Chrome

Google Fixes 52 Vulnerabilities in Chrome Including Four Critical Issues

Google has released security updates for its Chrome browser that address a total of 52 vulnerabilities. Four of these flaws received the highest severity rating of Critical. The updates were issued on October 27, 2026, for Windows, macOS, and Linux platforms. The critical vulnerabilities include memory corruption in the file system, input validation issues in the file API, problems in the Skia graphics library, and a Use After Free flaw in the Layout component. Specific CVEs patched are CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, and CVE-2026-118344. The remaining 48 vulnerabilities received lower severity ratings but were still addressed in the same release.

Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate

Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.

Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams

Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.

Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues

Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.

Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch

Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.

Microsoft Patches Over 1,400 Vulnerabilities in October 2026 Security Update, Some Already Exploited

Microsoft released its October 2026 Patch Tuesday updates on October 13, 2026, addressing a total of 1,407 CVEs plus one additional advisory. The update covers a wide range of issues including 315 remote code execution flaws, 673 privilege escalation vulnerabilities, and 252 information disclosure problems. Severity ratings show 78 vulnerabilities classified as Critical and 1,329 as Important. Several of the addressed flaws have already been confirmed as exploited in the wild. The release aligns with the regular second Tuesday of the month schedule for coordinated vendor patching. Related security advisories from other vendors were also highlighted in the same reporting cycle.

Privacy-Focused Browser Tool Compresses PDFs Locally Without Uploading Sensitive Documents

A developer created a PDF compression tool that runs entirely inside the browser to protect sensitive personal and professional documents from third-party servers. The solution addresses repeated situations where embassy submissions, financial presentations, contracts, and internal reports exceeded size limits, forcing users to choose between installing desktop software or risking data exposure through online services. The tool reduces scanned and photographic PDFs by 66 to 97 percent depending on quality settings while honestly reporting weaker performance on text-heavy files compared with Ghostscript. It works on both desktop and mobile platforms, including iPhone and Android, requires no installation, and continues functioning offline after the first page load. On mobile devices the application respects memory constraints by limiting images to four megapixels, preserving readability for A4 documents intended for printing. The project originated from a single evening script built around Ghostscript and evolved into a full web application after similar compression needs recurred across multiple devices and locations.

Google Releases Chrome 155 Fixing 247 Vulnerabilities Including Four Critical Use-After-Free Flaws

Google has released Chrome 155 on October 6, 2026, addressing a total of 247 security issues across Windows, macOS, and Linux platforms. The update includes four critical vulnerabilities, all classified as use-after-free flaws that affect Chromecast, Browser, Navigation, and Track components. Fifty-three high-severity issues were also resolved, covering problems in SiteIsolation, Core, Omnibox, FileSystem, ANGLE, WebGL, and multiple other modules. The critical CVEs fixed are CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347. Additional fixes address use-after-free conditions, race conditions, type confusion, and integer overflows in V8, WebRTC, PDF, Media, Parser, Storage, and WebAudio. The new versions are Chrome 155.0.8059.40 for Windows and macOS and 155.0.8059.39 for Linux and macOS.

Top Cybersecurity Stories: SharePoint Exploits Warned by US Authorities, Citrix and WordPress Flaws Lead Weekly Rankings

Security NEXT has published its weekly ranking of the most viewed articles from September 27 to October 3, 2026, highlighting critical vulnerability disclosures and confirmed exploitation cases. US authorities issued warnings about active exploitation of five vulnerabilities affecting SharePoint and WordPress. Citrix NetScaler received multiple vulnerability advisories with two flaws already confirmed as exploited in the wild. Apple released iOS 26.7.1 to address vulnerabilities potentially used in targeted attacks against specific individuals. Other notable incidents include a personal data breach at Times Car car-sharing service and a ransomware attack impacting Keio Electric Railway operations.

