Log in
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]
Google has released Chrome 156 to the stable channel for Windows, macOS, and Linux, addressing 353 security vulnerabilities, including six rated critical.
Announced on October 20, 2026, the critical vulnerabilities affect Skia, Accessibility, CSS, Paint, and WebRTC. Google identifies five as memory corruption issues and one as a use-after-free vulnerability.
The announcement lists component names and researcher credits but does not disclose detailed exploitation requirements, attack chains, or technical proof-of-concept material.
Google Chrome Update Fixes 353 Security Vulnerabilities
CVE-2026-113341 involves memory corruption in Skia and was reported internally by Google on October 3. Two Accessibility vulnerabilities also received critical ratings: memory corruption tracked as CVE-2026-113279 and a use-after-free flaw assigned CVE-2026-113271.
Xinyang Ge reported the Accessibility issues, alongside critical memory corruption vulnerabilities in CSS, CVE-2026-113072, and Paint, CVE-2026-113280. The advisory explicitly credits Ge at Anthropic, assisted by Claude, for the Accessibility use-after-free discovery reported on October 8.
The sixth critical issue, CVE-2026-113303, concerns memory corruption in WebRTC. Google credits OpenAI Codex Security, identified as kylebot, with reporting the vulnerability on October 15.
These acknowledgments document AI involvement in vulnerability research without establishing how independently the systems performed their investigations.
The update also resolves high-severity vulnerabilities across SiteIsolation, FileSystem, ANGLE, V8, GPU, Navigation, and other components. Listed weaknesses include memory corruption, use-after-free, improper input validation, and out-of-bounds reads.
Among the rewarded reports, CVE-2026-113101, a SiteIsolation use-after-free vulnerability, earned a $10,000 bounty. Google credited Quyen Son at VinFast for that finding. A FileSystem use-after-free issue, CVE-2026-113097, received $3,000, while several additional reports earned $2,000 or $1,000.
Other AI-credited findings include vulnerabilities affecting V8, Turbolev, Date, ServiceWorker, DisplayLocking, and PDF. However, the advisory does not state that any listed vulnerability has been exploited in the wild. That absence should not be interpreted as confirmation that exploitation is impossible or has never occurred.
Google says access to bug details may remain restricted until most users have installed fixes. Restrictions can also continue when affected third-party libraries are shared with projects that have not yet patched the underlying issue.
The announcement identifies Chrome 156 as the stable release but does not provide platform-specific build numbers. Organizations tracking remediation should distinguish that release designation from a complete installed version identifier.
| CVE | Severity | Component | Vulnerability |
|---|---|---|---|
| CVE-2026-113341 | Critical | Skia | Memory corruption |
| CVE-2026-113279 | Critical | Accessibility | Memory corruption |
| CVE-2026-113072 | Critical | CSS | Memory corruption |
| CVE-2026-113280 | Critical | Paint | Memory corruption |
| CVE-2026-113271 | Critical | Accessibility | Use after free |
| CVE-2026-113303 | Critical | WebRTC | Memory corruption |
| CVE-2026-113101 | High | SiteIsolation | Use after free |
| CVE-2026-113097 | High | FileSystem | Use after free |
| CVE-2026-113098 | High | CacheStorage | Memory corruption |
| CVE-2026-113242 | High | ANGLE | Memory corruption |
| CVE-2026-113058 | High | WebUI | Use after free |
| CVE-2026-113082 | High | ANGLE | Memory corruption |
| CVE-2026-113119 | High | Network | Use after free |
