Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
A security update for Chromium version 152.0.7977.64 addresses multiple critical vulnerabilities including use-after-free, buffer overflows, type confusion, race conditions, improper input validation, incorrect authorization, information leaks, and memory corruption across various components such as ANGLE, Aura, Chromecast, Views, V8, GPU, and others. These vulnerabilities could allow attackers to cause memory corruption, unauthorized access, or information disclosure. The update was released by the SUSE Product Security Team on 2026-08-25.
This security update for Chromium addresses multiple critical vulnerabilities affecting various components such as Codecs, Blink, V8, GPU, WebRTC, and many others. The issues include out-of-bounds writes, use-after-free errors, type confusion, integer overflows, and insufficient validation of untrusted input, among others. These vulnerabilities span Chromium versions from 150.0.7871.46 through 150.0.7871.186. The update improves stability and security by mitigating these critical memory safety and input validation flaws.
This security update for Chromium addresses multiple critical vulnerabilities including use-after-free bugs, heap buffer overflows, out-of-bounds reads and writes, insufficient validation of untrusted input, race conditions, and incorrect security UI. The vulnerabilities affect various Chromium components such as WebShare, Digital Credentials, WebView, WebRTC, GPU, Extensions, and Passwords. The update fixes issues in Chromium versions 149.0.7827.102, 149.0.7827.114, and 149.0.7827.155. These vulnerabilities could lead to memory corruption and potential security breaches if exploited.
A security update for Chromium addresses multiple critical vulnerabilities including out of bounds reads and writes, use after free, integer overflows, heap buffer overflows, uninitialized use, and insufficient validation of untrusted input in various components. These vulnerabilities could allow attackers to cause memory corruption or execute arbitrary code. The update fixes these issues in Chromium version 148.0.7778.215.
Multiple critical security vulnerabilities affecting Chromium have been addressed in updates culminating in version 146.0.7680.177. These vulnerabilities include use-after-free, heap buffer overflows, integer overflows, out-of-bounds reads and writes, insufficient policy enforcement, and incorrect security UI implementations across various components such as CSS, GPU, WebGL, V8, WebCodecs, Dawn, PDF, WebAudio, and WebRTC. The issues have been fixed in Chromium version 146.0.7680.177.
This security update for Chromium addresses multiple critical vulnerabilities including use-after-free bugs, heap buffer overflows, integer overflows, type confusion, insufficient validation of untrusted input, race conditions, and policy enforcement issues. The vulnerabilities affect various components such as Canvas, iOS, Accessibility, GPU, ANGLE, Skia, Media, WebRTC, V8, PDFium, and Blink. These issues could lead to memory corruption, information leakage, or bypass of security policies. The update covers several Chromium versions including 147.0.7727.55, 147.0.7727.101, 147.0.7727.116, and 147.0.7727.137. The vulnerabilities have been fixed in this update, and no known exploits are reported in the wild.
Multiple security vulnerabilities have been identified and fixed in Chromium versions prior to 144.0.7559.132. These vulnerabilities include heap buffer overflow, type confusion, race conditions, out-of-bounds memory access, use-after-free, and incorrect security UI implementations. The flaws could lead to remote code execution and memory corruption when processing crafted web content. A security update addressing these issues is available.
A security update for Chromium addresses multiple vulnerabilities including integer overflows, heap buffer overflows, use-after-free issues, and inappropriate implementations in various components such as ANGLE, PowerVR, Skia, DevTools, WebAudio, CSS, WebAssembly, V8, WebCodecs, Media, PDFium, and WebGPU. The affected versions range from 145.0.7632.45 through 145.0.7632.159. These vulnerabilities have been assigned CVE identifiers from CVE-2026-2313 to CVE-2026-3545. The update also includes packaging and build improvements. No explicit patch links or vendor advisory details were provided.
This security update for Chromium addresses multiple vulnerabilities across several versions, including issues such as use-after-free, out-of-bounds memory access, type confusion, and insufficient policy enforcement. The vulnerabilities affect components like WebView, WebGPU, V8 JavaScript engine, ANGLE, Password Manager, Toolbar, Google Updater, DevTools, Digital Credentials, Downloads, Loader, Media Stream, WebRTC, and Passwords. One of the issues fixed in version 143.0.7499.109 is known to have an exploit in the wild. The update includes fixes for CVE-2025-13630 and numerous other CVEs, improving overall security posture. No CVSS scores are provided for these vulnerabilities. The affected versions are not explicitly stated in the input data.
The npm package 'secretkey2fa' version 1.0.1, advertised as a lightweight TOTP/HOTP library, contains malicious code executed via a postinstall hook. This code steals Windows credentials by enumerating Credential Manager entries, extracts Microsoft Account tokens from Minecraft launcher files, decrypts Chromium browser cookies and credentials, and exfiltrates this data to a concealed Discord webhook. The malicious payload activates only on real Windows developer environments, avoiding CI and audit contexts. The 2FA functionality is a cover story for this credential-stealing malware.
The npm package '2fa-secretkey' contains malicious code that executes automatically upon installation. It runs a hidden payload on Windows systems that collects sensitive credentials, including Windows Credential Manager secrets, Microsoft refresh tokens, JWT access tokens, Minecraft session IDs, and decrypted Chromium browser cookies and stored credentials. This stolen data is exfiltrated to a hardcoded Discord webhook URL unrelated to the package's advertised functionality. The payload includes environment checks to avoid execution in CI environments or non-Windows systems. Multiple specific versions of the package are affected.
Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.