Loading story…
Google Chrome addressed two high-severity heap buffer overflow vulnerabilities that could be used to help break out of the browser sandbox. CVE-2026-6296 affects ANGLE in Chrome versions prior to 147.0.7727.101 and could allow a remote attacker to potentially achieve a sandbox escape by luring a user to a crafted HTML page. The flaw is tracked as CWE-122 and carries a CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating high impact across confidentiality, integrity, and availability.
Google also fixed CVE-2026-7353, a separate Skia heap buffer overflow affecting Chrome versions prior to 147.0.7727.138. Chromium rated the issue as high severity and said a remote attacker who had already compromised the renderer process could potentially use a crafted HTML page to achieve a sandbox escape. The bug is also classified as CWE-122 and was assigned the CVSS:3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Google linked both issues to Chrome release notes and Chromium issue tracker entries as part of the remediation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-7353 record was updated to add a CVSS v3.1 vector and references to the Chrome Releases blog and Chromium issue tracker. The added scoring reflected high impact to confidentiality, integrity, and availability with required user interaction and scope change.
A heap buffer overflow vulnerability in Skia affecting Google Chrome versions prior to 147.0.7727.138 was published as CVE-2026-7353. Chromium described it as High severity, and exploitation could potentially enable a sandbox escape after renderer compromise via a crafted HTML page.
A critical heap buffer overflow vulnerability in ANGLE affecting Google Chrome versions prior to 147.0.7727.101 was recorded as CVE-2026-6296. The flaw could allow a remote attacker to potentially achieve a sandbox escape by luring a user to a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome patched two high-severity heap buffer overflow vulnerabilities, **`CVE-2026-5272`** in the browser's GPU component and **`CVE-2026-5275`** in **ANGLE**, that could allow **remote arbitrary code execution** if a user opened a crafted HTML page. Both flaws are classified as **`CWE-122`** and carry a **CVSS v3.1** rating of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, reflecting low attack complexity and high potential impact to confidentiality, integrity, and availability. The issues affect Google Chrome versions prior to **`146.0.7680.178`**, with impacted platforms listed across **Windows, Linux, and macOS**, while the ANGLE flaw was specifically described as affecting Chrome on Mac. The vulnerabilities were referenced in Google's Chrome stable channel advisory and Chromium issue tracker, underscoring the need for organizations to update browsers promptly to the patched release to reduce exposure to malicious web content.
Jun 29, 2026
Google disclosed two high-severity use-after-free vulnerabilities in Chrome, **CVE-2026-6302** and **CVE-2026-6304**, affecting versions prior to **`147.0.7727.101`**. The flaws reside in the browser's **Video** and **Graphite** components and can be triggered with a crafted HTML page. **CVE-2026-6302** could allow a remote attacker to execute arbitrary code inside the sandbox, while **CVE-2026-6304** could let an attacker who has already compromised the renderer process potentially escape Chrome's sandbox. Both issues are classified as **`CWE-416`** use-after-free bugs and were rated **High** severity by Chromium. The published CVSS v3.1 vectors indicate significant potential impact to confidentiality, integrity, and availability, with **CVE-2026-6302** scored as **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`** and **CVE-2026-6304** as **`AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H`**. Organizations running Chrome should prioritize upgrading to **`147.0.7727.101`** or later to mitigate the risk from malicious web content targeting these memory-safety flaws.
Jun 29, 2026
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026