Loading story…
Microsoft published Security Update Guide entries for two Chromium vulnerabilities affecting different browser components: CVE-2026-9124, which maps to Chromium CVE-2026-9123 and describes a heap buffer overflow in Chromecast, and CVE-2024-5274, a type confusion flaw in the V8 JavaScript engine. The advisories indicate Microsoft is tracking upstream Chromium security issues through its own update guidance for downstream products that rely on Chromium components.
The listed flaws affect memory safety in high-risk areas of the Chromium codebase, with one issue tied to media casting functionality and the other to JavaScript execution. While the entries provide limited public detail, the combination of a heap buffer overflow and a V8 type confusion bug signals potential browser exploitation risk and reinforces the need for organizations to prioritize vendor updates for Microsoft and Chromium-based software as patches become available.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-9124 that maps to Chromium vulnerability CVE-2026-9123, described as a heap buffer overflow in Chromecast. The advisory was published on 2026-05-22.
Microsoft's advisory references Chromium vulnerability CVE-2024-5274, described as a type confusion issue in the V8 engine. The advisory was published on 2024-05-25, indicating public disclosure or vendor tracking by that date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **Chromium** vulnerabilities spanning browser components including **WebXR**, **WebRTC**, **V8**, and web apps. The issues are tracked as `CVE-2026-8583` (**insufficient policy enforcement in WebXR**), `CVE-2023-7024` (**heap buffer overflow in WebRTC**), `CVE-2022-1096` (**type confusion in V8**), and `CVE-2021-4052` (**use-after-free in web apps**), indicating exposure across both rendering and scripting-related functionality in Chromium-based environments. The listed flaws cover multiple high-risk bug classes commonly associated with browser compromise, including memory corruption and policy enforcement weaknesses. Microsoft surfaced the vulnerabilities through its Security Update Guide and portal advisories, signaling that organizations using Microsoft products that incorporate Chromium components should review applicable updates and assess browser-related attack surface tied to immersive web features, real-time communications, JavaScript execution, and web application handling.
Jul 12, 2026
Microsoft published Security Update Guide entries for a broad set of **Chromium** vulnerabilities affecting browser components including **WebRTC, ANGLE, Network, Navigation, Blink, Base, V8, Skia,** and **WebAudio**. The listed issues include multiple `use-after-free` bugs such as `CVE-2026-4445`, `CVE-2026-4454`, `CVE-2026-4449`, and `CVE-2026-4441`, as well as a `heap buffer overflow` in `ANGLE` (`CVE-2026-4448`), a `heap buffer overflow` in `WebAudio` (`CVE-2026-4443`), an `out-of-bounds read` in `Skia` (`CVE-2026-4460`), `insufficient validation of untrusted input` in `Navigation` (`CVE-2026-4451`), and an `inappropriate implementation` flaw in `V8` (`CVE-2026-4461`). The same set of advisories also included non-Chromium entries tied to lower-level platform components: `CVE-2026-4438` for `gethostbyaddr` and `gethostbyaddr_r` returning invalid DNS hostnames, `CVE-2025-71267` for an `ntfs3` infinite loop triggered by a zero-sized `ATTR_LIST`, and `CVE-2026-23233` for an `f2fs` fix to avoid mapping the wrong physical block for a swapfile. Together, the disclosures show Microsoft tracking both browser-engine memory-corruption risks and underlying filesystem and networking defects through its update pipeline.
Jun 29, 2026
Microsoft published Security Update Guide entries for multiple Chromium vulnerabilities affecting browser components including **HID**, **ServiceWorker**, **V8**, and the **File Manager API**. The newly listed issues include `CVE-2026-8515`, a **use-after-free** flaw in HID, and `CVE-2026-9116`, an **insufficient policy enforcement** bug in ServiceWorker, alongside earlier Chromium-tracked issues such as `CVE-2024-4761` (**out-of-bounds write** in V8), `CVE-2022-4262` (**type confusion** in V8), and `CVE-2022-0107` (**use-after-free** in the File Manager API). The advisories indicate continued Microsoft tracking of upstream Chromium security defects that can affect Chromium-based products, with the listed bugs spanning memory-corruption and policy-enforcement weaknesses commonly associated with browser compromise risk. The reference set also includes `CVE-2019-1406`, a separate **Jet Database Engine remote code execution** vulnerability, but the dominant event is Microsoft's publication of several Chromium-related vulnerability records covering browser engine and API attack surfaces.
Jul 12, 2026