| CVE-2026-113092 | High | Passwords | Use after free |
| CVE-2026-113134 | High | ANGLE | Memory corruption |
| CVE-2026-113339 | High | SVG | Use after free |
| CVE-2026-113317 | High | Accessibility | Memory corruption |
| CVE-2026-113193 | High | V8 | Memory corruption |
| CVE-2026-113117 | High | ANGLE | Improper input validation |
| CVE-2026-113188 | High | GPU | Memory corruption |
| CVE-2026-113104 | High | Frames | Memory corruption |
| CVE-2026-113322 | High | Dawn | Memory corruption |
| CVE-2026-113163 | High | WebGL | Use after free |
| CVE-2026-113253 | High | Canvas | Use after free |
| CVE-2026-113298 | High | Transactions Platform | Use after free |
| CVE-2026-113315 | High | ANGLE | Memory corruption |
| CVE-2026-113236 | High | Navigation | Use after free |
| CVE-2026-113284 | High | XML | Memory corruption |
| CVE-2026-113141 | High | Transactions Platform | Use after free |
| CVE-2026-113316 | High | Views | Improper input validation |
| CVE-2026-113234 | High | ANGLE | Memory corruption |
| CVE-2026-113252 | High | ANGLE | Improper input validation |
| CVE-2026-113305 | High | Privacy | Use after free |
| CVE-2026-113044 | High | V8 | Use after free |
| CVE-2026-113135 | High | PictureInPicture | Memory corruption |
| CVE-2026-113266 | High | ANGLE | Memory corruption |
| CVE-2026-113273 | High | ANGLE | Memory corruption |
| CVE-2026-113293 | High | ANGLE | Use after free |
| CVE-2026-113225 | High | Browser | Memory corruption |
| CVE-2026-113210 | High | ANGLE | Use after free |
| CVE-2026-113285 | High | ANGLE | Memory corruption |
| CVE-2026-113324 | High | GPU | Use after free |
| CVE-2026-113334 | High | ANGLE | Improper input validation |
| CVE-2026-113020 | High | Date | Improper input validation |
| CVE-2026-113222 | High | V8 | Use after free |
| CVE-2026-113318 | High | ServiceWorker | Memory corruption |
| CVE-2026-113310 | High | Bluetooth | Out of bounds read |
| CVE-2026-113338 | High | Turbolev | Use after free |
| CVE-2026-113093 | High | DisplayLocking | Memory corruption |
| CVE-2026-113012 | High | GPU | Improper input validation |
| CVE-2026-113175 | High | FileSystem | Improper input validation |
| CVE-2026-113192 | High | V8 | Memory corruption |
| CVE-2026-113309 | High | Media | Out of bounds read |
| CVE-2026-113295 | High | ANGLE | Out of bounds read |
| CVE-2026-113217 | High | WebAppInstalls | Use after free |
| CVE-2026-113040 | High | Proxy | Improper input validation |
| CVE-2026-113161 | High | WebRTC | Use after free |
| CVE-2026-113154 | High | Canvas | Memory corruption |
| CVE-2026-113336 | High | Compositing | Memory corruption |
| CVE-2026-113181 | High | Navigation | Use after free |
| CVE-2026-113019 | High | Turbolev | Use after free |
| CVE-2026-113095 | High | Focus | Out of bounds read |
| CVE-2026-113160 | High | Turbolev | Use after free |
| CVE-2026-113212 | High | Memory corruption | |
| CVE-2026-113000 | High | Paint | Memory corruption |
| CVE-2026-113179 | High | Paint | Use after free |
| CVE-2026-112993 | High | Input | Use after free |
| CVE-2026-113055 | Medium | FullScreen | Type confusion |
| CVE-2026-113068 | Medium | Input | Use after free |
| CVE-2026-113320 | Medium | Navigation | Memory corruption |
| CVE-2026-113231 | Medium | Extensions | Improper input validation |
| CVE-2026-113174 | Medium | Extensions | Use after free |
| CVE-2026-113022 | Medium | PDFium | Memory corruption |
| CVE-2026-113079 | Medium | SiteIsolation | Use after free |
| CVE-2026-113191 | Medium | Internals | Use after free |
| CVE-2026-113250 | Medium | ANGLE | Use after free |
| CVE-2026-113109 | Medium | API | Memory corruption |
| CVE-2026-113113 | Medium | Extensions | Use after free |
| CVE-2026-113069 | Medium | Compositing | Memory corruption |
