chrome security

Google disclosed CVE-2026-7987 on May 6, 2026, as a WebRTC use-after-free flaw in Chrome before version 148.0.7778.96 that can let a remote attacker run code inside the browser sandbox through a crafted HTML page. That sounds narrow, almost boring, until you notice where the bug lives: WebRTC...

Google and Microsoft disclosed CVE-2026-7995 on May 6–7, 2026, an out-of-bounds read in Chromium’s AdFilter component affecting Chrome before 148.0.7778.96 and Edge builds consuming the vulnerable Chromium code, with exploitation possible through a crafted HTML page inside the browser sandbox...

Chrome’s CVE-2026-8001, disclosed May 6, 2026 and fixed in Chrome 148.0.7778.96 for Linux and 148.0.7778.96/97 for Windows and Mac, is a printing-component use-after-free flaw that could help a renderer-compromising attacker escape the browser sandbox on Linux, macOS, and ChromeOS. That is the...

Google and Microsoft moved CVE-2026-8003 into the public vulnerability pipeline this week after Chrome 148.0.7778.96 fixed an input-validation flaw in TabGroups that could let a remote attacker spoof browser UI through malicious network traffic. The bug is rated low by Chromium but medium by...

Google and Microsoft disclosed CVE-2026-8007 on May 6, 2026, describing a Cast component input-validation flaw in Chromium-based browsers before Chrome 148.0.7778.96 that could let an attacker escalate privileges after first compromising the renderer process with a crafted web page. The dry...

CVE-2026-8011 is a low-severity Chromium vulnerability disclosed on May 6, 2026, affecting Google Chrome before version 148.0.7778.96, where insufficient policy enforcement in Search could let a remote attacker leak cross-origin data through a crafted HTML page. The bug is not the sort of...

Google and Microsoft disclosed CVE-2026-8015 on May 6, 2026, after fixing a low-severity Chromium Media flaw in Chrome versions before 148.0.7778.96 that could let a remote attacker spoof browser UI through a crafted HTML page. The bug is not the sort of memory-corruption monster that dominates...

On April 28, 2026, Google shipped Chrome 147.0.7727.137/138 for Windows and Mac and 147.0.7727.137 for Linux, fixing CVE-2026-7341, a high-severity use-after-free flaw in WebRTC that could let a remote attacker run code inside Chrome’s sandbox through a crafted HTML page. The bug is not the...

CVE-2026-7337 is a high-severity type confusion flaw in Chrome’s V8 JavaScript engine, disclosed April 28, 2026, affecting Google Chrome before 147.0.7727.138 and patched in the April 28 Stable Channel desktop update for Windows, macOS, and Linux. The bug is not a garden-variety browser...

Google disclosed CVE-2026-7345 on April 28, 2026, as a high-severity Chrome vulnerability in the browser’s Feedback component, fixed in Chrome 147.0.7727.138 after allowing a renderer-compromising attacker to potentially escape the sandbox through a crafted HTML page. That sounds narrow, almost...

Google and Microsoft disclosed CVE-2026-7335 on April 28, 2026, after Chrome’s stable desktop update to 147.0.7727.137/138 fixed a high-severity use-after-free flaw in Chromium’s media component that could let a remote attacker run code inside the browser sandbox through a crafted HTML page. The...

Google and Microsoft disclosed CVE-2026-7358 on April 28, 2026, as a high-severity use-after-free flaw in Chrome’s Animation component affecting Google Chrome before version 147.0.7727.138, with exploitation possible through a crafted HTML page that can execute code inside Chrome’s sandbox. The...

Google disclosed CVE-2026-7344 on April 28, 2026, as a critical use-after-free flaw in Chrome’s Accessibility component on Windows before version 147.0.7727.138 that could let an attacker escape the browser sandbox after compromising the renderer. The bug is not just another Chrome memory-safety...

Google disclosed CVE-2026-7359 on April 28, 2026, as a high-severity use-after-free flaw in Chrome’s ANGLE graphics layer before version 147.0.7727.138, enabling a renderer-compromising attacker to potentially escape the browser sandbox through a crafted HTML page on desktop platforms. The...

Google disclosed CVE-2026-7343 on April 28, 2026, as a critical use-after-free flaw in Chrome’s Views component on Windows before version 147.0.7727.138, enabling a renderer-compromising attacker to potentially escape the browser sandbox via crafted HTML. That dry sentence is the whole drama in...

Chromium’s latest security alert, CVE-2026-6919, is a reminder that browser hardening is no longer just about JavaScript engines, media codecs, or extension permissions. The flaw is a use-after-free vulnerability in DevTools affecting Google Chrome versions before 147.0.7727.117, and it could...

Google has patched CVE-2026-6302, a high-severity use-after-free flaw in Chrome’s Video component, in Chrome version 147.0.7727.101 for Linux and 147.0.7727.101/102 for Windows and Mac. The issue could let a remote attacker achieve arbitrary code execution inside the browser sandbox by luring a...

The latest Chromium security cycle has put CVE-2026-6299 under a harsh spotlight because it combines three things defenders hate to see together: a use-after-free bug, a critical Chromium severity rating, and a fix that lands in a browser engine used by far more than just Google Chrome...

Google has patched CVE-2026-6297, a use-after-free in Proxy that affects Chrome versions before 147.0.7727.101 and carries a Critical Chromium severity rating. The public description says a crafted HTML page could allow an attacker in a privileged network position to potentially achieve a...

Insufficient policy enforcement bugs in Chromium continue to be a reminder that browser security is often won or lost at the seams between isolation boundaries, not just in the core rendering engine. CVE-2026-6312 fits that pattern: Google says a remote attacker who had already compromised the...