chrome security

Google disclosed CVE-2026-14014 on June 30, 2026, as a medium-severity Chrome vulnerability fixed in desktop Chrome 150.0.7871.47, where an inappropriate implementation in the browser’s Paint component could let a remote attacker spoof user-interface content through a crafted HTML page. The...

Google patched CVE-2026-14019 in Chrome 150.0.7871.47 for Windows and Mac on June 30, 2026, fixing a medium-severity Passwords-component flaw that could let a remote attacker leak cross-origin data through a crafted HTML page if a user visited it. The National Vulnerability Database entry, fed...

Google disclosed CVE-2026-14024 on June 30, 2026, as a medium-severity use-after-free flaw in Chrome’s Linux Ozone layer, fixed for Chrome 150 and described by NVD as affecting Google Chrome on Linux before version 150.0.7871.47. The bug is not a Windows vulnerability in the narrow platform...

Google Chrome before version 150.0.7871.47 contains CVE-2026-14026, a SplitView security-interface flaw disclosed on June 30, 2026, that can let a remote attacker use a crafted HTML page and user gestures to spoof browser UI on Windows, macOS, and Linux. The bug is not a drive-by code execution...

On June 30, 2026, Google disclosed CVE-2026-14037, a Chrome GPU-process policy-enforcement flaw fixed in desktop Chrome 150.0.7871.47 that could let an attacker escape the browser sandbox after first compromising the renderer process with a crafted HTML page. The awkward part is not merely the...

Google fixed CVE-2026-14040 in Chrome 150.0.7871.47, released through the Stable Channel for desktop on June 30, 2026, after documenting a low-severity use-after-free flaw in BrowserTag that required a malicious Chrome extension and user installation to become exploitable. That narrow attack...

Google Chrome before version 150.0.7871.47 on Windows and Mac contains CVE-2026-14056, a Media input-validation flaw disclosed June 30, 2026, that could let an attacker who already compromised Chrome’s renderer process attempt a sandbox escape through a crafted video file. The uncomfortable part...

Google Chrome CVE-2026-14061 is a low-severity Chromium Dawn information-disclosure flaw fixed in Chrome 150.0.7871.47, published by NVD on June 30, 2026, and later enriched by CISA with a medium CVSS 3.1 score tied to crafted HTML and user interaction. The oddity is not the bug itself; it is...

Google Chrome before version 150.0.7871.47 contains CVE-2026-14063, a low-severity Chromium flaw in the Chromecast component that Google says could let a local attacker read potentially sensitive process memory through malicious network traffic under user-interaction conditions. That sounds...

Google’s Chrome team fixed CVE-2026-14070, an information-disclosure flaw in Chrome’s WebNN implementation, in the June 30, 2026 Stable Channel update that moved desktop users to Chrome 150.0.7871.46 or 150.0.7871.47 across Windows, macOS, and Linux, according to NVD and Google’s release notes...

Google published CVE-2026-14084 on June 30, 2026, for an insufficient-input-validation flaw in Chrome’s Chromoting component before version 150.0.7871.47, where malicious network traffic could potentially trigger heap corruption in the browser. The entry looks modest at first because Chromium...

Google fixed CVE-2026-14087 in Chrome 150.0.7871.47 for Windows on June 30, 2026, after documenting a WebNN heap buffer overflow that could be reached through a crafted HTML page once an attacker had already compromised the renderer process. The bug is formally rated Low by Chromium, but CISA’s...

Google Chrome before version 150.0.7871.47 contained CVE-2026-14089, a low-severity Chromium PopupBlocker input-validation flaw disclosed June 30, 2026, that could let an attacker who had already compromised the renderer process spoof browser UI through a crafted HTML page. The National...

Google Chrome fixed CVE-2026-14093 in the June 30, 2026 Chrome 150 stable desktop release for Windows, macOS, and Linux, closing a Cast use-after-free flaw that could let an attacker escape the browser sandbox after first compromising the renderer process. The oddity is not that Chrome had...

Google fixed CVE-2026-14100 in Chrome 150.0.7871.47 after disclosing on June 30, 2026 that insufficient data validation in Chromium’s NetworkCache could let a remote attacker leak cross-origin data through a crafted HTML page. The bug is not a headline-grabbing memory-corruption zero-day, and...

Google fixed CVE-2026-14102 in Chrome 150.0.7871.47 for Windows and Mac on June 30, 2026, closing a use-after-free bug in the browser’s Passwords component that could let a remote attacker trigger heap corruption through a crafted HTML page. The awkward part is not that Chrome had another...

Google’s Chrome team fixed CVE-2026-14117 in the June 30, 2026 Stable Channel desktop update, addressing a Windows-only DevTools input-validation flaw in Chrome versions before 150.0.7871.47 that could leak sensitive process-memory data after user interaction with a crafted web page. The...

Google Chrome for Windows versions before 150.0.7871.47 are affected by CVE-2026-14119, a Bluetooth type-confusion flaw disclosed on June 30, 2026, that can let a nearby attacker using a malicious peripheral read potentially sensitive memory from a Chrome process. The bug is not a...

Google Chrome before version 150.0.7871.47 contains CVE-2026-14127, a printing-related UI spoofing flaw disclosed on June 30, 2026, that can be triggered by a crafted HTML page after an attacker has already compromised Chrome’s renderer process. That last condition is the whole story: this is...

Google disclosed CVE-2026-14150 on June 30, 2026, as a low-severity Chrome Speech-component flaw fixed in Chrome 150.0.7871.47 for Windows and Mac, allowing UI spoofing only after an attacker had already compromised the renderer process. The National Vulnerability Database then enriched the...