Google Releases Chrome Update Fixing 11 Vulnerabilities Including Critical WebGL Flaw

Google has issued an update for its Chrome browser that addresses 11 security vulnerabilities across Windows, macOS, and Linux platforms. The release includes Chrome 154.0.8037.98 and 154.0.8037.97 for Windows and macOS, along with version 154.0.8037.97 for Linux. One vulnerability, CVE-2026-103628, received a Critical rating due to an out-of-bounds memory write in WebGL that was originally reported in August. Nine additional issues rated High severity affect components such as FileSystem, Compositing, Skia, FedCM, SVG, MediaStream, and WebRTC, including a buffer overflow tracked as CVE-2026-103631. The update also resolves a type confusion flaw in the V8 scripting engine and one Medium-severity issue. Google plans a gradual rollout over the coming days and weeks.

Google Releases Chrome Security Update Fixing 32 Vulnerabilities Including One Critical Flaw

Google has issued a security update for its Chrome browser that addresses a total of 32 vulnerabilities across Windows, macOS, and Linux platforms. One vulnerability is rated Critical, while 25 are rated High, one Medium, and five Low. The Critical issue, tracked as CVE-2026-102331, is a buffer overflow in the ANGLE graphics component that was reported externally on August 24. High-severity fixes cover multiple type confusion and buffer overflow problems in the V8 JavaScript engine, use-after-free flaws in Bluetooth, Views, Passwords, FullScreen, and PictureInPicture, plus uninitialized resource handling in GPU and WebGPU. Additional High issues include out-of-bounds writes in GPU, out-of-bounds reads in WebGL, cross-site scripting in WebUI, UI display problems in Omnibox, and permission management weaknesses in Mojo. The update ships as Chrome 154.0.8037.93 and 154.0.8037.92 for Windows and macOS and 154.0.8037.92 for Linux, with gradual rollout over the coming days and weeks.

Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities

Google has published Chrome 154 for Windows, macOS, and Linux, addressing a total of 108 vulnerabilities. Eleven of these issues are rated Critical, covering buffer overflows in ANGLE, out-of-bounds writes in GPU, and multiple Use-After-Free flaws in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL. Twenty-five High-severity issues were also fixed, including authorization problems in extensions, improper UI rendering in SecurityIndicators, and race conditions plus type confusion in the V8 JavaScript engine. Additional Medium and Low severity fixes bring the total to 108 patched flaws across components such as PDFium and WebAudio. The update is being rolled out over the coming days and weeks. Specific CVEs addressed include CVE-2026-95350, CVE-2026-95357, and CVE-2026-95281.

Why HTTP to HTTPS Redirects Fall Short: Risks of Exposed Requests and the Role of HSTS Preload

A simple HTTP to HTTPS redirect satisfies basic audit requirements but leaves the initial request fully exposed in plaintext. The request carries the full path, query parameters, and cookies lacking the Secure flag, allowing observers on open Wi-Fi or compromised routers to read or tamper with traffic before TLS begins. Modern browsers such as Chrome since version 90 attempt HTTPS first, yet legacy clients, explicit http:// links in emails, scripts, and failed HTTPS fallbacks continue to send unprotected requests. HSTS instructs browsers to use HTTPS after the first successful visit, yet the header itself travels over HTTPS and cannot protect the very first connection from a new device or cleared cache. Preloading embeds the rule directly in the browser, eliminating the initial plaintext request entirely, but demands includeSubDomains and a one-year max-age, making the change effectively irreversible for months. The article recommends verifying Secure flags on all cookies, ensuring single-step redirects to the same host, and testing HSTS incrementally before considering preload.

