Loading story…
Google released a Chrome Stable Channel update for desktop that includes a security fix for CVE-2025-12443, with the vendor’s release materials directly crediting AISLE Research for reporting the issue. Public reporting indicates the flaw was listed in Chrome’s stable-channel notes alongside its CVE identifier and severity, making the disclosure notable for explicitly naming the external researcher in the upstream advisory.
Additional tracking from Bugflation says the vulnerability surfaced during an AISLE registry reconciliation and was later reflected in Chrome’s published release documentation rather than only in third-party databases. The update ties the fix to Chrome’s desktop stable release, while external references connect the advisory to AISLE’s CVE discovery registry and Bugflation’s public ledger documenting the issue’s disclosure history.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Google's Chrome stable channel update for desktop disclosed and fixed CVE-2025-12443, with the release materials crediting AISLE Research as the reporter and listing the issue's severity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a **Chrome Stable Channel** update for desktop (Chrome **145**) to address multiple security vulnerabilities in versions prior to `145.0.7632.45/46` (Windows/macOS) and `145.0.7632.45` (Linux), and the Canadian Centre for Cyber Security urged organizations to apply the update when available. The most severe issue reported publicly is **CVE-2026-2313**, a **use-after-free in CSS** that could enable **arbitrary code execution**; additional high-severity fixes include **CVE-2026-2314** (heap buffer overflow in *Codecs*) and **CVE-2026-2315** (inappropriate implementation in *WebGPU*), alongside several medium/low-severity issues across components such as Frames, DevTools, Ozone, File input, and Downloads. Separate from the Chrome release, the Canadian Centre for Cyber Security also published multiple vendor advisories covering unrelated vulnerability sets across enterprise infrastructure and software, including **HPE** (ProLiant/Synergy/Alletra/Aruba EdgeConnect/StoreEasy and Intel E810 controller firmware), **Intel** (multiple products), **Fortinet** (FortiOS, FortiClient Windows, FortiAuthenticator, FortiSandbox), **Dell** (SmartFabric Manager), and **IBM** (webMethods Integration, InfoSphere Information Server, Watson Discovery Cartridge, API Connect, OpenPages, and Common Cryptographic Architecture). These notices are general patch advisories and do not describe a single shared incident or exploit campaign tied to the Chrome vulnerabilities.
Jun 29, 2026
Google released an urgent *Chrome for Desktop* Stable Channel update to address **CVE-2026-2441**, a high-severity zero-day that Google said has an exploit **active in the wild**. The issue is a **use-after-free in Chrome’s CSS component**, a memory-corruption flaw that can enable code execution in the browser context when a user visits a malicious or compromised webpage; the vulnerability was reported to Google by researcher **Shaheen Fazim**. The Canadian Centre for Cyber Security echoed the need to patch Chrome, advising organizations to update beyond affected Stable Channel versions (Windows/Mac prior to `145.0.7632.68` and Linux prior to `144.0.7559.67`), while third-party reporting indicated patched Stable builds rolling out to `145.0.7632.75/.76` (Windows/Mac) and `144.0.7559.75` (Linux). Other Canadian Centre advisories published in the same period covered unrelated vendor patches for **Tenable Nessus Agent** (CVE-2026-2026), **Juniper Secure Analytics (JSA)**, **HPE SimpliVity** (Intel firmware advisories), and **PostgreSQL** point releases; these are separate remediation items and not part of the Chrome zero-day event.
Jun 29, 2026
Google released a Stable Channel update for Chrome Desktop, upgrading Windows and Mac to **149.0.7827.114/.115** and Linux to **149.0.7827.114**, to address **28 security vulnerabilities** across components including Core, DigitalCredentials, Accessibility, GPU, WebMIDI, Network, DevTools, Extensions, Video, and Views. The release includes **five critical flaws**, notably multiple use-after-free bugs, a heap buffer overflow in GPU, and insufficient validation of untrusted input in Accessibility; Google said technical details will remain restricted until most users are patched or dependent third-party fixes are available. Published CVE records tied to the release highlight several high-severity issues: **`CVE-2026-12013`**, a Chrome Media use-after-free on Windows that could be triggered through a crafted HTML page; **`CVE-2026-12014`**, a Cast use-after-free that could enable a sandbox escape from the local network segment via malicious network traffic; **`CVE-2026-12016`**, a DevTools flaw that could allow sandbox escape after renderer compromise; and **`CVE-2026-12018`**, a Mojo issue that could lead to OS-level privilege escalation on Windows through a malicious file. The Canadian Centre for Cyber Security urged users and administrators running versions prior to the patched builds to review Google’s advisory and apply updates as they become available.
Jun 29, 2026