Loading story…
OpenAI launched Codex Security in research preview as a system designed to help identify and validate software vulnerabilities, and Google Chrome release notes have since directly credited the project for multiple browser flaws. Public reporting says the credits were limited to entries that explicitly named Codex Security, indicating the tool has moved from preview into externally visible vulnerability discovery work.
Chrome release notes attributed three high-severity issues to Codex Security in 2026: CVE-2026-15903, an out-of-bounds read/write in V8; CVE-2026-76045, a WebGL use-after-free; and CVE-2026-17658, a V8 use-after-free discovered by Duc Nguyen of Calif.io in collaboration with OpenAI Codex Security. The credited findings span two of Chrome's most security-sensitive components, suggesting the project contributed to the discovery of memory-safety bugs that could have exposed users to browser compromise.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Chrome's August 2026 releases credited Duc Nguyen of Calif.io in collaboration with OpenAI Codex Security for CVE-2026-17658, a high-severity use-after-free vulnerability in V8.
Chrome's July 2026 releases directly credited OpenAI Codex Security for CVE-2026-76045, a high-severity use-after-free vulnerability in WebGL.
OpenAI announced Codex Security as being available in research preview. This is the earliest explicitly dated event in the provided references.
Chrome release notes for a July 16 stable update directly credited OpenAI Codex Security for CVE-2026-15903, a high-severity out-of-bounds read/write vulnerability in V8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026
Google disclosed two high-severity Chrome vulnerabilities that could be triggered when a user visits a crafted HTML page, affecting the browser's **WebCodecs** and **V8** components. **`CVE-2026-5292`** is an out-of-bounds read in WebCodecs, tracked as **`CWE-125`**, and impacts Chrome versions prior to **`146.0.7680.178`**. The flaw carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, indicating remote exploitation with user interaction and potentially high impact to confidentiality, integrity, and availability. Google also recorded **`CVE-2026-6363`**, a **type confusion** issue in **V8** tracked as **`CWE-843`**, affecting Chrome versions prior to **`147.0.7727.101`**. Chrome rated the V8 bug with Medium Chromium security severity, but the published **CVSS v3.1** vector likewise reflects potentially high impact if exploited through malicious web content. Both vulnerabilities were documented in Chrome release materials and Chromium issue tracker entries, underscoring the need for organizations to update Chrome promptly to the patched versions.
Jun 29, 2026