| CVE-2026-113006 | Medium | Navigation | Out of bounds read |
| CVE-2026-113263 | Medium | Core | Use after free |
| CVE-2026-113018 | Medium | IME | Memory corruption |
| CVE-2026-113301 | Medium | WebAppInstalls | Memory corruption |
| CVE-2026-113034 | Medium | FileSystem | Memory corruption |
| CVE-2026-113094 | Medium | API | Memory corruption |
| CVE-2026-113240 | Medium | Chromecast | Use after free |
| CVE-2026-113102 | Medium | FileSystem | Out of bounds read |
| CVE-2026-113142 | Medium | Extensions | Memory corruption |
| CVE-2026-113281 | Medium | SiteIsolation | Memory corruption |
| CVE-2026-113035 | Medium | API | Out of bounds read |
| CVE-2026-113211 | Medium | ServiceWorker | Memory corruption |
| CVE-2026-113011 | Medium | CredentialProvider | Use after free |
| CVE-2026-113198 | Medium | Extensions | Use after free |
| CVE-2026-113257 | Medium | Media | Memory corruption |
| CVE-2026-113070 | Medium | GetUserMedia | Out of bounds read |
| CVE-2026-113176 | Medium | Omnibox | Memory corruption |
| CVE-2026-113150 | Medium | Bindings | Memory corruption |
| CVE-2026-113311 | Medium | ServiceWorker | Use after free |
| CVE-2026-113078 | Medium | Compositing | Improper input validation |
| CVE-2026-113033 | Medium | Streaming | Use after free |
| CVE-2026-113026 | Medium | Memory corruption | |
| CVE-2026-113302 | Medium | Extensions | Use after free |
| CVE-2026-113164 | Medium | Voice | Memory corruption |
| CVE-2026-113239 | Medium | SiteIsolation | Range error |
| CVE-2026-113131 | Medium | Bluetooth | Memory corruption |
| CVE-2026-113333 | Medium | Extensions | Memory corruption |
| CVE-2026-113147 | Medium | WebShare | Improper input validation |
| CVE-2026-113337 | Medium | Scroll | Memory corruption |
| CVE-2026-113127 | Medium | Browser | Memory corruption |
| CVE-2026-113129 | Medium | Extensions | Improper access control |
| CVE-2026-113264 | Medium | Extensions | Improper input validation |
| CVE-2026-113105 | Medium | Extensions | Use after free |
| CVE-2026-113220 | Medium | Extensions | Memory corruption |
| CVE-2026-113275 | Medium | API | Use after free |
| CVE-2026-113283 | Medium | CredentialProvider | Memory corruption |
| CVE-2026-113014 | Medium | PerformanceAPIs | Use after free |
| CVE-2026-113108 | Medium | Script | Use after free |
| CVE-2026-113343 | Medium | Sandbox | Memory corruption |
| CVE-2026-113319 | Medium | Accessibility | Use after free |
| CVE-2026-113057 | Medium | ComputePressure | Improper access control |
| CVE-2026-113219 | Medium | Contacts | Memory corruption |
| CVE-2026-113005 | Medium | Bluetooth | Memory corruption |
| CVE-2026-113209 | Medium | Navigation | Memory corruption |
| CVE-2026-113166 | Medium | History | Memory corruption |
| CVE-2026-113051 | Medium | CSS | Memory corruption |
| CVE-2026-113196 | Medium | Mobile | Improper access control |
| CVE-2026-113003 | Medium | HID | Memory corruption |
| CVE-2026-113155 | Medium | Glic | Use after free |
| CVE-2026-113290 | Medium | Input | Use after free |
| CVE-2026-113183 | Medium | FedCM | Memory corruption |
| CVE-2026-113289 | Medium | PerformanceAPIs | Improper input validation |
| CVE-2026-113146 | Medium | PerformanceAPIs | Memory corruption |
| CVE-2026-113207 | Medium | SiteIsolation | Use after free |
| CVE-2026-113205 | Medium | Variations | Use after free |
| CVE-2026-113162 | Medium | Actor | Improper input validation |
| CVE-2026-113118 | Medium | Extensions | Memory corruption |
| CVE-2026-113232 | Medium | Search | Memory corruption |
| CVE-2026-113327 | Medium | Chromecast | Use after free |
| CVE-2026-112999 | Medium | API | Use after free |
| CVE-2026-113249 | Medium | Mobile | Improper input validation |
