "status": "final",
            "version": "1.0.0"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/*",
                                "product": {
                                    "name": "vers:unknown/*",
                                    "product_id": "CSAFPID-1"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "Chrome"
                    }
                ],
                "category": "vendor",
                "name": "Google"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-85042",
            "cwe": {
                "id": "CWE-416",
                "name": "Use After Free"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Use After Free",
                    "title": "CWE-416"
                },
                {
                    "category": "description",
                    "text": "A use-after-free vulnerability in Google Chrome DevTools before version 152.0.7977.82 allowed remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page, posing a high security risk.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85042 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85042.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                        "baseScore": 9.6,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85042"
        },
        {
            "cve": "CVE-2026-85043",
            "cwe": {
                "id": "CWE-459",
                "name": "Incomplete Cleanup"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Incomplete Cleanup",
                    "title": "CWE-459"
                },
                {
                    "category": "description",
                    "text": "A high-severity vulnerability in Google Chrome before version 152.0.7977.82 involved incomplete cleanup in the Network component, allowing remote attackers to bypass system access restrictions via crafted network traffic.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85043 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85043.json"
                }
            ],
            "title": "CVE-2026-85043"
        },
        {
            "cve": "CVE-2026-85044",
            "cwe": {
                "id": "CWE-672",
                "name": "Operation on a Resource after Expiration or Release"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Operation on a Resource after Expiration or Release",
                    "title": "CWE-672"
                },
                {
                    "category": "description",
                    "text": "A medium-severity vulnerability in Google Chrome on Android before version 152.0.7977.82 allowed remote attackers to bypass the web origin policy via a crafted HTML page exploiting released resource handling on mobile devices.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85044 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85044.json"
                }
            ],
            "title": "CVE-2026-85044"
        },
        {
            "cve": "CVE-2026-85045",
            "cwe": {
                "id": "CWE-367",
                "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Time-of-check Time-of-use (TOCTOU) Race Condition",
                    "title": "CWE-367"
                },
                {
                    "category": "description",
                    "text": "A race condition vulnerability in the V8 engine of Google Chrome prior to version 152.0.7977.82 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85045 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85045.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85045"
        },
        {
            "cve": "CVE-2026-85046",
            "cwe": {
                "id": "CWE-843",
                "name": "Access of Resource Using Incompatible Type ('Type Confusion')"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Access of Resource Using Incompatible Type ('Type Confusion')",
                    "title": "CWE-843"
                },
                {
                    "category": "description",
                    "text": "A type confusion vulnerability in the V8 engine of Google Chrome prior to version 152.0.7977.82 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85046 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85046.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85046"
        },
        {
            "cve": "CVE-2026-85047",
            "notes": [
                {
                    "category": "description",
                    "text": "Google Chrome on iOS versions before 152.0.7977.82 contains a medium-severity vulnerability in its Transactions Platform due to improper input validation, allowing remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85047 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85047.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                        "baseScore": 9.6,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85047"
        },
        {
            "cve": "CVE-2026-85048",
            "cwe": {
                "id": "CWE-416",
                "name": "Use After Free"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Use After Free",
                    "title": "CWE-416"
                },
                {
                    "category": "description",
                    "text": "Google Chrome versions prior to 152.0.7977.82 contain a high severity use-after-free vulnerability in the Compositing component that allows remote code execution via crafted HTML content.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85048 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85048.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                        "baseScore": 8.3,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85048"
        },
        {
            "cve": "CVE-2026-85049",
            "cwe": {
                "id": "CWE-416",
                "name": "Use After Free"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Use After Free",
                    "title": "CWE-416"
                },
                {
                    "category": "other",
                    "text": "Expired Pointer Dereference",
                    "title": "CWE-825"
                },
                {
                    "category": "description",
                    "text": "A use-after-free vulnerability in the Skia component of Chromium-based Chrome prior to version 152.0.7977.82 allows remote code execution within the sandbox via crafted HTML, rated as high severity.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85049 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85049.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85049"
        },
        {
            "cve": "CVE-2026-85050",
            "cwe": {
                "id": "CWE-787",
                "name": "Out-of-bounds Write"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Out-of-bounds Write",
                    "title": "CWE-787"
                },
                {
                    "category": "description",
                    "text": "Google Chrome for Android versions prior to 152.0.7977.82 contain a high-severity out of bounds write vulnerability in WebGL that allows remote attackers to execute arbitrary code outside the sandbox via crafted HTML pages.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85050 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85050.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                        "baseScore": 9.6,
                        "baseSeverity": "CRITICAL"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85050"
        },
        {
            "cve": "CVE-2026-85052",
            "cwe": {
                "id": "CWE-125",
                "name": "Out-of-bounds Read"
            },
            "notes": [
                {
                    "category": "other",
                    "text": "Out-of-bounds Read",
                    "title": "CWE-125"
                },
                {
                    "category": "description",
                    "text": "Google Chrome before version 152.0.7977.82 contains a high-severity out-of-bounds read vulnerability in the CrashReporting component that allows remote attackers with renderer process access to read memory outside the sandbox via crafted HTML pages.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85052 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85052.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
                        "baseScore": 3.1,
                        "baseSeverity": "LOW"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85052"
        },
        {
            "cve": "CVE-2026-85053",
            "notes": [
                {
                    "category": "description",
                    "text": "A high-severity vulnerability in Google Chrome before version 152.0.7977.82 allowed remote code execution within the sandbox via improper resource exposure in CacheStorage triggered by a crafted HTML page.",
                    "title": "Summary"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-1"
                ]
            },
            "references": [
                {
                    "category": "self",
                    "summary": "CVE-2026-85053 | NCSC-NL Website",
                    "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85053.json"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-1"
                    ]
                }
            ],
            "title": "CVE-2026-85053"
        }
    ]
}