Visualização de leitura

U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Google Chromium V8 flaw, tracked as CVE-2026-85046 (CVSS score of 8,8), to its Known Exploited Vulnerabilities (KEV) catalog.

This week, Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046, an actively exploited V8 type confusion flaw.

The bug affects Chrome’s JavaScript and WebAssembly engine and could let a remote attacker execute arbitrary code inside the browser sandbox by using a specially crafted HTML page.

“CVE-2026-85046: Type confusion in V8.” reads the advisory. “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”

As usual, Google did not disclose technical details about the attacks exploiting this vulnerability or attribute them to any specific threat actor.

Security researcher Salvatore Gulizia, known as Serotav, reported the flaw on August 4, 2026, and received a $1,000 bug bounty.

“a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arb r/w on the js heap.” wrote Serotav. “The bug was present in both maglev and turbofan.”

CVE-2026-85046 is the sixth actively exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild:

  • February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS.
  • March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine.
  • April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing.
  • June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine

Google has updated Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, with the rollout happening over the coming days and weeks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by September 18, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Google fixes the sixth actively exploited Chrome zero-day of 2026

Google patched 12 Chrome flaws, including an actively exploited V8 zero-day that could enable remote code execution through a crafted webpage.

Google released a Chrome security update fixing 12 vulnerabilities, including CVE-2026-85046 (CVSS score of 8.8), an actively exploited V8 type confusion flaw.

The bug affects Chrome’s JavaScript and WebAssembly engine and could let a remote attacker execute arbitrary code inside the browser sandbox by using a specially crafted HTML page.

“CVE-2026-85046: Type confusion in V8.” reads the advisory. “Google is aware that an exploit for CVE-2026-85046 exists in the wild.”

As usual, Google did not disclose technical details about the attacks exploiting this vulnerability or attribute them to any specific threat actor.

Security researcher Salvatore Gulizia, known as Serotav, reported the flaw on August 4, 2026, and received a $1,000 bug bounty.

“a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this can be turned into arb r/w on the js heap.” wrote Serotav. “The bug was present in both maglev and turbofan.”

CVE-2026-85046 is the sixth actively exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild:

  • February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS.
  • March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine.
  • April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing.
  • June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine

Google has updated Chrome Stable to version 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, with the rollout happening over the coming days and weeks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Chrome)

Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild

Google has released an emergency Chrome security update that fixes a critical zero-day vulnerability already being exploited in real-world attacks.

The flaw, tracked as CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine used by Chrome to process web content. The company confirmed that it is aware of an exploit for the vulnerability existing in the wild.

While Google did not disclose details about the attacks, affected targets, or the threat actors behind the activity, the active exploitation notice makes immediate patching important for all Chrome desktop users.

The security update moves Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS. Linux users receive version 152.0.7977.82. Google said the update will roll out gradually over the coming days and weeks.

Chrome 0-Day Vulnerability Exploited

CVE-2026-85046 is described as a high-severity type confusion vulnerability in V8. Type confusion bugs occur when software incorrectly treats a piece of data as one type when it is actually another type.

In a browser engine, this kind of memory-handling error can be dangerous. An attacker may be able to create specially crafted JavaScript or web content that causes Chrome to handle memory unexpectedly.

Depending on the exploit chain, this could lead to browser crashes, data exposure, or the execution of attacker-controlled code within the browser process.

A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites.

The vulnerability was reported by security researcher Salvatore Gulizia, also known as Serotav, on August 4, 2026. Google awarded a $1,000 bug bounty for the report.

The Chrome update contains 12 security fixes in total. Several of the patched issues are rated high severity and affect important browser components, including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting.

Among the notable fixes are a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws in Compositing, DevTools, and Skia, and a type confusion issue in Compositing.

Google is restricting access to some vulnerability details until most users have installed the update. This approach is intended to reduce the chance that attackers can quickly reverse-engineer the fixes and build additional exploit code before organizations and individuals patch their browsers.

Chrome users should update immediately by opening the browser menu, selecting Help, and then choosing About Google Chrome. Chrome will check for the latest version and download the update when available.

Users should relaunch the browser after installation to ensure the security fixes are applied. Enterprise administrators should verify that managed endpoints are updated to Chrome 152.0.7977.82 or later.

Security teams should also monitor endpoint telemetry and web-filtering logs for suspicious browser activity, especially phishing campaigns that use newly registered domains or deceptive update prompts.

