use-after-free

Overview Google has patched a high-severity use-after-free vulnerability in Chrome’s FileSystem component, tracked as CVE-2026-6360, and the fix is now part of the Stable channel build 147.0.7727.101/102 for Windows and Mac and 147.0.7727.101 for Linux. The issue was disclosed in Google’s April...

Google’s disclosure of CVE-2026-6318 is another reminder that the browser security story is still dominated by memory safety bugs, not just policy bypasses and UI tricks. The flaw is a use-after-free in Codecs affecting Google Chrome prior to 147.0.7727.101, and Google says a crafted HTML page...

Chromium’s latest security disclosure is a sharp reminder that browser code paths still sit at the center of modern attack surface. CVE-2026-6362 is a use-after-free in Codecs that affects Google Chrome versions prior to 147.0.7727.101, and Google says a remote attacker could potentially trigger...

The discovery of CVE-2026-6359 is a reminder that browser security issues rarely stop at the label attached to the bug. Google’s April 15, 2026 Chrome release shows the flaw is a use-after-free in Video, fixed in Chrome 147.0.7727.101/102 for Windows and Mac and 147.0.7727.101 for Linux, while...

In this article, I'll explain the significance of CVE-2026-23410, a Linux kernel AppArmor race condition that can turn into a use-after-free and, under the right circumstances, a serious denial-of-service or even broader compromise vector. The issue sits in a subtle corner of AppArmor’s...

CVE-2026-34757 is the latest reminder that image parsing bugs can still punch far above their weight in modern software stacks. According to Microsoft’s Security Update Guide entry, the flaw in libpng is a use-after-free affecting png_set_PLTE, png_set_tRNS, and png_set_hIST, with the practical...

CVE-2026-33416 is a reminder that mature image libraries can still hide dangerous memory-safety bugs in code paths that look deceptively routine. Microsoft’s update guide frames the flaw as a use-after-free in libpng with high availability impact, and the PNG Project says the bug affects...

CVE-2026-32080 is being treated by Microsoft as a Windows WalletService elevation-of-privilege issue, and the first-pass picture is straightforward: this is a local privilege-escalation bug in a Windows component that can matter a great deal once an attacker already has a foothold. Public...

CVE-2026-27923 is the kind of Windows flaw that security teams dislike not because it is glamorous, but because it is practical: a local elevation-of-privilege issue in Desktop Window Manager that can turn a foothold into full system control. Microsoft’s advisory places the bug in DWM, the...

Microsoft’s April 14, 2026 Patch Tuesday brought a new local privilege escalation flaw into focus: CVE-2026-27916, a Windows UPnP Device Host vulnerability that Microsoft rates as an elevation-of-privilege issue. The public description points to a use-after-free condition, a classic...

CVE-2026-31419 is a good example of how a kernel bug can look deceptively narrow while still carrying real operational weight. The flaw sits in the Linux bonding driver’s broadcast transmit path, where the code reused the original skb for the “last” slave and cloned it for the others. Under...

Google has published CVE-2026-5866, a use-after-free in Chrome’s Media component that can let a remote attacker execute code inside the browser sandbox through a crafted HTML page. The issue affects Google Chrome versions prior to 147.0.7727.55, and it has been assigned Chromium security...

Microsoft’s latest Chromium security cycle has surfaced CVE-2026-5872, a use-after-free in Blink that affects Google Chrome prior to 147.0.7727.55 and can let a remote attacker execute code inside the browser sandbox through a crafted HTML page. Microsoft’s Security Update Guide now reflects the...

Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 is one of those browser bugs that looks narrow on paper but has broad implications in practice. Microsoft’s Security Update Guide records it as CVE-2026-5874 and ties it to a crafted HTML page that can coerce a user into...

Google’s newly published CVE-2026-5877 is a reminder that browser security still hinges on the same class of memory-safety bugs that have haunted Chromium for years: a use-after-free in Navigation that can let a remote attacker execute code inside Chrome’s sandbox through a crafted HTML page...

The Chromium team has disclosed CVE-2026-5883, a use-after-free in Media that affects Google Chrome prior to 147.0.7727.55 and can let a remote attacker execute arbitrary code inside the browser sandbox through a crafted HTML page. Microsoft’s Security Update Guide also tracks the issue, and the...

Linux’s Bluetooth stack has a fresh use-after-free flaw, tracked as CVE-2026-31408, and the issue sits in one of the trickier parts of kernel networking: the SCO path that handles synchronous audio traffic. The bug arises in sco_recv_frame(), where the code reads conn->sk while holding...

Google has patched a high-severity use-after-free in Chrome’s CSS engine, tracked as CVE-2026-5273, in the Stable desktop update that landed on Tuesday, March 31, 2026. The fix ships in Chrome 146.0.7680.177/178 for Windows and Mac and 146.0.7680.177 for Linux, and Google says the flaw could let...

CVE-2026-5284 is another reminder that modern browser security is rarely about a single flaw in isolation. The issue is a use-after-free in Dawn, Chrome’s WebGPU-related graphics stack, and Google says it could let a remote attacker who had already compromised the renderer process execute...

Google’s latest Chromium security cycle has added another high-priority browser flaw to the patch queue, and this time the weak point sits in a place most users treat as routine: PDF rendering. CVE-2026-5287 is a use-after-free issue in Chrome’s PDF handling that Google says allowed a remote...