| CVE-2026-113272 | Medium | Extensions | Memory corruption |
| CVE-2026-113112 | Medium | Extensions | Use after free |
| CVE-2026-113321 | Medium | Extensions | Use after free |
| CVE-2026-113059 | Medium | Sensor | Memory corruption |
| CVE-2026-113137 | Medium | Extensions | Memory corruption |
| CVE-2026-113208 | Medium | ContextualSearch | Use after free |
| CVE-2026-113238 | Medium | CustomTabs | Memory corruption |
| CVE-2026-113194 | Medium | Core | Memory corruption |
| CVE-2026-113189 | Medium | Core | Use after free |
| CVE-2026-113060 | Medium | Bluetooth | Improper input validation |
| CVE-2026-113115 | Medium | Transactions Platform | Use after free |
| CVE-2026-113045 | Medium | Offline | Out of bounds read |
| CVE-2026-113307 | Medium | Extensions | Memory corruption |
| CVE-2026-113009 | Medium | WindowControlsOverlay | Use after free |
| CVE-2026-113071 | Medium | Notifications | Use after free |
| CVE-2026-113278 | Medium | Extensions | Use after free |
| CVE-2026-113190 | Medium | ServiceWorker | Use after free |
| CVE-2026-112992 | Medium | Canvas | Memory corruption |
| CVE-2026-112995 | Medium | Animation | Use after free |
| CVE-2026-113261 | Medium | WebAppInstalls | Use after free |
| CVE-2026-113172 | Medium | ServiceWorker | Memory corruption |
| CVE-2026-113332 | Medium | GPU | Memory corruption |
| CVE-2026-113262 | Medium | Extensions | Use after free |
| CVE-2026-113149 | Medium | FullScreen | Memory corruption |
| CVE-2026-113206 | Medium | Omnibox | Memory corruption |
| CVE-2026-113185 | Medium | Extensions | Memory corruption |
| CVE-2026-113171 | Medium | Prompts | Memory corruption |
| CVE-2026-113042 | Medium | Extensions | Use after free |
| CVE-2026-113276 | Medium | Passwords | Memory corruption |
| CVE-2026-113218 | Medium | DataTransfer | Use after free |
| CVE-2026-113195 | Medium | Downloads | Improper input validation |
| CVE-2026-113328 | Medium | Privacy | Improper input validation |
| CVE-2026-113335 | Medium | Extensions | Memory corruption |
| CVE-2026-113255 | Medium | CustomTabs | Use after free |
| CVE-2026-113076 | Medium | Toolbar | Use after free |
| CVE-2026-113325 | Medium | SignIn | Memory corruption |
| CVE-2026-113084 | Medium | Permissions | Improper input validation |
| CVE-2026-113308 | Medium | Core | Use after free |
| CVE-2026-113224 | Medium | WebAppInstalls | Memory corruption |
| CVE-2026-113148 | Medium | WebUI | Memory corruption |
| CVE-2026-113010 | Medium | Extensions | Out of bounds read |
| CVE-2026-113073 | Medium | Browser | Use after free |
| CVE-2026-113265 | Medium | BFCache | Memory corruption |
| CVE-2026-113329 | Medium | Installer | Out of bounds read |
| CVE-2026-113043 | Medium | iOSWeb | Use after free |
| CVE-2026-113202 | Medium | BrowserTag | Use after free |
| CVE-2026-113016 | Medium | Extensions | Improper input validation |
| CVE-2026-113246 | Medium | iOSWebView | Memory corruption |
| CVE-2026-113041 | Medium | Actor | Use after free |
| CVE-2026-113126 | Medium | PolicyContainer | Memory corruption |
| CVE-2026-113031 | Medium | Media | Memory corruption |
| CVE-2026-113081 | Medium | Compositing | Use after free |
| CVE-2026-113139 | Medium | Autofill | Memory corruption |
| CVE-2026-113128 | Medium | Animation | Missing authorization |
| CVE-2026-113049 | Medium | Core | Memory corruption |
| CVE-2026-113032 | Medium | Omnibox | Memory corruption |
| CVE-2026-113204 | Medium | TrustedWebActivities | Use after free |
| CVE-2026-113144 | Medium | Speech | Memory corruption |
| CVE-2026-113054 | Medium | SiteIsolation | Out of bounds read |
| CVE-2026-113123 | Medium | GPU | Use after free |
| CVE-2026-113277 | Medium | CustomTabs | Out of bounds read |
| CVE-2026-113136 | Medium | DevTools | Memory corruption |
