Loading story…
Microsoft published security advisories for a broad set of Chromium vulnerabilities affecting its browser platform, including CVE-2026-7344 (use-after-free in Accessibility), CVE-2026-7341 (use-after-free in WebRTC), CVE-2026-7353 (heap buffer overflow in Skia), and CVE-2026-7337 (type confusion in V8). Additional flaws patched include use-after-free bugs in Views, Media, GPU, Cast, and Navigation, along with insufficient validation of untrusted input in Compositing and an inappropriate implementation issue in Tint.
The volume and variety of bugs indicate a significant browser security update focused on memory-safety and input-handling weaknesses in Chromium components commonly exposed through web content. Microsoft also listed CVE-2026-31682, a separate issue tied to br_nd_send and Neighbor Discovery option parsing, but the main body of advisories centers on Chromium-derived fixes that organizations should prioritize across Microsoft Edge deployments to reduce risk from malicious websites and crafted content.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft's Security Update Guide published an advisory for CVE-2026-7980, a Chromium use-after-free vulnerability in WebAudio. The advisory represents a new Microsoft-tracked Chromium vulnerability disclosure.
Microsoft's Security Update Guide published an advisory for CVE-2026-7977, a Chromium vulnerability described as inappropriate implementation in Canvas. The advisory represents a new Microsoft-tracked Chromium vulnerability disclosure.
Microsoft's Security Update Guide published an advisory for CVE-2026-7914, a Chromium type confusion vulnerability in Accessibility. The advisory appears as a new Microsoft-tracked Chromium vulnerability disclosure.
Microsoft's Security Update Guide published a batch of Chromium-related vulnerability advisories, including CVE-2026-7333, CVE-2026-7334, CVE-2026-7335, CVE-2026-7337, CVE-2026-7338, CVE-2026-7341, CVE-2026-7343, CVE-2026-7344, CVE-2026-7346, CVE-2026-7353, CVE-2026-7356, and CVE-2026-7360. The entries cover issues such as use-after-free, type confusion, heap buffer overflow, inappropriate implementation, and insufficient validation of untrusted input across Chromium components.
Microsoft's Security Update Guide published an advisory for CVE-2026-31682, described as "bridge: br_nd_send: linearize skb before parsing ND options." The reference indicates the vulnerability entry was made public on this date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
17 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published Security Update Guide entries for a broad set of **Chromium** vulnerabilities affecting browser components including **WebRTC, ANGLE, Network, Navigation, Blink, Base, V8, Skia,** and **WebAudio**. The listed issues include multiple `use-after-free` bugs such as `CVE-2026-4445`, `CVE-2026-4454`, `CVE-2026-4449`, and `CVE-2026-4441`, as well as a `heap buffer overflow` in `ANGLE` (`CVE-2026-4448`), a `heap buffer overflow` in `WebAudio` (`CVE-2026-4443`), an `out-of-bounds read` in `Skia` (`CVE-2026-4460`), `insufficient validation of untrusted input` in `Navigation` (`CVE-2026-4451`), and an `inappropriate implementation` flaw in `V8` (`CVE-2026-4461`). The same set of advisories also included non-Chromium entries tied to lower-level platform components: `CVE-2026-4438` for `gethostbyaddr` and `gethostbyaddr_r` returning invalid DNS hostnames, `CVE-2025-71267` for an `ntfs3` infinite loop triggered by a zero-sized `ATTR_LIST`, and `CVE-2026-23233` for an `f2fs` fix to avoid mapping the wrong physical block for a swapfile. Together, the disclosures show Microsoft tracking both browser-engine memory-corruption risks and underlying filesystem and networking defects through its update pipeline.
Jun 29, 2026
Microsoft published security advisories for several **Chromium** vulnerabilities spanning browser components including **WebXR**, **WebRTC**, **V8**, and web apps. The issues are tracked as `CVE-2026-8583` (**insufficient policy enforcement in WebXR**), `CVE-2023-7024` (**heap buffer overflow in WebRTC**), `CVE-2022-1096` (**type confusion in V8**), and `CVE-2021-4052` (**use-after-free in web apps**), indicating exposure across both rendering and scripting-related functionality in Chromium-based environments. The listed flaws cover multiple high-risk bug classes commonly associated with browser compromise, including memory corruption and policy enforcement weaknesses. Microsoft surfaced the vulnerabilities through its Security Update Guide and portal advisories, signaling that organizations using Microsoft products that incorporate Chromium components should review applicable updates and assess browser-related attack surface tied to immersive web features, real-time communications, JavaScript execution, and web application handling.
Jul 12, 2026
Microsoft published security advisories for two Chromium vulnerabilities affecting browser security components: **CVE-2026-5872**, a **use-after-free in Blink**, and **CVE-2026-5899**, an **incorrect security UI issue in History Navigation**. The flaws were listed in Microsoft's Security Update Guide as Chromium-related issues, indicating they affect browser code relied on by Microsoft products built on the Chromium engine. The Blink memory-safety bug could expose users to instability or potential exploitation scenarios typical of use-after-free vulnerabilities, while the History Navigation flaw involves incorrect security indicators that could mislead users about page state or trust signals during navigation. Organizations using Microsoft browsers or platforms that incorporate Chromium components should review the relevant advisories and apply the associated security updates through normal patch management processes.
Jul 12, 2026