Loading story…
Microsoft's Security Update Guide published entries for several third-party and upstream vulnerabilities affecting components used across its ecosystem, including Chromium, Git, and wolfSSH. The listed issues include CVE-2026-0628, an insufficient policy enforcement flaw in the Chromium WebView tag; CVE-2022-4135, a heap buffer overflow in Chromium's GPU component; and CVE-2025-13631, described as an inappropriate implementation issue in Google Updater.
The guide also added CVE-2025-46334, identified as a Git Malicious Shell Vulnerability, and CVE-2025-10966, which describes missing SFTP host verification with wolfSSH. Together, the entries highlight Microsoft tracking a mix of browser, developer tooling, and secure file transfer weaknesses that could affect enterprise environments through embedded or bundled software dependencies.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-0628, described as insufficient policy enforcement in the Chromium WebView tag.
Microsoft's Security Update Guide lists CVE-2025-46334 as a Git malicious shell vulnerability. No further synopsis is provided in the reference.
Microsoft published a Security Update Guide entry for CVE-2025-10966, described as missing SFTP host verification with wolfSSH.
Microsoft published a Security Update Guide entry for CVE-2025-13631, described as an inappropriate implementation issue in Google Updater within Chromium-related software.
Microsoft's Security Update Guide lists CVE-2022-4135, a Chromium heap buffer overflow in GPU. The advisory publication marks the disclosed event in the provided references.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published Security Update Guide entries for multiple Chromium vulnerabilities affecting browser components including **HID**, **ServiceWorker**, **V8**, and the **File Manager API**. The newly listed issues include `CVE-2026-8515`, a **use-after-free** flaw in HID, and `CVE-2026-9116`, an **insufficient policy enforcement** bug in ServiceWorker, alongside earlier Chromium-tracked issues such as `CVE-2024-4761` (**out-of-bounds write** in V8), `CVE-2022-4262` (**type confusion** in V8), and `CVE-2022-0107` (**use-after-free** in the File Manager API). The advisories indicate continued Microsoft tracking of upstream Chromium security defects that can affect Chromium-based products, with the listed bugs spanning memory-corruption and policy-enforcement weaknesses commonly associated with browser compromise risk. The reference set also includes `CVE-2019-1406`, a separate **Jet Database Engine remote code execution** vulnerability, but the dominant event is Microsoft's publication of several Chromium-related vulnerability records covering browser engine and API attack surfaces.
Jul 12, 2026
Microsoft added Security Update Guide entries for multiple third-party vulnerabilities, including **Chromium** flaws `CVE-2026-8574` and `CVE-2025-13223` and an **Adobe Systems Incorporated** issue tracked as `CVE-2024-20721`. The Chromium advisories identify a **use-after-free in Core** and a **type confusion in V8**, both bug classes commonly associated with browser instability and potential code-execution risk depending on exploit conditions. Microsoft also listed `CVE-2024-20721` as an **improper input validation** vulnerability that can cause **denial of service** in Adobe software. The entries appear in Microsoft's Security Update Guide as vendor-linked advisories, giving defenders a consolidated reference point to track affected third-party components and prioritize patch validation across browsers and Adobe-dependent environments.
Jul 12, 2026
Microsoft published Security Update Guide entries for a broad set of **Chromium** vulnerabilities affecting browser components including **WebRTC, ANGLE, Network, Navigation, Blink, Base, V8, Skia,** and **WebAudio**. The listed issues include multiple `use-after-free` bugs such as `CVE-2026-4445`, `CVE-2026-4454`, `CVE-2026-4449`, and `CVE-2026-4441`, as well as a `heap buffer overflow` in `ANGLE` (`CVE-2026-4448`), a `heap buffer overflow` in `WebAudio` (`CVE-2026-4443`), an `out-of-bounds read` in `Skia` (`CVE-2026-4460`), `insufficient validation of untrusted input` in `Navigation` (`CVE-2026-4451`), and an `inappropriate implementation` flaw in `V8` (`CVE-2026-4461`). The same set of advisories also included non-Chromium entries tied to lower-level platform components: `CVE-2026-4438` for `gethostbyaddr` and `gethostbyaddr_r` returning invalid DNS hostnames, `CVE-2025-71267` for an `ntfs3` infinite loop triggered by a zero-sized `ATTR_LIST`, and `CVE-2026-23233` for an `f2fs` fix to avoid mapping the wrong physical block for a swapfile. Together, the disclosures show Microsoft tracking both browser-engine memory-corruption risks and underlying filesystem and networking defects through its update pipeline.
Jun 29, 2026