browser security

Google’s June 30, 2026 Chrome 150 desktop update fixed CVE-2026-14010, a medium-severity Windows-only information disclosure flaw in Chrome’s Codecs component that affected versions before 150.0.7871.47 and could expose process memory through a crafted HTML page. The bug is not a browser...

Microsoft published CVE-2026-58294 on July 3, 2026, as a high-severity remote code execution vulnerability in Chromium-based Microsoft Edge, fixed in Edge 150.0.4078.48 for affected Stable and Extended Stable installations. The important detail is not just that Edge had another browser RCE; it...

Microsoft published CVE-2026-58292 on July 3, 2026, as a high-severity remote code execution vulnerability in Chromium-based Microsoft Edge, with Edge Stable 150.0.4078.48 identified as the patched release for Windows and other desktop channels. The advisory is thin on exploit detail, but that...

Microsoft published CVE-2026-58290 on July 3, 2026, as an Important remote code execution vulnerability in Chromium-based Microsoft Edge, fixed in Edge version 150.0.4078.48 and tied to a type confusion flaw that requires user interaction. The advisory, issued through the Microsoft Security...

Microsoft disclosed CVE-2026-58289 on July 3, 2026, as a critical Microsoft Edge Chromium-based remote code execution vulnerability caused by type confusion, affecting Edge versions before 150.0.4078.48 and requiring administrators to treat the July 2 Stable Channel update as the practical fix...

Microsoft published CVE-2026-58286 on July 3, 2026, as a high-severity spoofing vulnerability in Chromium-based Microsoft Edge, fixed by updating Stable or Extended Stable Edge to version 150.0.4078.48 or later on supported desktop platforms. The important part is not that Edge has another CVE...

Microsoft disclosed CVE-2026-58285 on July 3, 2026, as a remote code execution vulnerability in Chromium-based Microsoft Edge affecting versions before 150.0.4078.48, with public vulnerability databases mirroring Microsoft’s advisory and assigning it a CVSS 3.1 score of 8.3. The uncomfortable...

An attacker could exploit CVE-2026-58278 over the network by hosting a specially crafted website, luring a Microsoft Edge user to visit it through email, messaging, or an attachment, and relying on user interaction because Microsoft says the attacker cannot force the target to view the content...

Google assigned CVE-2026-13954 to a medium-severity Chrome for Android flaw fixed before version 150.0.7871.47, where insufficient XML policy enforcement could let a remote attacker read potentially sensitive process memory through a crafted HTML page. The entry landed in the National...

Microsoft disclosed CVE-2026-58276 on July 3, 2026, as a high-severity remote code execution vulnerability in Chromium-based Microsoft Edge affecting versions before 150.0.4078.48, with exploitation requiring user interaction and the fix landing in the July 2 Stable Channel update. The...

An attacker could exploit CVE-2026-57981 over the network by hosting a specially crafted website that targets Microsoft Edge’s Chromium code path and persuading a user, typically through email, instant messaging, or a malicious attachment, to open that attacker-controlled content in the browser...

Google Chrome before version 150.0.7871.47 contains CVE-2026-14001, a medium-severity Network component flaw disclosed on June 30, 2026, that can let a remote attacker inject arbitrary scripts or HTML through a crafted web page. The bug is not the loudest defect in Chrome 150’s enormous security...

Google fixed CVE-2026-14052 in Chrome 150.0.7871.47 for Windows and Mac on June 30, 2026, closing a low-severity FileSystem policy-enforcement flaw that could let a remote attacker bypass discretionary access controls through a crafted HTML page. The bug is not the sort of browser vulnerability...

Google Chrome before version 150.0.7871.47 contains CVE-2026-14079, a low-severity Chromium Network flaw disclosed on June 30, 2026, that can let a remote attacker bypass same-origin policy protections through a crafted HTML page. That is the plain version, and it is enough to justify updating...

Google disclosed CVE-2026-14080 on June 30, 2026, as a low-severity Chrome for Android TabSwitcher flaw fixed before version 150.0.7871.47, where insufficient validation of untrusted input could let a remote attacker bypass navigation restrictions through malicious network traffic. The bug is...

CVE-2026-14088 is a Chrome for Android vulnerability, published by NVD on June 30, 2026 and last modified July 2, that affects versions before 150.0.7871.47 and can let a remote attacker read potentially sensitive process memory through a crafted HTML page. The bug is not the sort of...

Google Chrome before 150.0.7871.47 contains CVE-2026-14091, a DevTools use-after-free flaw disclosed June 30, 2026, that can let a remote attacker execute arbitrary code inside Chrome’s sandbox through a crafted HTML page when user interaction is involved. That sounds like a contradiction in...

Google Chrome before version 150.0.7871.47 contained a CSS implementation flaw, CVE-2026-14098, disclosed on June 30, 2026, that could let a remote attacker leak cross-origin data through a crafted HTML page on affected desktop platforms. The bug is officially rated “Low” by Chromium, but CISA’s...

Google Chrome CVE-2026-13774, published by NVD on June 30, 2026 and modified on July 2, affects Chrome before version 150.0.7871.47 on Windows, macOS, and Linux through a critical use-after-free flaw in the browser’s Extensions component. The short answer to the CPE question is that the Chrome...

Google Chrome CVE-2026-13957 was published by NVD on June 30, 2026, modified by CISA-ADP on July 1, and initially analyzed by NIST on July 2 as an Extensions security-UI flaw affecting Chrome versions before 150.0.7871.47. The short answer to the CPE question is: probably not, at least not for...