chrome security

Google’s June 30 Chrome 150 desktop release fixed CVE-2026-13782, a critical use-after-free flaw in the browser process that could let an attacker escape Chrome’s sandbox after compromising the renderer, with patched desktop builds shipping as Chrome 150.0.7871.46 for Linux and 150.0.7871.46/.47...

Google patched CVE-2026-13780 in Chrome 150.0.7871.47 for Windows and macOS after disclosing on June 30, 2026, that insufficient validation in ANGLE could let an attacker who had already compromised Chrome’s renderer escape the browser sandbox through a crafted HTML page. The NVD later rated the...

Google Chrome’s CVE-2026-13776 is a critical type-confusion flaw in the Dawn graphics layer, fixed in Chrome 150.0.7871.47 on June 30, 2026, and NVD’s change history indicates that Chrome CPE data was added even if the public page still shows a loading prompt. That is the small but important...

Google fixed CVE-2026-13775, a critical use-after-free flaw in Chrome’s GPU component, in the June 30, 2026 Stable Channel update that moved desktop Chrome to version 150.0.7871.47 on Windows and Mac and 150.0.7871.46 on Linux. The bug matters less because it is exotic than because it sits...

Google disclosed CVE-2026-14125 on June 30, 2026, as an uninitialized-use flaw in ANGLE affecting Google Chrome before version 150.0.7871.47, allowing a remote attacker to read potentially sensitive process memory through a crafted HTML page. The bug arrived in the National Vulnerability...

Google disclosed CVE-2026-13029 on June 24, 2026, as a high-severity use-after-free vulnerability in Chrome’s Web Authentication component affecting desktop versions before 149.0.7827.197, with exploitation requiring a user to install a malicious Chrome extension that could trigger heap...

Google disclosed CVE-2026-13031 on June 24, 2026, as a high-severity use-after-free flaw in Chrome’s Blink rendering engine, fixed in desktop Chrome 149.0.7827.196/197 and capable of letting a remote attacker execute code inside Chrome’s sandbox through a crafted HTML page. That sounds like the...

Google shipped Chrome 149.0.7827.196/197 for Windows and macOS and 149.0.7827.196 for Linux on June 23, 2026, fixing CVE-2026-13033, a critical Blink Interest Groups memory-safety flaw that could let a remote attacker execute code through a crafted HTML page. The bug is not merely another line...

CVE-2026-13034 is a high-severity Google Chrome vulnerability disclosed on June 24, 2026, affecting Chrome versions before 149.0.7827.197, where an attacker who had already compromised the renderer process could use a crafted HTML page to bypass site isolation. The short version is simple: this...

Google fixed CVE-2026-13021 in Chrome before version 149.0.7827.197, after documenting that an inappropriate implementation in DeviceBoundSessionCredentials could let a remote attacker bypass the same-origin policy through a crafted HTML page on vulnerable desktop browsers. That is the plain...

Google Chrome before 149.0.7827.197 contains CVE-2026-13022, a high-severity Chromium Autofill flaw disclosed June 24, 2026, that can let a remote attacker who has already compromised the renderer process leak cross-origin data through a crafted HTML page. The bug is not a stand-alone “visit a...

Google disclosed CVE-2026-11655 on June 8, 2026, as a high-severity integer overflow in Chrome’s Media component on macOS before version 149.0.7827.103, where an attacker who had already compromised the renderer could potentially escape the browser sandbox using a crafted HTML page. That...

Google disclosed CVE-2026-11700 on June 8, 2026, as a use-after-free flaw in Chrome’s Tracing component before version 149.0.7827.103 that could let an attacker who already compromised the renderer process attempt a sandbox escape through a crafted HTML page. That description sounds narrow...

Google Chrome CVE-2026-11699 is a high-severity use-after-free vulnerability in Chrome’s Bluetooth code on macOS, disclosed in June 2026 and fixed for Mac users in Chrome 149.0.7827.103 after Google’s stable-channel desktop security update. The bug is not the loudest Chrome flaw of the month...

CVE-2026-11697 is a high-severity Google Chrome vulnerability, published by NVD on June 8, 2026, affecting Chrome versions before 149.0.7827.103 on Windows, macOS, and Linux, where insufficient UI input validation could let a remote attacker attempt sandbox escape through a crafted HTML page...

CVE-2026-11691 is a high-severity Chromium vulnerability disclosed in June 2026 in Google Chrome’s New Tab Page, fixed before version 149.0.7827.103, that could let an attacker who had already compromised the renderer leak cross-origin data through a crafted HTML page. The awkward phrasing...

Google Chrome before version 149.0.7827.103 contains CVE-2026-11688, a high-severity SVG implementation flaw disclosed on June 8, 2026, that can let a remote attacker execute arbitrary code inside Chrome’s sandbox when a user opens a crafted HTML page. That is the plain answer; the more useful...

Google Chrome before 149.0.7827.103 contains CVE-2026-11684, a high-severity Chromium Network flaw disclosed on June 8, 2026, that could let an attacker leak cross-origin data after compromising Chrome’s utility process through a crafted HTML page. The short version for Windows users is simple...

Google Chrome’s CVE-2026-11676 was published on June 8, 2026, as a high-severity Dawn vulnerability affecting Linux and ChromeOS before Chrome 149.0.7827.103, with NVD later adding a CPE configuration that appears narrower and messier than the plain-language advisory suggests. The uncomfortable...

Google assigned CVE-2026-11673 to a high-severity use-after-free flaw in Chrome’s InterestGroups component, fixed in Chrome 149.0.7827.103 for Windows and macOS before June 9, 2026, after NVD published the entry on June 8. The exploit condition is brutally familiar: a crafted HTML page, user...