| CVE-2026-113106 | Medium | Skia | Memory corruption |
| CVE-2026-113001 | Medium | Workers | Use after free |
| CVE-2026-113064 | Medium | OptimizationGuide | Memory corruption |
| CVE-2026-113243 | Medium | DOM | Memory corruption |
| CVE-2026-113326 | Medium | Core | Memory corruption |
| CVE-2026-113124 | Medium | DataTransfer | Memory corruption |
| CVE-2026-113230 | Medium | Browser | Improper input validation |
| CVE-2026-113090 | Medium | Interstitials | Memory corruption |
| CVE-2026-113158 | Medium | Streaming | Use after free |
| CVE-2026-113077 | Medium | Core | Memory corruption |
| CVE-2026-113282 | Medium | Views | Use after free |
| CVE-2026-113165 | Medium | Core | Use after free |
| CVE-2026-113178 | Medium | Views | Memory corruption |
| CVE-2026-113110 | Medium | ShadowDOM | Memory corruption |
| CVE-2026-113007 | Medium | Permissions | Memory corruption |
| CVE-2026-113187 | Medium | DOM | Use after free |
| CVE-2026-113075 | Medium | DevTools | Use after free |
| CVE-2026-113259 | Medium | Frames | Use after free |
| CVE-2026-113228 | Medium | Network | Use after free |
| CVE-2026-113099 | Medium | Omnibox | Improper input validation |
| CVE-2026-113216 | Medium | Navigation | Use after free |
| CVE-2026-113270 | Medium | Internals | Use after free |
| CVE-2026-113087 | Medium | Actor | Use after free |
| CVE-2026-113267 | Medium | Video | Memory corruption |
| CVE-2026-113304 | Medium | GPU | Memory corruption |
| CVE-2026-113177 | Medium | FileSystem | Use after free |
| CVE-2026-113151 | Medium | Actor | Out of bounds read |
| CVE-2026-113028 | Medium | Media | Use after free |
| CVE-2026-113120 | Medium | Media | Improper input validation |
| CVE-2026-112997 | Medium | CSS | Memory corruption |
| CVE-2026-113037 | Medium | WebSockets | Use after free |
| CVE-2026-113153 | Medium | SiteIsolation | Memory corruption |
| CVE-2026-113138 | Medium | WebAppInstalls | Memory corruption |
| CVE-2026-113030 | Medium | V8 | Improper access control |
| CVE-2026-113100 | Medium | Audio | Memory corruption |
| CVE-2026-113221 | Medium | Google Lens | Use after free |
| CVE-2026-113344 | Medium | Performance | Use after free |
| CVE-2026-113342 | Medium | Network | Memory corruption |
| CVE-2026-113159 | Medium | DevTools | Improper access control |
| CVE-2026-113233 | Medium | Core | Out of bounds read |
| CVE-2026-113065 | Medium | Media | Use after free |
| CVE-2026-113002 | Medium | Transactions Platform | Memory corruption |
| CVE-2026-113199 | Medium | Payments | Out of bounds read |
| CVE-2026-113197 | Medium | Forms | Use after free |
| CVE-2026-113203 | Medium | CSS | Use after free |
| CVE-2026-113170 | Medium | Autofill | Use after free |
| CVE-2026-113258 | Medium | Chromoting | Memory corruption |
| CVE-2026-113297 | Medium | Ozone | Improper access control |
| CVE-2026-113062 | Medium | API | Improper input validation |
| CVE-2026-113096 | Medium | Text | Memory corruption |
| CVE-2026-113050 | Medium | HID | Out of bounds read |
| CVE-2026-113008 | Medium | Transactions Platform | Memory corruption |
| CVE-2026-113111 | Medium | Compositing | Use after free |
| CVE-2026-113200 | Medium | ANGLE | Use after free |
| CVE-2026-113143 | Medium | ANGLE | Memory corruption |
| CVE-2026-113157 | Medium | ANGLE | Information leak |
| CVE-2026-113235 | Medium | Passwords | Improper input validation |
| CVE-2026-113089 | Medium | PrintPreview | Improper input validation |
| CVE-2026-113340 | Medium | ANGLE | Memory corruption |
| CVE-2026-113052 | Medium | V8 | Memory corruption |
| CVE-2026-113133 | Medium | PlatformIntegration | Memory corruption |
| CVE-2026-113086 | Medium | Input | Improper input validation |
| CVE-2026-113251 | Low | Use after free | |
