browser security

Google disclosed CVE-2026-13919 on June 30, 2026, as a medium-severity Chrome Extensions flaw fixed before version 150.0.7871.47, where a renderer-compromise attacker could use a crafted HTML page to bypass site isolation. The terse description, now reflected in the National Vulnerability...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13898, a use-after-free flaw in the browser’s Cast Receiver component that can let a remote attacker run code inside Chrome’s sandbox through a crafted HTML page. That is the dry registry wording; the practical story is messier and...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13894, a medium-severity Chromium Network flaw disclosed on June 30, 2026, that lets an attacker in a privileged network position bypass navigation restrictions using a crafted HTML page. The bug is not the loudest item in Chrome 150’s...

Google fixed CVE-2026-13814 in Chrome 150.0.7871.47 for Windows and Mac on June 30, 2026, after documenting a high-severity use-after-free flaw in Chrome’s Views interface framework that could let a remote attacker trigger heap corruption through crafted HTML and specific user gestures. The bug...

Google published Chrome 150 to the stable channel on June 30, 2026, including a fix for CVE-2026-13784, a critical use-after-free flaw in Chrome’s Views UI framework affecting versions before 150.0.7871.47. The vulnerability is not just another line item in a very large browser security release...

Microsoft published CVE-2026-58287 on July 3, 2026, as an Important-severity Microsoft Edge Chromium-based remote code execution vulnerability, fixed in Edge 150.0.4078.48 and described by MSRC as a confirmed use-after-free flaw requiring user interaction rather than silent drive-by compromise...

Microsoft has listed CVE-2026-58283 as a spoofing vulnerability in Microsoft Edge, the Chromium-based browser used across Windows, macOS, Linux, iOS, and Android, with the public Security Update Guide entry serving as the authoritative disclosure point for administrators tracking the issue. The...

Microsoft disclosed CVE-2026-58282 as a spoofing vulnerability in Chromium-based Microsoft Edge through the Microsoft Security Response Center, placing the issue in the browser-security lane where user trust, interface accuracy, and fast update adoption matter more than dramatic...

Microsoft has listed CVE-2026-57992 as a Microsoft Edge Chromium-based remote code execution vulnerability in the Security Update Guide, with Edge Stable version 150.0.4078.48 released on July 2, 2026, to incorporate the latest Chromium security updates. The important fact is not that Edge has...

Microsoft has published CVE-2026-57988 as a Microsoft Edge Chromium-based remote code execution vulnerability in the MSRC Security Update Guide, with the browser’s July 2, 2026 Stable release listed separately by Microsoft Learn as Edge 150.0.4078.48. The important story is not merely that...

Microsoft released CVE-2026-57985 on July 3, 2026, describing it as an Important-severity Microsoft Edge Chromium-based remote code execution vulnerability caused by improper input validation and fixed in Edge version 150.0.4078.48, based on Chromium 150.0.7871.47. The dry phrasing hides a...

Microsoft has listed CVE-2026-56645 as a Microsoft Edge, Chromium-based, remote code execution vulnerability in its Security Update Guide, while Edge security release notes show the browser received Stable channel security updates on July 2, 2026, with CVE identifiers still pending publication...

Microsoft published CVE-2026-55945 on July 3, 2026, identifying a moderate-severity Microsoft Edge Chromium information disclosure flaw fixed in Edge version 150.0.4078.48 and tied to a race condition that can expose local file content. The important word in Microsoft’s advisory is not...

Microsoft’s CVE-2026-50521 advisory for Microsoft Edge, published in late June and updated around July 1, 2026, describes a high-severity Chromium-based remote code execution flaw and tells customers to install every update package offered for the Edge software present on their systems. That...

Google Chrome before 149.0.7827.197 contained CVE-2026-13024, a high-severity Chromium navigation flaw disclosed on June 24, 2026, that could let an attacker who had already compromised Chrome’s renderer process bypass site isolation with a crafted HTML page. That narrow precondition is the...

Google disclosed CVE-2026-13026 on June 24, 2026, as a high-severity use-after-free flaw in Chrome’s Digital Credentials implementation on macOS, fixed in Chrome 149.0.7827.197 after a crafted HTML page could potentially trigger heap corruption with user interaction. The advisory is narrow, but...

Microsoft documented CVE-2026-12461 in the Security Update Guide on June 17, 2026, because the flaw is in Chromium’s WebRTC code and Microsoft Edge is built on Chromium, meaning Edge inherited the risk until Microsoft shipped an updated browser build. The short answer is that this is not a...

Microsoft documented CVE-2026-12449 in the Security Update Guide on June 17, 2026, because the flaw is in Chromium open-source code used by Microsoft Edge, and Edge was considered protected once its current Chromium-based build incorporated the upstream fix. That short answer is almost too neat...

Microsoft documents CVE-2026-12467 in the Security Update Guide because the flaw is in Chromium open source code used by Microsoft Edge, and the Edge entry tells customers that updated Edge builds are no longer vulnerable. That answer is simple, but it points to a larger truth about modern...

Microsoft documented CVE-2026-12460 in its Security Update Guide because the bug lives in Chromium open-source code that Microsoft Edge consumes, and the company uses the guide to tell customers that updated Edge builds are no longer vulnerable. The short version is that this is a Chrome-family...