Because CVE-2026-85046 is actively exploited, delaying the update leaves systems exposed to a known browser attack path.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Google Patches 26 Chrome Vulnerabilities, Including Critical WebGL and Shared Tab Groups Flaws

Google has released a new update for the Chrome Stable Channel on desktop platforms, addressing 26 security vulnerabilities. This includes two critical use-after-free flaws affecting WebGL and Shared Tab Groups. The update upgrades Chrome to version 152.0.7977.75 on Windows and macOS, while Linux users receive version 152.0.7977.76. Google stated that the update will be rolled […]

The post Google Patches 26 Chrome Vulnerabilities, Including Critical WebGL and Shared Tab Groups Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Chrome and Edge Extensions Strip CSP and Inject JavaScript to Drain EVM, Solana and Tron Wallets

Research identified 19 malicious browser extensions 18 for Google Chrome and 1 for Microsoft Edge that use a modular malware framework to strip website Content Security Policy protections, inject attacker-controlled JavaScript. Socket determined that 14 extensions were created by the threat actor, while five were acquired from legitimate developers and subsequently weaponized. The most consequential […]

The post Chrome and Edge Extensions Strip CSP and Inject JavaScript to Drain EVM, Solana and Tron Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Chrome 152 Released With 327 Security Fixes, Including 10 Critical Vulnerabilities

Google has released Chrome 152 for Windows, macOS, and Linux, delivering 327 security fixes and improvements. The update addresses 10 critical vulnerabilities, making it an important security release for individual users and enterprise environments.

Chrome 152 is rolling out as version 152.0.7977.64 for Linux and version 152.0.7977.64/.65 for Windows and macOS. Google said availability will expand to users over the coming days and weeks.

The most serious flaws are memory-safety issues, including several use-after-free vulnerabilities. Such bugs occur when software continues accessing memory after it has been released.

Attackers may be able to exploit these conditions to crash the browser, access sensitive information, or potentially run code in the context of the affected Chrome process.

Chrome 152 Released With 327 Security Fixes

The critical issues affect several Chrome components. CVE-2026-79282 is a use-after-free vulnerability in ANGLE, the graphics translation layer used by Chrome. The flaw was reported by security researcher Goodluck and earned a $25,000 reward.

Other critical vulnerabilities affect Aura, Chrome’s user-interface framework, Chromecast, Views, Safe Browsing, and Mobile components.

Google assigned CVE-2026-79290 and CVE-2026-79052 to use-after-free flaws in Aura. It also fixed CVE-2026-79054 and CVE-2026-79224, both of which are use-after-free issues in Chromecast.

Chrome 152 further patches CVE-2026-79121, an improper input validation vulnerability in Chromecast; CVE-2026-79150, a use-after-free flaw in Views; CVE-2026-78935, an uninitialized-variable issue in Mobile; and CVE-2026-79012, a use-after-free bug in Safe Browsing.

Fixes 10 Critical Vulnerabilities

CVEVulnerability typeAffected component
CVE-2026-79282Use-after-freeANGLE
CVE-2026-79290Use-after-freeAura
CVE-2026-79054Use-after-freeChromecast
CVE-2026-79121Improper input validationChromecast
CVE-2026-79224Use-after-freeChromecast
CVE-2026-79052Use-after-freeAura
CVE-2026-79150Use-after-freeViews
CVE-2026-78935Use of uninitialized variableMobile
CVE-2026-79012Use-after-freeSafe Browsing
CVE-2026-79200Use-after-freeAura

The update also contains a large set of high-severity fixes affecting ANGLE, WebGL, V8, WebRTC, Extensions, Autofill, GPU, Bluetooth, Sandbox, Passwords, and other browser subsystems.

High-severity bugs include buffer overflows, out-of-bounds reads and writes, type-confusion errors, authorization flaws, race conditions, and information leaks.

Several high-severity fixes concern ANGLE, including out-of-bounds writes, buffer overflows, type confusion, use-after-free conditions, and uninitialized resources.

Since ANGLE processes graphics-related content, malicious web pages could potentially use specially crafted graphics or WebGL data to reach vulnerable browser code.

Google has not said that any of the fixed vulnerabilities are being actively exploited in attacks. However, the company is temporarily restricting access to bug details and links until most users have updated.

Google may also retain restrictions when a flaw in a third-party library has not yet been fixed in other dependent projects. Users should update Chrome immediately by opening the browser menu, navigating to Help, selecting About Google Chrome, and relaunching after the update downloads.

Organizations should verify that managed endpoints update to Chrome 152 as it becomes available through their established update channels.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Google Chrome 152 Released With 327 Security Fixes, Including 10 Critical Vulnerabilities appeared first on Cyber Security News.

