Loading story…
Google disclosed two high-severity Chrome vulnerabilities that could be triggered when a user visits a crafted HTML page, affecting the browser's WebCodecs and V8 components. CVE-2026-5292 is an out-of-bounds read in WebCodecs, tracked as CWE-125, and impacts Chrome versions prior to 146.0.7680.178. The flaw carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating remote exploitation with user interaction and potentially high impact to confidentiality, integrity, and availability.
Google also recorded CVE-2026-6363, a type confusion issue in V8 tracked as CWE-843, affecting Chrome versions prior to 147.0.7727.101. Chrome rated the V8 bug with Medium Chromium security severity, but the published CVSS v3.1 vector likewise reflects potentially high impact if exploited through malicious web content. Both vulnerabilities were documented in Chrome release materials and Chromium issue tracker entries, underscoring the need for organizations to update Chrome promptly to the patched versions.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Later the same day, the CVE-2026-6363 record was modified to add a CVSS v3.1 vector indicating high potential impact and references to the Chrome Releases blog and Chromium issue tracker. Chrome classified the underlying Chromium issue with Medium security severity.
Google newly recorded CVE-2026-6363, a type confusion vulnerability in Chrome's V8 engine affecting versions prior to 147.0.7727.101. The issue could allow a remote attacker to trigger out-of-bounds memory access through a crafted HTML page.
Google received and recorded CVE-2026-5292 for an out-of-bounds read vulnerability in Chrome's WebCodecs component. The flaw affects Chrome versions prior to 146.0.7680.178 and can be triggered by a remote attacker via a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome patched two high-severity vulnerabilities affecting desktop builds on **Windows, Linux, and macOS** before version `146.0.7680.178`. The first, `CVE-2026-5282`, is an out-of-bounds read in **WebCodecs** that could be triggered if a user opens a crafted HTML page, potentially exposing sensitive memory and causing a crash. NVD classified the flaw as `CWE-125` and scored it with the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H`, indicating remote exploitation with low complexity but requiring user interaction. The second flaw, `CVE-2026-5289`, is a **use-after-free** in Chrome's **Navigation** component that could allow an attacker who has already compromised the renderer process to potentially escape the browser sandbox through a crafted HTML page. NVD mapped the issue to `CWE-416` and assigned the vector `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`, reflecting the risk of broader compromise across confidentiality, integrity, and availability. Google referenced both issues in its Chrome stable channel advisory and linked them to Chromium issue tracker entries, making version `146.0.7680.178` the key remediation point for affected users and enterprises.
Jun 29, 2026
Google released a **Chrome Stable** security update for desktop that fixes two **high-severity** vulnerabilities that could enable **arbitrary code execution** or **denial-of-service** conditions. The update advances Chrome to `144.0.7559.132/.133` on Windows and macOS and `144.0.7559.132` on Linux, with a staged rollout over days to weeks; exploitation is described as typically requiring a victim to visit a specially crafted website that triggers the bug in the renderer context. The patched issues are **CVE-2026-1862**, a **type confusion** flaw in the **V8** JavaScript/WebAssembly engine (reported by researcher **Chaoyuan Peng / @ret2happy**) that can enable out-of-bounds memory access and potentially code execution, and **CVE-2026-1861**, a **heap buffer overflow** in the **libvpx** VP8/VP9 video codec library that could be triggered by crafted media content to crash the browser/system or potentially hijack control flow. Google is restricting detailed bug information and links until most users have applied the fix to reduce the risk of rapid exploit development via patch diffing.
Jun 29, 2026
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026