Google Releases Chrome 153 Fixing 230 Vulnerabilities Including Zero-Day Exploit

Google has released Chrome 153 for Windows, macOS, and Linux, addressing a total of 230 security vulnerabilities. The update includes fixes for five critical-severity issues and one confirmed zero-day vulnerability already exploited in the wild. Among the critical flaws are use-after-free bugs in WebGL tracked as CVE-2026-87464 and CVE-2026-87488, an out-of-bounds write CVE-2026-87438, a buffer overflow CVE-2026-87527, and a use-after-free in the Cast component identified as CVE-2026-87628. A medium-severity out-of-bounds write in the V8 JavaScript engine, CVE-2026-87491, was reported on August 6, 2026 and has seen active exploitation. The company is rolling out the patches gradually over the coming days and weeks across all supported platforms.

Top 10 Security Stories: Critical Flaws in PaperCut NG/MF, Chrome, WatchGuard and Others Dominate Week

Security NEXT has published its weekly ranking of the ten most-read articles between August 30 and September 5 2026. The list is led by a critical vulnerability in PaperCut NG/MF that is already being exploited in the wild. Google Chrome received two separate updates addressing 38 vulnerabilities, including two rated Critical and one zero-day. WatchGuard Fireware OS, SonicWall SMA 1000, Cisco IOS XR and Apache Tomcat also received urgent patches for severe flaws. Three real-world incidents made the top ten: a customer-data breach at 01 Bank, a ransomware infection at Hands HD and a suspected cloud leak at Corona. The ranking reflects strong reader interest in both newly disclosed vulnerabilities and confirmed exploitation cases.

CVE-2026-85046 Exploited in Chromium V8 Engine, Affecting Chrome, Edge and Other Browsers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw resides in the V8 JavaScript engine of Chromium and stems from a type confusion issue that can allow arbitrary code execution inside the sandbox when a crafted HTML page is processed. Google released a patch for Chrome on September 3, 2026, while the vulnerability carries a CVSS v3.1 base score of 8.8 and is rated High severity. Because numerous browsers including Microsoft Edge, Opera, and Vivaldi are built on Chromium, they are potentially exposed until their respective vendors issue updates. Security teams are advised to verify that all Chromium-based browsers in their environments have been updated to the latest versions containing the fix.

Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)

Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw is a type confusion issue within the Maglev compiler, specifically tied to optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Attackers can exploit the vulnerability by tricking victims into visiting a specially crafted HTML page, enabling remote code execution within the browser sandbox. The update brings Chrome to version 152.0.7977.82 or higher on Windows, macOS, and Linux, while also addressing a total of 12 vulnerabilities. The issue was reported by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi will require corresponding updates from their vendors.

Google Chrome Patches 12 Vulnerabilities Including Actively Exploited V8 Zero-Day

Google has released security updates for Chrome addressing 12 vulnerabilities across Windows, macOS, and Linux platforms. The updates include versions 152.0.7977.83 and 152.0.7977.82 for Windows and macOS, and 152.0.7977.82 for Linux. No critical-rated flaws were fixed in this batch, but ten issues carry a high severity rating. The most notable is CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine that was reported on August 4 and is already being exploited in the wild. Additional high-severity fixes cover a race condition in V8 (CVE-2026-85045), a use-after-free in Compositing (CVE-2026-85048), and another type confusion issue (CVE-2026-85051). This marks the second Chrome security update in three days.

HTTPS Lock Icon Present but List of Visited Sites Remains Visible

Even when HTTPS is active and passwords stay protected, DNS queries and the SNI field in TLS handshakes expose the exact domains a user visits over public Wi-Fi. Classic unencrypted DNS over UDP sends domain names in plaintext, allowing anyone on the same network to observe them with simple packet captures. The SNI extension reveals the target hostname before encryption is negotiated, enabling domain-based filtering without decrypting traffic. DNS over HTTPS moves queries inside encrypted channels but shifts visibility to the chosen resolver instead of the local network. Encrypted Client Hello offers partial protection for SNI yet requires support from both browsers and server infrastructure. The practical takeaway is that metadata about services used, timing, and frequency leaks more readily than credentials in modern public networks.