| CVE-2026-113215 | Low | Extensions | Use after free |
| CVE-2026-113053 | Low | Cookies | Use after free |
| CVE-2026-113312 | Low | Autofill | Memory corruption |
| CVE-2026-113323 | Low | Chrome for iOS | Use after free |
| CVE-2026-113114 | Low | SignIn | Use after free |
| CVE-2026-113015 | Low | Workers | Use after free |
| CVE-2026-113091 | Low | PerformanceAPIs | Use after free |
| CVE-2026-113168 | Low | Permissions | Use after free |
| CVE-2026-113229 | Low | Loader | Use after free |
| CVE-2026-113256 | Low | Permissions | Use after free |
| CVE-2026-113103 | Low | WebProtect | Use after free |
| CVE-2026-113056 | Low | PerformanceAPIs | Memory corruption |
| CVE-2026-113201 | Low | Google Lens | Memory corruption |
| CVE-2026-113027 | Low | WebFonts | Memory corruption |
| CVE-2026-113214 | Low | FullScreen | Improper input validation |
| CVE-2026-113004 | Low | Sync | Memory corruption |
| CVE-2026-113300 | Low | Forms | Out of bounds write |
| CVE-2026-113213 | Low | DevTools | Memory corruption |
| CVE-2026-113167 | Low | Network | Memory corruption |
| CVE-2026-113223 | Low | DevTools | Memory corruption |
| CVE-2026-113291 | Low | FullScreen | Memory corruption |
| CVE-2026-113241 | Low | Toolbar | Memory corruption |
| CVE-2026-113244 | Low | UI | Improper input validation |
| CVE-2026-113048 | Low | DevTools | Memory corruption |
| CVE-2026-113247 | Low | DevTools | Memory corruption |
| CVE-2026-113023 | Low | Extensions | Improper input validation |
| CVE-2026-113330 | Low | CustomTabs | Memory corruption |
| CVE-2026-113226 | Low | Model | Memory corruption |
| CVE-2026-113152 | Low | SignIn | Memory corruption |
| CVE-2026-113029 | Low | ANGLE | Improper access control |
| CVE-2026-113296 | Low | Actor | Memory corruption |
| CVE-2026-113306 | Low | Network | Improper input validation |
| CVE-2026-113245 | Low | DevTools | Memory corruption |
| CVE-2026-113299 | Low | WebProtect | Memory corruption |
| CVE-2026-113024 | Low | WebAppInstalls | Use after free |
| CVE-2026-113025 | Low | Input | Use after free |
| CVE-2026-113080 | Low | WebAppInstalls | Use after free |
| CVE-2026-113186 | Low | DevTools | Memory corruption |
| CVE-2026-113180 | Low | ContentCapture | Memory corruption |
| CVE-2026-113140 | Low | ANGLE | Use after free |
| CVE-2026-113184 | Low | Scheduling | Memory corruption |
| CVE-2026-113017 | Low | Views | Use after free |
| CVE-2026-112998 | Low | Views | Memory corruption |
| CVE-2026-113021 | Low | WebAppInstalls | Use after free |
| CVE-2026-113145 | Low | Messages | Memory corruption |
| CVE-2026-113292 | Low | Omnibox | Improper input validation |
| CVE-2026-113156 | Low | Messages | Use after free |
| CVE-2026-113116 | Low | DevTools | Use after free |
| CVE-2026-113047 | Low | BrowserTag | Memory corruption |
| CVE-2026-113173 | Low | UI | Improper input validation |
| CVE-2026-113260 | Low | Core | Memory corruption |
| CVE-2026-113269 | Low | BrowserTag | Memory corruption |
| CVE-2026-113036 | Low | HTML | Memory corruption |
| CVE-2026-113268 | Low | Navigation | Memory corruption |
| CVE-2026-113038 | Low | DevTools | Memory corruption |
| CVE-2026-113313 | Low | DevTools | Memory corruption |
| CVE-2026-113061 | Low | Chromoting | Memory corruption |
| CVE-2026-113248 | Low | FileSystem | Memory corruption |
| CVE-2026-113288 | Low | Core | Memory corruption |
| CVE-2026-113085 | Low | Media | Use after free |
| CVE-2026-113107 | Low | Media | Use after free |
| CVE-2026-113066 | Low | Fonts | Memory corruption |
| CVE-2026-113121 | Low | ContextMenu | Memory corruption |
| CVE-2026-113287 | Low | Prompts | Use after free |
| CVE-2026-113132 | Low | DevTools | Memory corruption |
