Loading story…
Microsoft added Security Update Guide entries for multiple third-party vulnerabilities, including Chromium flaws CVE-2026-8574 and CVE-2025-13223 and an Adobe Systems Incorporated issue tracked as CVE-2024-20721. The Chromium advisories identify a use-after-free in Core and a type confusion in V8, both bug classes commonly associated with browser instability and potential code-execution risk depending on exploit conditions.
Microsoft also listed CVE-2024-20721 as an improper input validation vulnerability that can cause denial of service in Adobe software. The entries appear in Microsoft's Security Update Guide as vendor-linked advisories, giving defenders a consolidated reference point to track affected third-party components and prioritize patch validation across browsers and Adobe-dependent environments.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft's Security Update Guide publishes CVE-2026-8574, a Chromium use-after-free vulnerability in Core. The advisory was published on 2026-05-16.
Microsoft's Security Update Guide lists CVE-2025-13223, a Chromium type confusion vulnerability in V8. The advisory was published on 2025-11-18.
Microsoft's Security Update Guide lists CVE-2024-20721, an Adobe Systems Incorporated improper input validation denial-of-service vulnerability. The advisory was published on 2024-11-01.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a broad set of Chromium vulnerabilities affecting its browser platform, including `CVE-2026-7344` (use-after-free in Accessibility), `CVE-2026-7341` (use-after-free in WebRTC), `CVE-2026-7353` (heap buffer overflow in Skia), and `CVE-2026-7337` (type confusion in V8). Additional flaws patched include use-after-free bugs in Views, Media, GPU, Cast, and Navigation, along with insufficient validation of untrusted input in Compositing and an inappropriate implementation issue in Tint. The volume and variety of bugs indicate a significant browser security update focused on memory-safety and input-handling weaknesses in Chromium components commonly exposed through web content. Microsoft also listed `CVE-2026-31682`, a separate issue tied to `br_nd_send` and Neighbor Discovery option parsing, but the main body of advisories centers on Chromium-derived fixes that organizations should prioritize across Microsoft Edge deployments to reduce risk from malicious websites and crafted content.
Jul 12, 2026
Microsoft released security guidance for **CVE-2026-23359**, a flaw in `bpf` described as a **stack out-of-bounds write in devmap**, indicating a memory corruption issue in low-level packet processing components. The company also published an advisory for **CVE-2026-5283**, a Chromium vulnerability in **ANGLE** caused by an inappropriate implementation, extending the scope of affected software from kernel-adjacent networking code to browser graphics infrastructure. The advisories were issued through Microsoft's Security Update Guide and identify two distinct vulnerability classes that could affect system and browser security depending on product exposure and patch status. Organizations using Microsoft products that incorporate Linux kernel `bpf` functionality or Chromium-based components should review the relevant updates for **CVE-2026-23359** and **CVE-2026-5283** and prioritize remediation based on asset exposure and dependency on those technologies.
Jul 12, 2026
Microsoft published security advisories for several **Chromium** vulnerabilities spanning browser components including **WebXR**, **WebRTC**, **V8**, and web apps. The issues are tracked as `CVE-2026-8583` (**insufficient policy enforcement in WebXR**), `CVE-2023-7024` (**heap buffer overflow in WebRTC**), `CVE-2022-1096` (**type confusion in V8**), and `CVE-2021-4052` (**use-after-free in web apps**), indicating exposure across both rendering and scripting-related functionality in Chromium-based environments. The listed flaws cover multiple high-risk bug classes commonly associated with browser compromise, including memory corruption and policy enforcement weaknesses. Microsoft surfaced the vulnerabilities through its Security Update Guide and portal advisories, signaling that organizations using Microsoft products that incorporate Chromium components should review applicable updates and assess browser-related attack surface tied to immersive web features, real-time communications, JavaScript execution, and web application handling.
Jul 12, 2026