Google Patches Two Critical Memory Corruption Flaws in Chrome WebGL and Dawn Components

Google has issued a security update for Chrome that addresses 15 vulnerabilities, two of which are rated critical. The flaws, tracked as CVE-2026-76034 and CVE-2026-76036, involve buffer overflow conditions that can lead to out-of-bounds memory writes. CVE-2026-76034 affects the WebGL component used for 2D and 3D graphics rendering on web pages, while CVE-2026-76036 impacts Dawn, the Chromium implementation of WebGPU. Both issues were discovered internally and could result in crashes or remote code execution in certain scenarios. Updated versions are now available for Windows, macOS, Linux, and Android, and users are strongly advised to apply the patches immediately.

Google Releases Chrome Security Update Fixing 15 Vulnerabilities Including Two Critical Flaws

Google has issued a security update for its Chrome browser that addresses 15 vulnerabilities, two of which are rated critical. The update covers Windows, macOS, and Linux platforms with specific version numbers released on August 18, 2026. Among the fixes are buffer overflow issues in WebGL and Dawn that were reported by Google since mid-July. Thirteen high-severity vulnerabilities were also resolved, including type confusion and calculation errors in the V8 engine, Use After Free flaws in Browser and WebGL, buffer overflows in ANGLE, and information leaks in Skia. Additional problems fixed involve CORS implementation weaknesses, CredentialProvider link handling, USB race conditions, and uninitialized GPU resources. The patches are being rolled out gradually over the coming days and weeks.

Top Cybersecurity Stories of the Week: WordPress XSS Flaw, Microsoft Patch Tuesday, Cisco Zero-Day and More

Security NEXT has published its weekly ranking of the most viewed articles between August 9 and August 15 2026. The list is dominated by critical vulnerabilities affecting widely deployed platforms including WordPress, Microsoft products, Cisco networking gear and Fortinet FortiOS. A cross-site scripting issue in the WordPress login screen and a remote code execution flaw in WordPress 7.0.4 both received immediate patches. Microsoft released updates addressing more than 400 vulnerabilities, while Cisco disclosed a zero-day denial-of-service flaw in its SSL VPN implementation. Additional high-impact issues were reported in FortiOS, Google Chrome, Zoom and Jenkins, prompting urgent remediation guidance from vendors.

Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts

Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.

Google Chrome Blocks Over 7 Billion Unwanted Notifications Daily on Android

Google reported that its Chrome protection systems blocked more than 7 billion unwanted notifications every day on Android during the first quarter of 2026. Websites increasingly use browser notifications to deliver phishing attempts, fraudulent payment requests, and malware. Chrome applies a multi-layer "Swiss cheese" defense model where several overlapping filters compensate for each other's weaknesses. The browser automatically revokes notification permissions from sites that have not been visited recently or that trigger repeated security warnings, and it can also cancel associated subscriptions. For particularly noisy resources, Chrome enforces a hard limit of 1,000 messages per minute and returns HTTP 429 responses to excess traffic. Google also made permission prompts less intrusive on Android, which reduced background activity and improved battery life. Users can review and manage notification permissions through Safety Hub on both desktop and mobile versions of Chrome.

Google Releases Chrome 151 Fixing 41 Vulnerabilities Including Six Critical Flaws

Google has issued Chrome 151 to address 41 security vulnerabilities, six of which are rated critical and could lead to memory corruption, browser crashes, and remote code execution. The update covers Windows, macOS, and Linux platforms with versions 151.0.7922.108 and 151.0.7922.109. Two use-after-free flaws in the WebGL component, tracked as CVE-2026-19137 and CVE-2026-19170, allow continued memory access after deallocation. Additional critical issues affect the Aura, Skia, Views, and ANGLE components under CVE-2026-19149, CVE-2026-19154, CVE-2026-19172, and CVE-2026-19157. Google has withheld technical details and proof-of-concept code for several flaws to limit exploitation while the rollout completes. Users are advised to check for updates immediately through the browser's About section.