Google Chrome 152 Patches 327 Security Flaws, Including 10 Critical Vulnerabilities

Google has released Chrome version 152 for Windows, macOS, and Linux, addressing 327 security vulnerabilities, including 10 rated as Critical. This stable-channel update is being rolled out as version 152.0.7977.64 for Linux and 152.0.7977.64/.65 for Windows and macOS. This update is significant due to the sheer number and severity of memory-safety issues fixed across Chrome’s […]

The post Google Chrome 152 Patches 327 Security Flaws, Including 10 Critical Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Chrome 151 Update Fixes 7 Security Flaws Enabling Remote Code Execution and Sandbox Escape

Google has released Chrome version 151 to the Stable channel for desktop platforms, addressing seven security vulnerabilities. Among these vulnerabilities is a critical use-after-free flaw, along with several high-severity issues affecting various components of the browser, including V8, DOM, Workers, networking, and Linux toolkit theming. The update is being rolled out as version 151.0.7922.173/.174 for […]

The post Google Chrome 151 Update Fixes 7 Security Flaws Enabling Remote Code Execution and Sandbox Escape appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Fixes Two Critical Chrome Flaws in WebGL and Dawn — Update Your Browser

Google has released a new Chrome Stable channel update that fixes two critical security vulnerabilities affecting graphics-related components. Users should update their browsers as soon as the release becomes available for their device.

The update moves Chrome to version 151.0.7922.169/.170 on Windows and macOS, while Linux users receive version 151.0.7922.169. Google said the rollout will occur gradually over the coming days and weeks.

The two critical issues are tracked as CVE-2026-76034 and CVE-2026-76036. Both are buffer overflow vulnerabilities, a memory-safety flaw that can occur when software writes more data into a memory area than it was designed to hold.

Such bugs can lead to browser crashes, data corruption, or potentially arbitrary code execution in certain attack scenarios. CVE-2026-76034 affects WebGL, Chrome’s interface for rendering interactive 2D and 3D graphics inside websites.

Online games, visualizations, browser-based design tools, and other graphics-heavy web applications widely use WebGL. A malicious website could potentially attempt to trigger the flaw through specially crafted WebGL content.

The second issue, CVE-2026-76036, is a buffer overflow in Dawn. Dawn is Chromium’s implementation of the WebGPU standard, a newer graphics API intended to provide web applications with more direct and efficient access to graphics hardware.

Because WebGPU and related graphics components process complex data from web content, memory corruption issues in these areas can represent a significant browser security risk.

Google credited its own security team with reporting CVE-2026-76034 on July 15, 2026, and CVE-2026-76036 on July 28, 2026. The company has not publicly disclosed technical details, proof-of-concept code, or exploitation information.

It said access to bug reports may remain restricted until most Chrome users have installed the fixes, reducing the opportunity for attackers to reverse-engineer patches and weaponize the vulnerabilities.

In total, the Chrome 151 Stable release includes 15 security fixes. Google also noted that it uses memory-error detection and fuzzing technologies, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, to identify security bugs during development.

CVE IDSeverityVulnerability typeAffected componentReporterIssue ID
CVE-2026-76034CriticalBuffer overflowWebGLGoogle534923522
CVE-2026-76036CriticalBuffer overflowDawnGoogle540087398
CVE-2026-76033HighInappropriate implementationCORSGoogle516715010
CVE-2026-76037HighLink followingCredentialProviderGoogle517612295
CVE-2026-76044HighRace conditionUSBGoogle522732244
CVE-2026-76039HighIncorrect reference resolutionCoreGoogle525167753
CVE-2026-76040HighUse-after-freeBrowserGoogle534862220
CVE-2026-76035HighInappropriate implementationMediaGoogle536439844
CVE-2026-76042HighUse of uninitialized resourceGPUGoogle536460270
CVE-2026-76046HighBuffer overflowANGLEGoogle536581050
CVE-2026-76043HighIncorrect calculationV8Raghav Maheshwari539350801
CVE-2026-76041HighInformation leakSkiaGoogle540027341
CVE-2026-76047HighType confusionV8ywatanabee541251902
CVE-2026-76038HighType confusionV8un3xploitable && GF541926503
CVE-2026-76045HighUse-after-freeWebGLOpenAI Codex Security (amyb)543082390

Users can update Chrome by opening the browser menu, selecting Help, then About Google Chrome. Chrome will automatically check for the latest available build and prompt users to relaunch once the update has downloaded.

Organizations should ensure managed Windows, macOS, and Linux endpoints receive the new Chrome version through their normal patch-management process.

Security teams should also monitor browser version compliance, particularly on systems that regularly access untrusted websites or use web-based graphics applications.

Google’s published release notes identify the affected builds and confirm that the update contains 15 security fixes, including two critical buffer overflow vulnerabilities in WebGL and Dawn.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Google Fixes Two Critical Chrome Flaws in WebGL and Dawn — Update Your Browser appeared first on Cyber Security News.

