New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Google Chrome: Incorrect authorization in Input bypasses web origin policy

Google Chrome for desktop prior to 156.0.8078.79 contains an incorrect authorization flaw in the Input component. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page, which requires social engineering. The official CVE record rates the impact as high (CVSS 8.8), but the Chrome release notes describe the flaw as a use-after-free, so the description should be verified against NVD and the vendor advisory.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem

A flaw in the FileSystem component of Google Chrome before 156.0.8078.79 may allow a remote attacker to potentially execute arbitrary code. The CVE data describes incorrect authorization (CWE-863) that could allow code execution outside the sandbox, and it requires a user to open a crafted HTML page after social engineering. Sources disagree on the description, CWE and CVSS score (some trackers list memory corruption, CWE-119, code execution inside the sandbox and CVSS 6.3), so the exact impact must be verified against the NVD record.

Google · Chrome

Google Chrome: Improper input validation in Network

Google Chrome before 156.0.8078.79 contains an improper input validation flaw in its Network component (CVE-2026-76029, rated High by Chromium). According to the CVE text, a remote attacker can execute arbitrary code inside the browser sandbox by sending crafted network traffic. Other sources describe a memory corruption flaw triggered by a crafted HTML page, so the exact conditions and the CVSS score of 8.8 must be verified against the NVD entry.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in its FileSystem component (CWE-863 in the CVE record). A remote attacker who lures a user to a crafted HTML page can, with social engineering, execute arbitrary code outside the sandbox. The CVE record rates it High (CVSS 8.8), but other sources differ on the bug class and score, so the vendor fix should be applied regardless.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Origin validation error in Autofill

Google Chrome prior to 156.0.8078.79 contains an origin validation error in its Autofill feature (CWE-346, CVSS 8.8 per the supplied data). A remote attacker can use a crafted HTML page to bypass the web origin policy, and the victim must open that page. Secondary sources describe this issue as a memory corruption bug (CWE-119, VulDB CVSS 6.3), and the NVD record was still pending, so the details should be verified.

Google · Chrome

Google Chrome: Incorrect authorization in FileSystem allows code execution

Google Chrome prior to 156.0.8078.79 contains an incorrect authorization flaw in the FileSystem component. A remote attacker can use social engineering and a crafted HTML page to execute arbitrary code outside the browser sandbox. The attack requires the victim to visit the malicious page.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Uninitialized resource in Skia enables memory read

Google Chrome versions prior to 156.0.8078.79 contain an uninitialized resource flaw in the Skia graphics library. An attacker who has already compromised the renderer process can use a crafted HTML page to read memory outside the sandbox. The attack requires a user to visit the page, and the vendor rates the Chromium security severity as High. The CVE record and the research notes disagree on the weakness type (CWE-908 versus use-after-free), so the NVD record should be checked.

Google · Chrome

Google Chrome: Incorrect reference resolution in CacheStorage

A flaw in the CacheStorage component of Google Chrome allows a remote attacker to obtain sensitive information via a crafted HTML page. According to the CVE record, the attacker must already have compromised the renderer process. The assessment is CVSS 8.8 (NVD status: Modified), and the Chromium severity is High.

Google · Chrome

Google Chrome: Incorrect authorization in Blink allows origin policy bypass

Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in the Blink rendering engine. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page. The attack requires no login but needs the user to open the page. The official CVE record states High severity. The research notes indicate that public sources describe this CVE ID differently (use-after-free, CWE-416), so the description should be verified against NVD before client reporting.

Google · Chrome

Google Chrome: Use-after-free in Editing component

A use-after-free flaw in the Editing component of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attacker needs a victim to open a crafted HTML page, so any user browsing the web is in scope. The CVE record lists CWE-416 (use-after-free), but one aggregator describes it as an integer overflow (CWE-190), so the weakness type should be verified in NVD.

Google · Chrome

Google Chrome: Use-after-free in DOM allows code execution in sandbox

A use-after-free flaw in the DOM component of Google Chrome desktop versions before 156.0.8078.79 can be exploited by a remote attacker. If a user opens a crafted HTML page, the attacker can execute arbitrary code inside the browser sandbox. Exploitation requires the victim to visit the page, and the sandbox escape needed for a full compromise is not described.

Google · Chrome