New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Google Chrome: Incorrect authorization in Input bypasses web origin policy

Google Chrome for desktop prior to 156.0.8078.79 contains an incorrect authorization flaw in the Input component. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page, which requires social engineering. The official CVE record rates the impact as high (CVSS 8.8), but the Chrome release notes describe the flaw as a use-after-free, so the description should be verified against NVD and the vendor advisory.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem

A flaw in the FileSystem component of Google Chrome before 156.0.8078.79 may allow a remote attacker to potentially execute arbitrary code. The CVE data describes incorrect authorization (CWE-863) that could allow code execution outside the sandbox, and it requires a user to open a crafted HTML page after social engineering. Sources disagree on the description, CWE and CVSS score (some trackers list memory corruption, CWE-119, code execution inside the sandbox and CVSS 6.3), so the exact impact must be verified against the NVD record.

Google · Chrome

Google Chrome: Improper input validation in Network

Google Chrome before 156.0.8078.79 contains an improper input validation flaw in its Network component (CVE-2026-76029, rated High by Chromium). According to the CVE text, a remote attacker can execute arbitrary code inside the browser sandbox by sending crafted network traffic. Other sources describe a memory corruption flaw triggered by a crafted HTML page, so the exact conditions and the CVSS score of 8.8 must be verified against the NVD entry.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in its FileSystem component (CWE-863 in the CVE record). A remote attacker who lures a user to a crafted HTML page can, with social engineering, execute arbitrary code outside the sandbox. The CVE record rates it High (CVSS 8.8), but other sources differ on the bug class and score, so the vendor fix should be applied regardless.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Origin validation error in Autofill

Google Chrome prior to 156.0.8078.79 contains an origin validation error in its Autofill feature (CWE-346, CVSS 8.8 per the supplied data). A remote attacker can use a crafted HTML page to bypass the web origin policy, and the victim must open that page. Secondary sources describe this issue as a memory corruption bug (CWE-119, VulDB CVSS 6.3), and the NVD record was still pending, so the details should be verified.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome prior to 156.0.8078.79 contains an incorrect authorization flaw in the FileSystem component. A remote attacker can use social engineering and a crafted HTML page to execute arbitrary code outside the browser sandbox. The attack requires the victim to visit the malicious page.

Google · Chrome

Google Chrome: Use-after-free in MediaStream

Google Chrome contains a use-after-free vulnerability in its MediaStream component, which handles audio and video feeds for web pages. A remote attacker can exploit it by luring a user to a crafted HTML page, which may allow arbitrary code execution inside the browser sandbox. Exploitation requires user interaction, and Chromium rates the issue as critical. As of the research date, no exploitation in the wild and no public proof of concept are known.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Uninitialized resource in Skia enables memory read

Google Chrome versions prior to 156.0.8078.79 contain an uninitialized resource flaw in the Skia graphics library. An attacker who has already compromised the renderer process can use a crafted HTML page to read memory outside the sandbox. The attack requires a user to visit the page, and the vendor rates the Chromium security severity as High. The CVE record and the research notes disagree on the weakness type (CWE-908 versus use-after-free), so the NVD record should be checked.

Google · Chrome

Google Chrome: Incorrect reference resolution in CacheStorage

A flaw in the CacheStorage component of Google Chrome allows a remote attacker to obtain sensitive information via a crafted HTML page. According to the CVE record, the attacker must already have compromised the renderer process. The assessment is CVSS 8.8 (NVD status: Modified), and the Chromium severity is High.

Google · Chrome

Google Chrome: Incorrect authorization in Blink allows origin policy bypass

Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in the Blink rendering engine. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page. The attack requires no login but needs the user to open the page. The official CVE record states High severity. The research notes indicate that public sources describe this CVE ID differently (use-after-free, CWE-416), so the description should be verified against NVD before client reporting.

Google · Chrome

Google Chrome: Use-after-free in Editing component

A use-after-free flaw in the Editing component of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attacker needs a victim to open a crafted HTML page, so any user browsing the web is in scope. The CVE record lists CWE-416 (use-after-free), but one aggregator describes it as an integer overflow (CWE-190), so the weakness type should be verified in NVD.

Google · Chrome

Google Chrome: Use-after-free in DOM allows code execution in sandbox

A use-after-free flaw in the DOM component of Google Chrome desktop versions before 156.0.8078.79 can be exploited by a remote attacker. If a user opens a crafted HTML page, the attacker can execute arbitrary code inside the browser sandbox. Exploitation requires the victim to visit the page, and the sandbox escape needed for a full compromise is not described.

Google · Chrome

Google Chrome: Incorrect reference resolution in Quota leads to sandbox escape

Google Chrome contains an incorrect reference resolution flaw in its Quota component (CWE-706). According to the official CVE record, a remote attacker who has already compromised the renderer process can use a crafted HTML page to potentially execute arbitrary code outside the sandbox. Exploitation requires a user to visit the page and a separate renderer compromise, so it is a chained attack. Third-party sources describe the bug as a use-after-free inside the sandbox, so the official record should be verified.

Google · Chrome

Google Chrome: Incorrect reference resolution in Quota

A flaw in the Quota component of Google Chrome allows incorrect reference resolution. A remote attacker who has already compromised the renderer process can use crafted network traffic to execute arbitrary code outside the sandbox. The attack requires a second, chained vulnerability to compromise the renderer first, and the record is marked as modified, so the final NVD text should be checked.

Google · Chrome

Google Chrome Dawn: Use after free (memory corruption)

Google Chrome versions before 156.0.8078.79 contain a flaw in Dawn, the WebGPU implementation in Chromium. According to the CVE description, a remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the sandbox, and user interaction is required. The sources differ on the bug class (use after free in the CVE description, memory corruption in Google's release notes) and on whether the sandbox is escaped, so this is unresolved.

Google · Chrome

Google Chrome: Use-after-free in GarbageCollection allows code execution

A use-after-free flaw in the GarbageCollection component of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a victim loads a crafted HTML page, for example via a malicious website, a phishing link or a malicious advertisement. The CVSS base score is 9.6 (critical), and Google rates the Chromium security severity as High.

Google · Chrome

Google Chrome: Out-of-bounds write in V8 JavaScript engine

A memory corruption flaw (out-of-bounds write) in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. An attacker needs a user to open a crafted HTML page, for example via a phishing link, a malicious advertisement or a compromised website. Code execution is limited to the sandbox; the description does not claim a full system compromise.

Google · Chrome

Google Chrome: Improper input validation in Skia graphics engine

Improper input validation in Skia, the 2D graphics engine of Google Chrome desktop, is listed in the Chrome release notes as High severity. The supplied description calls it a buffer overflow that requires a compromised renderer process, but the release note and research notes do not confirm this, so the weakness type and preconditions must be verified on NVD. Per the description, an attacker could use a crafted HTML page to potentially execute code outside the sandbox. The CVSS score is 9.6 (critical), but the record should be checked before prioritising.

Google · Chrome

Google Chrome: Use after free in Frames allows code execution in sandbox

Google Chrome versions before 156.0.8078.79 contain a use-after-free flaw in the Frames component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, for example through a link in a phishing email.

Google · Chrome

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Apple

Research and translation in progress – available shortly.