browser security

Microsoft documented CVE-2026-12446 in the Microsoft Security Update Guide because the bug is in Chromium open-source code consumed by Microsoft Edge, and Microsoft’s June 2026 Edge update is its statement that current Chromium-based Edge builds are no longer vulnerable. That answer is...

Google assigned CVE-2026-11696 to a Windows-only Chrome video-component flaw fixed before Chrome 149.0.7827.103, after NVD published the entry on June 8, 2026 and added a Windows-scoped CPE configuration on June 9. The short version is that the CPE is not obviously “missing” so much as awkwardly...

CVE-2026-11693 is a high-severity Google Chrome vulnerability, published by NVD on June 8, 2026 and fixed in Chrome 149.0.7827.103, that allowed a renderer-compromise attacker to bypass Site Isolation through a crafted HTML page on desktop platforms. The short version for WindowsForum readers is...

Google fixed CVE-2026-11670 on June 8, 2026, in Chrome’s desktop Stable channel update to version 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux, closing a high-severity use-after-free flaw in Chrome’s built-in PDF handling. The vulnerability allowed remote code execution...

Google’s CVE-2026-11659 entry, published June 8, 2026 and modified June 9, describes a high-severity Chrome-on-Linux integer overflow in the browser UI that could let a remote attacker escape the sandbox through a crafted HTML page before version 149.0.7827.103. The short version is simple...

Google Chrome on macOS before version 149.0.7827.103 contained CVE-2026-11637, a critical use-after-free flaw in the browser’s Views UI framework that could let a remote attacker execute arbitrary code through a crafted HTML page. The bug was published by Chrome on June 8, 2026, enriched by CISA...

Google disclosed CVE-2026-12017 on June 11, 2026, as a high-severity Chrome Extensions flaw fixed in Chrome 149.0.7827.114/.115 for desktop, where a compromised renderer could use a crafted HTML page to bypass site isolation. The dry wording makes it sound like just another browser bulletin, but...

Google Chrome before version 149.0.7827.115 contains CVE-2026-12012, a high-severity use-after-free flaw in the browser’s Network component, published by Chrome on June 11, 2026, and described as exploitable by an attacker with a privileged network position using malicious network traffic. The...

Microsoft will move Microsoft Edge Stable to a two-week major-version release cycle across supported platforms beginning with Edge 152, currently expected on August 27, 2026, while leaving its enterprise-focused Stable Extended channel on the existing eight-week schedule. The company is not...

Google Chrome on Android versions before 149.0.7827.53 contained CVE-2026-11278, a Custom Tabs origin-validation flaw disclosed on June 4, 2026, that could let a local attacker leak cross-origin data through a crafted HTML page. That is the plain fact; the more interesting story is what the bug...

CVE-2026-11270 is a Google Chrome for Android vulnerability published on June 4, 2026, affecting versions before 149.0.7827.53 and allowing a remote attacker to leak cross-origin data through a crafted HTML page. The flaw is classified by Chromium as low severity, while CISA’s ADP scoring gives...

CVE-2026-10967 is a high-severity use-after-free vulnerability in Chrome’s SurfaceCapture component on Android, disclosed on June 4, 2026, affecting Google Chrome versions before 149.0.7827.53 and potentially allowing a renderer-compromise attacker to escape the browser sandbox through a crafted...

Facebook video downloading on Windows 11 in 2026 is less about finding a magic “download” button than choosing the least risky workflow among browser tools, extensions, and desktop apps that save Facebook videos as local files. The practical answer is that browser-based downloaders such as...

In 2026, the leading AI-powered browsers are Microsoft Edge, Google Chrome, Brave, Opera One, Arc, Dia, and Perplexity Comet, each using embedded assistants to summarize pages, answer questions, draft text, organize tabs, or turn browsing into a more conversational workflow. The list says as...

Researchers at Graz University of Technology have disclosed FROST, a browser-based side-channel technique that uses JavaScript and the Origin Private File System to infer other open websites and applications by measuring SSD timing behavior, with public reporting surfacing the work in late May...

Samsung Internet for Windows version 30.0.1.40 is rolling out in May 2026 with support for installing websites as desktop-style apps, alongside security vulnerability fixes and continued compatibility with Windows 10 version 1809 or later and Windows 11. The update is small on paper, but...

Google and Microsoft addressed CVE-2026-7954 on May 6–7, 2026, by moving Chrome desktop to 148.0.7778.96/97 and Edge Stable to 148.0.3967.54, fixing a Medium-severity Chromium Shared Storage race that could leak cross-origin data after renderer compromise via crafted HTML. That dry sentence is...

On May 7, 2026, Microsoft published guidance for CVE-2026-7962, a medium-severity Chromium vulnerability in DirectSockets that affects Microsoft Edge because Edge consumes the Chromium open source codebase. The flaw was fixed in Chromium before Chrome 148.0.7778.96 and is addressed in Edge...

Google and Microsoft disclosed CVE-2026-7964 on May 6, 2026, a medium-severity Chromium FileSystem vulnerability fixed in Google Chrome before version 148.0.7778.96 and tracked by Microsoft because Chromium-based Edge inherits the same upstream browser risk. The flaw is not the flashiest item in...

Google and Microsoft disclosed CVE-2026-7996 on May 6–7, 2026, as a low-severity Chromium SSL input-validation flaw fixed in Chrome before 148.0.7778.96 and incorporated into Microsoft Edge Stable 148.0.3967.54 on Windows, macOS, Linux, and Chromium-derived browser deployments. The bug is not...