Loading story…
Microsoft published guidance for CVE-2026-9114, a Chromium vulnerability described as a use-after-free in QUIC, indicating a memory-safety flaw in the browser networking stack that could expose users of Chromium-based software to security risk. The entry appears in Microsoft's Security Update Guide under Chromium-related advisories, reflecting Microsoft's tracking of upstream browser flaws that can affect products built on the Chromium codebase.
The new advisory sits alongside an earlier Microsoft Chromium entry for CVE-2023-5346, a type confusion in V8, the JavaScript engine used by Chromium. Together, the advisories highlight continued security exposure in core Chromium components spanning both network protocol handling and script execution, reinforcing the need for organizations to apply vendor browser and platform updates promptly across affected endpoints.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-9114, describing it as a Chromium use-after-free vulnerability in QUIC.
Microsoft added CVE-2023-5346 to its Security Update Guide, identifying it as a Chromium Type Confusion vulnerability in V8.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft added **CVE-2026-9120** to its Security Update Guide as a **Chromium** flaw caused by a **use-after-free in WebRTC**, extending a pattern of browser-component memory-safety issues that have repeatedly affected Microsoft products built on Chromium. Related Microsoft advisories previously tracked similar upstream Chromium bugs including **CVE-2022-2294** (**heap buffer overflow in WebRTC**), **CVE-2022-2008** (**out-of-bounds memory access in WebGL**), **CVE-2021-4066** (**integer underflow in ANGLE**), and **CVE-2025-5419** (**out-of-bounds read/write in V8**). The broader set of Microsoft Security Update Guide entries also shows the company continuing to catalog third-party and legacy-component vulnerabilities that can lead to severe impact, including **OpenSSL CVE-2022-3602** affecting X.509 certificate verification and older **Jet Database Engine remote code execution** flaws such as **CVE-2019-0577**, **CVE-2019-0579**, and **CVE-2020-0995**. Together, the advisories highlight Microsoft's ongoing publication of high-risk memory-corruption and code-execution issues across browser, cryptographic, and database components that defenders should track for patching and exposure assessment.
Jul 12, 2026
Microsoft published Security Update Guide entries for two Chromium vulnerabilities affecting different browser components: `CVE-2026-9124`, which maps to Chromium `CVE-2026-9123` and describes a heap buffer overflow in **Chromecast**, and `CVE-2024-5274`, a **type confusion** flaw in the **V8** JavaScript engine. The advisories indicate Microsoft is tracking upstream Chromium security issues through its own update guidance for downstream products that rely on Chromium components. The listed flaws affect memory safety in high-risk areas of the Chromium codebase, with one issue tied to media casting functionality and the other to JavaScript execution. While the entries provide limited public detail, the combination of a heap buffer overflow and a V8 type confusion bug signals potential browser exploitation risk and reinforces the need for organizations to prioritize vendor updates for Microsoft and Chromium-based software as patches become available.
Jul 12, 2026
Microsoft published Security Update Guide entries for a broad set of **Chromium** vulnerabilities affecting browser components including **WebRTC, ANGLE, Network, Navigation, Blink, Base, V8, Skia,** and **WebAudio**. The listed issues include multiple `use-after-free` bugs such as `CVE-2026-4445`, `CVE-2026-4454`, `CVE-2026-4449`, and `CVE-2026-4441`, as well as a `heap buffer overflow` in `ANGLE` (`CVE-2026-4448`), a `heap buffer overflow` in `WebAudio` (`CVE-2026-4443`), an `out-of-bounds read` in `Skia` (`CVE-2026-4460`), `insufficient validation of untrusted input` in `Navigation` (`CVE-2026-4451`), and an `inappropriate implementation` flaw in `V8` (`CVE-2026-4461`). The same set of advisories also included non-Chromium entries tied to lower-level platform components: `CVE-2026-4438` for `gethostbyaddr` and `gethostbyaddr_r` returning invalid DNS hostnames, `CVE-2025-71267` for an `ntfs3` infinite loop triggered by a zero-sized `ATTR_LIST`, and `CVE-2026-23233` for an `f2fs` fix to avoid mapping the wrong physical block for a swapfile. Together, the disclosures show Microsoft tracking both browser-engine memory-corruption risks and underlying filesystem and networking defects through its update pipeline.
Jun 29, 2026