Loading story…
Google released a Chrome Stable desktop update to 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux, fixing 18 security issues, including four rated critical. The most serious bugs include two WebGL use-after-free flaws, an out-of-bounds read in Blink InterestGroups, and a use-after-free issue in Autofill, alongside 14 high-severity vulnerabilities affecting components such as GPU, Navigation, DevTools, Web Authentication, Passwords, Bluetooth, and WebView. Public details for some flaws were temporarily restricted until more users receive the update or dependent third-party libraries are patched, and the Canadian Centre for Cyber Security urged organizations to apply the update for versions earlier than the fixed releases.
GitLab also issued security patch releases 19.1.1, 19.0.3, and 18.11.6 for Community Edition and Enterprise Edition, addressing 13 vulnerabilities and urging self-managed customers to upgrade immediately. The most severe issue, CVE-2026-10086, is a high-severity cross-site scripting flaw in the Analytics Dashboard for GitLab EE with a CVSS score of 8.7; other notable issues include CVE-2026-10712, an unauthenticated XSS flaw in the Web IDE workbench asset handler, and CVE-2026-12053, an information disclosure bug in Duo Workflows. GitLab said GitLab.com had already been patched and GitLab Dedicated customers required no action, while warning that included database migrations may cause downtime on single-node deployments unless zero-downtime upgrade procedures are used in multi-node environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Debian published security advisory DSA 6364-1 for Chromium. The advisory announces a Chromium security update for Debian systems in response to vulnerabilities affecting the browser.
On 2026-06-24, the Canadian Centre for Cyber Security published advisory AV26-630 covering vulnerabilities in GitLab CE and EE versions prior to 19.1.1, 19.0.3, and 18.11.6. The notice directed users and administrators to review GitLab's advisory and apply the updates.
On 2026-06-24, GitLab released security patch versions 19.1.1, 19.0.3, and 18.11.6 for Community Edition and Enterprise Edition and urged self-managed customers to upgrade immediately. The patches fixed 13 vulnerabilities, including high-severity issues such as CVE-2026-10086, while GitLab.com had already been patched.
On 2026-06-24, the Canadian Centre for Cyber Security distributed advisory AV26-626 about Google's Chrome vulnerabilities. The notice urged users and administrators to review Google's advisory and apply the necessary updates.
On 2026-06-23, Google announced a Chrome Stable channel update for Desktop to version 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux. The release included 18 security fixes, including four critical vulnerabilities, with rollout planned over the coming days and weeks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecybersecuritynews.com
Open sourcelists.debian.org
Open sourcehkcert.org
Open sourcedocs.gitlab.com
Open sourcedocs.gitlab.com
Open sourceabout.gitlab.com
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **18.10.3**, **18.9.5**, and **18.8.9** to address multiple vulnerabilities tracked as `CVE-2026-5173`, `CVE-2026-1092`, `CVE-2025-12664`, and `CVE-2026-1101`. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API. The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said **GitLab.com** had already been patched, **GitLab Dedicated** customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
Jul 24, 2026
GitLab released patched Community Edition and Enterprise Edition versions **17.0.1**, **16.11.3**, and **16.10.6** to fix multiple security vulnerabilities and bug issues, and urged self-managed customers to upgrade immediately. The most severe issue was a high-severity cross-site scripting flaw in the Web IDE that could enable **one-click account takeover**, alongside additional medium-severity weaknesses affecting denial of service, CSRF protections, authorization controls, and information disclosure. The release is associated with several tracked vulnerabilities, including **`CVE-2024-5258`**, **`CVE-2023-7045`**, **`CVE-2024-4835`**, and **`CVE-2024-2874`**. GitLab said **GitLab.com** was already running the patched version when the advisory was published, and the notice also referenced mitigations related to a **PDF.js** vulnerability and an update for **Mattermost** as part of the broader security response.
Jul 24, 2026
GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.
Jul 9, 2026