Top 10 Security Stories: WordPress XSS Flaw, PHP Vulnerabilities, and VMware ESX Issues Lead Weekly Roundup

Security NEXT has published its weekly ranking of the most viewed articles for the period from August 2 to August 8, 2026. The list highlights critical vulnerabilities affecting widely used platforms including WordPress, PHP, pgAdmin 4, VMware ESX, and Chrome. Several entries focus on newly released security updates and ongoing exploitation warnings issued by US authorities. The ranking also includes real-world incidents such as credit card skimming by employees and data leaks caused by phishing attacks. This weekly overview reflects the topics that drew the highest attention from the Japanese cybersecurity community during the specified week.

Chrome Adds On-Device Gemini Nano While Ask Gemini Sends Page Content to Google Cloud

Google has introduced an 'AI on device' toggle in Chrome settings that enables local execution of the Gemini Nano model directly on the user's computer. Several gigabytes of Gemini Nano weights are now stored in the browser profile directory and can run on CPU or GPU for tasks such as initial analysis of suspicious pages. Despite the local model being present, the user-facing 'Ask Gemini' feature does not use it and instead routes page content, URLs, and up to ten additional tabs to Google's cloud infrastructure. The company uses two distinct systems under the Gemini name: the cloud-based Ask Gemini / Gemini in Chrome service and the on-device Gemini Nano accessed only through internal APIs or by websites and extensions. When Enhanced Protection is enabled, results from the local Safe Browsing analysis may still be transmitted to Google Safe Browsing servers. The naming and interface choices have created confusion, as users cannot directly invoke the downloaded Gemini Nano model for tasks like summarizing open pages.

One Request, Five Observers: What Websites, Providers, DNS and VPNs Learn When Loading a Page

The article breaks down exactly what each participant in a typical web request can observe when a user visits a page over HTTPS. It examines the roles of the browser, DNS resolver, ISP, VPN service and the destination site itself, showing that each sees different pieces of metadata or content. HTTPS protects the page body and parameters from network observers, while Encrypted Client Hello and secure DNS further limit visibility of domain names. VPNs replace the user's home IP address with the VPN exit node but introduce a new trusted party that sees all traffic metadata. Browser fingerprinting, cookies and account logins often allow sites to re-identify users even after an IP change. The piece stresses that privacy tools must be chosen according to the specific threat model rather than relying on any single mechanism.

Google Releases Chrome Security Update Fixing 41 Vulnerabilities Including Six Critical Flaws

Google has issued a major security update for its Chrome browser addressing 41 vulnerabilities, six of which are rated Critical. The update covers Windows, macOS, and Linux platforms with new builds 151.0.7922.109 and 151.0.7922.108. Among the critical issues resolved is an out-of-bounds write vulnerability in ANGLE tracked as CVE-2026-19157. Five additional Critical Use After Free flaws were patched in WebGL, Aura, Skia, and Views components. The remaining 35 vulnerabilities received a High severity rating. Google plans a gradual rollout of the update over the coming days and weeks.

Weekly Roundup: Critical Vulnerabilities Hit VMware ESX, FortiOS, Chrome, fastjson, Cisco FMC and Ruby on Rails

Security NEXT published its list of the ten most-read articles for the week of July 26 to August 1, 2026. The ranking is dominated by high-severity vulnerabilities affecting widely deployed enterprise platforms. VMware released fixes for serious flaws in ESX and vCenter, while Fortinet confirmed active exploitation of vulnerabilities in FortiOS and VeloCloud Orchestrator. Google patched 370 security issues in Chrome, and a data-conversion library fastjson was found vulnerable with observed attacks. Apple shipped iOS 26.6 and iPadOS 26.6 containing fixes for 87 vulnerabilities, and Cisco warned that its Firewall Management Center is already being exploited. Additional patches addressed OpenAM, Node.js, and a critical flaw dubbed KindaRails2Shell in Ruby on Rails. The list also includes a breach at an ANA Group e-commerce site that may have exposed customer data.