chrome security

Google Chrome fixed CVE-2026-14152 on June 30, 2026, in Chrome 150.0.7871.47 for Windows and Mac, after disclosing an ANGLE out-of-bounds read/write flaw that could help an attacker escape the browser sandbox after first compromising the renderer process. The oddity is not that Chrome had...

Google Chrome CVE-2026-14154 is a DevTools UI-spoofing flaw disclosed June 30, 2026, affecting Chrome versions before 150.0.7871.47 and requiring an attacker to persuade a user to install a malicious Chrome extension. NVD lists the issue as sourced from Chrome, while CISA’s enrichment assigns a...

Google fixed CVE-2026-14155 in Chrome 150.0.7871.47 for Windows and Mac on June 30, 2026, after documenting that a StorageAccessAPI policy-enforcement flaw could let a remote attacker leak cross-origin data through a crafted HTML page. The vulnerability is not the scariest bug in Chrome 150, and...

CVE-2026-14156 is a Google Chrome StorageAccessAPI policy-enforcement flaw disclosed on June 30, 2026, affecting Chrome versions before 150.0.7871.47 and allowing a remote attacker with an already-compromised renderer process to bypass same-origin policy using a crafted HTML page. The short...

Google patched CVE-2026-13961 in Chrome 150.0.7871.47 for Windows after disclosing that a crafted HTML page, paired with specific user interface gestures, could let a remote attacker obtain potentially sensitive information from process memory through DevTools. The bug is rated Medium by...

Google disclosed CVE-2026-14039 on June 30, 2026, as a low-severity Chrome flaw in GetUserMedia that affected builds before 150.0.7871.47 and could let a remote attacker bypass same-origin policy with a crafted HTML page. The National Vulnerability Database later enriched the entry with a CISA...

CVE-2026-14059 is a Google Chrome vulnerability published by NVD on June 30, 2026, affecting Chrome versions before 150.0.7871.47 and allowing a remote attacker to leak cross-origin data through a crafted HTML page. The immediate fix is mundane: update Chrome. The more interesting story is that...

Google disclosed CVE-2026-14092 on June 30, 2026, as a low-severity Chrome privacy flaw fixed before version 150.0.7871.47, while NVD and CISA later described it as a cross-origin data leak requiring user interaction and a privileged network position. The bug is not the kind of browser...

Google disclosed CVE-2026-14105 on June 30, 2026, as a low-severity Chrome Speech flaw fixed in Chrome 150.0.7871.47, while NVD and CISA subsequently published sharply different CVSS assessments for the same same-origin-policy bypass. That disagreement is the story. A bug Google describes as a...

Google disclosed CVE-2026-13962 on June 30, 2026, as a medium-severity Chrome PDF input-validation flaw fixed in desktop Chrome 150.0.7871.47, allowing an attacker who had already compromised the renderer process to bypass navigation restrictions with a crafted HTML page. The National...

Google fixed CVE-2026-13958 in the June 30, 2026 Chrome 150 stable update for Windows, where versions before 150.0.7871.47 could leak potentially sensitive process memory through a crafted HTML page that exercised Chrome’s codecs component. The bug is rated Medium by Chromium and 6.5 Medium by...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13953, a medium-severity SplitView flaw published June 30, 2026, that could let an attacker who already compromised Chrome’s renderer bypass navigation restrictions using a crafted HTML page. The bug is not the kind of...

Google Chrome versions before 150.0.7871.47 are affected by CVE-2026-13938, an integer overflow in the browser’s font-handling code that can let a remote attacker trigger an out-of-bounds memory write when a user opens a crafted HTML page. The flaw landed in the National Vulnerability Database...

Google fixed CVE-2026-13935 in Chrome 150.0.7871.47 for Windows and Mac after disclosing that a Compute Pressure side-channel flaw could let a remote attacker leak cross-origin data through a crafted HTML page. The bug is only rated Medium, but the interesting part is not the score. It is the...

Google fixed CVE-2026-13890 in Chrome 150.0.7871.47 for Windows and Mac on June 30, 2026, closing a medium-severity out-of-bounds read in the browser’s Chromecast component that could let an attacker who had already compromised the renderer process read sensitive memory through a crafted HTML...

Google Chrome users running builds earlier than 150.0.7871.47 should treat CVE-2026-13881 as patched but not yet fully explained: the flaw was published June 30, 2026, affects Chrome’s WebAppInstalls component, and can let a crafted HTML page bypass the browser’s same-origin policy. That is the...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13845, a high-severity use-after-free flaw in the browser’s DOM code that could let a remote attacker execute code inside Chrome’s sandbox after a user opens a crafted HTML page. The bug arrived in the National Vulnerability Database...

Google fixed CVE-2026-13831, a high-severity Chromium GPU memory-safety flaw affecting Chrome before version 150.0.7871.47, in the June 30, 2026 Stable Channel update for desktop Chrome on Windows, macOS, and Linux. The vulnerability matters less because of its label than because of where it...

CVE-2026-13830 is a high-severity use-after-free flaw in Chrome’s Chromoting component, published by NVD on June 30, 2026, affecting Google Chrome on Linux before 150.0.7871.47 and described as allowing remote code execution through malicious network traffic. The oddity is not the bug class...

Google Chrome before version 150.0.7871.47 contains CVE-2026-13793, a high-severity Chromium SVG policy-enforcement flaw disclosed on June 30, 2026, that can let a remote attacker leak cross-origin data through a crafted HTML page. That is the plain answer, but it is not the full story. The more...