Google Chrome Blocks Abusive Notifications Used to Deliver Malware and Scams

Google Chrome has implemented enhanced defenses aimed at disrupting abusive web push notifications that are often used to distribute malware, phishing attempts, fraudulent payment requests, and scam content. This initiative combines browser-based permission controls, backend rate limiting, Safe Browsing intelligence, and behavioural analysis to minimise notification abuse while still allowing legitimate websites to use the […]

The post Google Chrome Blocks Abusive Notifications Used to Deliver Malware and Scams appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Chrome 151 Update Fixes 5 High-Severity Use-After-Free Vulnerabilities

Google has released Chrome version 151.0.7922.137/138 for Windows and macOS, and version 151.0.7922.137 for Linux. This update addresses five high-severity security vulnerabilities, all use-after-free (UAF), that affect various Chrome components, including V8, TabStrip, Extensions, HTML, and Blink. Google Chrome 151 Update The rollout of this Stable channel update began on Tuesday, August 11, 2026. Google […]

The post Google Chrome 151 Update Fixes 5 High-Severity Use-After-Free Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware

A counterfeit installer for the widely used PC-cleaning utility CCleaner is being used to compromise Windows systems and deploy a malicious Chrome extension dubbed GhostDesk. CCleaner’s global popularity, with more than two billion downloads, gives attackers a credible pretext to target users searching for system-maintenance tools. The observed infection chain begins at ccleanerwind[.]top, a website […]

The post Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Chrome 151 Fixes 41 Security Flaws, Including 6 Critical Memory Bugs

Google has released Chrome 151 to the Stable channel, fixing 41 security vulnerabilities, including six critical memory-safety flaws that could enable browser crashes, memory corruption, or malicious code execution.

Chrome 151.0.7922.108/.109 is rolling out for Windows and macOS systems, while Linux users are receiving version 151.0.7922.108.

Google said the release will be delivered to users gradually over the coming days and weeks. Users are advised to update as soon as the new version becomes available.

The most serious bugs patched in this release are use-after-free vulnerabilities. These flaws occur when software continues to access memory after it has been released.

An attacker may exploit such weaknesses by convincing a target to visit a specially crafted website or interact with malicious web content.

Two critical use-after-free issues affect WebGL, Chrome’s technology for rendering interactive 2D and 3D graphics in web pages. They are tracked as CVE-2026-19137 and CVE-2026-19170.

Chrome 151 Vulnerabilities

The first was reported anonymously, while the second was discovered by Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. Other critical flaws include CVE-2026-19149, a use-after-free bug in Aura, Chrome’s user interface framework.

CVE-2026-19154, a use-after-free vulnerability in the Skia graphics library, and CVE-2026-19172, a use-after-free flaw in Views, another Chrome interface component.

Google also resolved CVE-2026-19157, an out-of-bounds write vulnerability in ANGLE, the graphics translation layer used by Chrome. In addition, the update patches 35 high-severity vulnerabilities affecting a broad range of browser components.

These include Chrome’s V8 JavaScript engine, GPU process, HTML renderer, media subsystem, Web Authentication implementation, extensions platform, payment features, translation service, workers, codecs, navigation handling, and crash-reporting functions.

Several of the high-severity bugs are memory-related, including heap buffer overflows, out-of-bounds writes, integer overflows, use of uninitialized memory, and additional use-after-free issues.

Critical Vulnerabilities Patched

CVEAffected Component
CVE-2026-19137WebGL (Use-after-free)
CVE-2026-19149Aura (Use-after-free)
CVE-2026-19154Skia (Use-after-free)
CVE-2026-19157ANGLE (Out-of-bounds write)
CVE-2026-19170WebGL (Use-after-free)
CVE-2026-19172Views (Use-after-free)

Such bugs are especially important because web browsers process untrusted data from websites, advertisements, downloaded files, scripts, and extensions.

Among the externally reported issues, Google awarded $5,000 for CVE-2026-19169, an insufficient validation flaw in Contextual Tasks reported by security researcher Sven Dysthe.

Researchers from OpenAI Codex Security, Hap Security, QED Audit, and other independent contributors were also credited with reporting vulnerabilities that were fixed in this release.

Google has withheld technical details and proof-of-concept information for the vulnerabilities until most users update Chrome, aiming to reduce the risk of attackers exploiting unpatched systems.

Chrome users can update the browser by opening the Chrome menu, selecting Help, and then choosing About Google Chrome. The browser will check for the latest version and prompt the user to relaunch after installation.

Organizations should prioritize deploying Chrome 151 across managed Windows, macOS, and Linux endpoints to reduce exposure to these high-impact browser vulnerabilities.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Google Chrome 151 Fixes 41 Security Flaws, Including 6 Critical Memory Bugs appeared first on Cyber Security News.

❌