| CVE-2026-113169 | Low | WebAppInstalls | Memory corruption |
| CVE-2026-113254 | Low | DevTools | Memory corruption |
| CVE-2026-113063 | Low | Chromoting | Improper input validation |
| CVE-2026-112994 | Low | Browser | Memory corruption |
| CVE-2026-113314 | Low | Media | Use after free |
| CVE-2026-113237 | Low | Chromoting | Memory corruption |
| CVE-2026-113331 | Low | Controls | Memory corruption |
| CVE-2026-113182 | Low | Passwords | Memory corruption |
| CVE-2026-113046 | Low | Passwords | Improper input validation |
| CVE-2026-113067 | Low | Chromoting | Use after free |
| CVE-2026-113074 | Low | Media | Use after free |
| CVE-2026-113130 | Low | Actor | Use after free |
| CVE-2026-113294 | Low | Loader | Improper input validation |
| CVE-2026-112996 | Low | Loader | Memory corruption |
| CVE-2026-113122 | Low | Loader | Memory corruption |
| CVE-2026-113227 | Low | Editing | Use after free |
| CVE-2026-113286 | Low | Google Lens | Memory corruption |
| CVE-2026-113083 | Low | Actor | Memory corruption |
| CVE-2026-113088 | Low | Mobile | Memory corruption |
| CVE-2026-113013 | Low | DevTools | Memory corruption |
| CVE-2026-113125 | Low | DevTools | Memory corruption |
| CVE-2026-113039 | Low | Bookmarks | Use after free |
| CVE-2026-113274 | Low | ReadingMode | Use after free |
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
The post Google Chrome Update Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws appeared first on Cyber Security News.
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks' PAN-OS, with Unit 42 investigating attacks since early June across numerous industries, such as finance, healthcare, and manufacturing.
CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection.
The security vendor first disclosed and patched the bug on May 13 and initially assigned it a medium-severity rating, saying it was aware of attempts to exploit it but had not observed any malicious exploitation.
That assessment quickly changed, and by the end of the month, Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17.
On Monday, Palo Alto Networks’ consulting and incident response biz, Unit 42, said ransomware crews including Qilin and Inc continue to batter the CVE.
“Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” said Andy Piazza, a senior director of threat intelligence at Unit 42.
After gaining initial access, the criminals move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned.
In its ongoing investigations, Unit 42 has spotted the ransomware criminals infecting “numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail."
Palo Alto Networks did not respond to The Register’s inquiries about the attacks, including how many organizations have been infected.
Additionally, ReliaQuest intel analysts warned that “multiple threat groups,” including Settra ransomware operators, are also exploiting the bug to gain initial access to corporate networks via unauthorized VPN sessions.
“The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer,” Piazza wrote. “In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK).”
This allows the miscreants to bypass in-guest endpoint detection and response products, and represents “a highly sophisticated method” of stealing domain-wide credentials, he added.
Unit 42 has also spotted criminals chaining this exploit for initial access with other vulnerabilities such as CVE-2023-27532, which targets Veeam backup infrastructure.
So if you haven’t already patched vulnerable PAN-OS software, do so now - and investigate whether attackers have already gained access to your network. Check Unit 42’s indicators of compromise to assist with threat-hunting activities.®
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]
Next Page of Stories