chrome security

Google Chrome users running builds earlier than 150.0.7871.47 should treat CVE-2026-13881 as patched but not yet fully explained: the flaw was published June 30, 2026, affects Chrome’s WebAppInstalls component, and can let a crafted HTML page bypass the browser’s same-origin policy. That is the...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13845, a high-severity use-after-free flaw in the browser’s DOM code that could let a remote attacker execute code inside Chrome’s sandbox after a user opens a crafted HTML page. The bug arrived in the National Vulnerability Database...

Google fixed CVE-2026-13831, a high-severity Chromium GPU memory-safety flaw affecting Chrome before version 150.0.7871.47, in the June 30, 2026 Stable Channel update for desktop Chrome on Windows, macOS, and Linux. The vulnerability matters less because of its label than because of where it...

CVE-2026-13830 is a high-severity use-after-free flaw in Chrome’s Chromoting component, published by NVD on June 30, 2026, affecting Google Chrome on Linux before 150.0.7871.47 and described as allowing remote code execution through malicious network traffic. The oddity is not the bug class...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13793, a high-severity Chromium SVG policy-enforcement flaw disclosed on June 30, 2026, that can let a remote attacker leak cross-origin data through a crafted HTML page. That is the plain answer, but it is not the full story. The more...

Google’s June 30 Chrome 150 desktop release fixed CVE-2026-13782, a critical use-after-free flaw in the browser process that could let an attacker escape Chrome’s sandbox after compromising the renderer, with patched desktop builds shipping as Chrome 150.0.7871.46 for Linux and 150.0.7871.46/.47...

Google patched CVE-2026-13780 in Chrome 150.0.7871.47 for Windows and macOS after disclosing on June 30, 2026, that insufficient validation in ANGLE could let an attacker who had already compromised Chrome’s renderer escape the browser sandbox through a crafted HTML page. The NVD later rated the...

Google Chrome’s CVE-2026-13776 is a critical type-confusion flaw in the Dawn graphics layer, fixed in Chrome 150.0.7871.47 on June 30, 2026, and NVD’s change history indicates that Chrome CPE data was added even if the public page still shows a loading prompt. That is the small but important...

Google fixed CVE-2026-13775, a critical use-after-free flaw in Chrome’s GPU component, in the June 30, 2026 Stable Channel update that moved desktop Chrome to version 150.0.7871.47 on Windows and Mac and 150.0.7871.46 on Linux. The bug matters less because it is exotic than because it sits...

Google disclosed CVE-2026-14125 on June 30, 2026, as an uninitialized-use flaw in ANGLE affecting Google Chrome before version 150.0.7871.47, allowing a remote attacker to read potentially sensitive process memory through a crafted HTML page. The bug arrived in the National Vulnerability...

Google disclosed CVE-2026-13029 on June 24, 2026, as a high-severity use-after-free vulnerability in Chrome’s Web Authentication component affecting desktop versions before 149.0.7827.197, with exploitation requiring a user to install a malicious Chrome extension that could trigger heap...

Google disclosed CVE-2026-13031 on June 24, 2026, as a high-severity use-after-free flaw in Chrome’s Blink rendering engine, fixed in desktop Chrome 149.0.7827.196/197 and capable of letting a remote attacker execute code inside Chrome’s sandbox through a crafted HTML page. That sounds like the...

Google shipped Chrome 149.0.7827.196/197 for Windows and macOS and 149.0.7827.196 for Linux on June 23, 2026, fixing CVE-2026-13033, a critical Blink Interest Groups memory-safety flaw that could let a remote attacker execute code through a crafted HTML page. The bug is not merely another line...

CVE-2026-13034 is a high-severity Google Chrome vulnerability disclosed on June 24, 2026, affecting Chrome versions before 149.0.7827.197, where an attacker who had already compromised the renderer process could use a crafted HTML page to bypass site isolation. The short version is simple: this...

Google fixed CVE-2026-13021 in Chrome before version 149.0.7827.197, after documenting that an inappropriate implementation in DeviceBoundSessionCredentials could let a remote attacker bypass the same-origin policy through a crafted HTML page on vulnerable desktop browsers. That is the plain...

Google Chrome before 149.0.7827.197 contains CVE-2026-13022, a high-severity Chromium Autofill flaw disclosed June 24, 2026, that can let a remote attacker who has already compromised the renderer process leak cross-origin data through a crafted HTML page. The bug is not a stand-alone “visit a...

Google disclosed CVE-2026-11655 on June 8, 2026, as a high-severity integer overflow in Chrome’s Media component on macOS before version 149.0.7827.103, where an attacker who had already compromised the renderer could potentially escape the browser sandbox using a crafted HTML page. That...

Google disclosed CVE-2026-11700 on June 8, 2026, as a use-after-free flaw in Chrome’s Tracing component before version 149.0.7827.103 that could let an attacker who already compromised the renderer process attempt a sandbox escape through a crafted HTML page. That description sounds narrow...

Google Chrome CVE-2026-11699 is a high-severity use-after-free vulnerability in Chrome’s Bluetooth code on macOS, disclosed in June 2026 and fixed for Mac users in Chrome 149.0.7827.103 after Google’s stable-channel desktop security update. The bug is not the loudest Chrome flaw of the month...

CVE-2026-11697 is a high-severity Google Chrome vulnerability, published by NVD on June 8, 2026, affecting Chrome versions before 149.0.7827.103 on Windows, macOS, and Linux, where insufficient UI input validation could let a remote attacker attempt sandbox escape through a crafted HTML page...