Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google patched ten Chrome 155 flaws, including critical Prerender use-after-free CVE-2026-110922, with no known exploitation.
68
Product
Chromium
- Mentions · 7d0
- Mentions · 30d11
- All mentions28
- First seenAug 15, 2026
- Last mentioned14d ago
Timeline
28 articles · newest firstGemini 4 Argon: Built to solve your hardest problems
Google released Gemini 4 Argon globally, ranking first on the Vals Index.
96
Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections
Researchers showed IDN lookalike domains can evade Chrome’s Unicode display and near-match phishing warnings.
60
New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Researchers showed Chromium can display Unicode brand lookalike domains as readable text, bypassing Punycode warnings.
58
CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer now bypasses Chromium App-Bound Encryption and adds a remote shell on Windows.
62
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer now bypasses Chromium app-bound encryption, runs remote commands, and exfiltrates data over encrypted TCP.
56
Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer, a Rust malware-as-a-service, harvests tokens and prompts from Claude, Codex, Grok, and Cursor.
78
Chromium Hardening Guide
A Chromium hardening guide covers browser choice, enterprise policies, flag persistence, and safer content-blocking options.
28
Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER
Attackers compromised over 100 sites with fake Cloudflare checks to install Windows infostealer LUNEXSTEALER.
71
LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension
CERT-UA reports LUNEXSTEALER installs LUNARAXE for remote Chromium control after fake Cloudflare prompts.
72
New Infostealer Can Steal Passwords, Cards, Cookies and Wi-Fi Keys From Windows PCs
K7 Labs analyzed a Python infostealer builder that steals Windows browser secrets, cards, cookies, Discord tokens, and Wi-Fi passwords.
48
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
Volexity says China-linked UTA0565 exploited Chrome and Windows zero-days against Asian governments.
88
Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities
Google released Chrome 153 fixing 16 vulnerabilities, including critical use-after-free in Dawn/WebGPU and a WebGL buffer overflow, across Windows, macOS, and Linux.
55
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
85
Re-Engineering YouTube for the Living Room: Bringing "Chrobalt" to RDK
Collabora and Google built the first RDK-based Chrobalt reference platform, re-architecting YouTube's Cobalt web engine on Chromium for smart TVs.
4
Attackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
82
CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36
CVE-2026-87464 is a critical use-after-free in Chrome's WebGL allowing sandbox-escaping RCE via crafted HTML pages, fixed in 153.0.8010.36.
78
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.
80
Four groups caught using the same Chrome and Windows exploit kit
Proofpoint reports at least four hacking groups, some China-linked, share the BlueMoon exploit kit chaining Chromium and Windows kernel vulnerabilities to install malware.
80
4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
85
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
85
Microsoft patches a record 972 vulnerabilities, 112 of them critical
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.
70
CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks
CISA added the actively exploited Chromium V8 type confusion zero-day CVE-2026-85046 to its KEV catalog, urging patching of Chrome, Edge, and Opera.
92
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability with evidence of active exploitation, to its KEV Catalog.
80
CISA KEV: Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 (CVE-2026-85046)
CISA added actively exploited Chromium V8 type confusion CVE-2026-85046 to the KEV catalog, requiring federal mitigation by September 18.
85
iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset
Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.
63
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
55
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Jamf details AmnesiaStealer, a new Rust-based macOS infostealer that hijacks Chromium sessions for live attacker-controlled browser access and steals Keychain data.
58
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
- Critical WebGL Buffer Overflow in Google Chrome for Android
- DOM memory corruption in Chrome before 155.0.8059.84
- Information Leak in Google Chrome Paint Component Prior to 153.0.8010.52
- Out-of-Bounds Read in Google Chrome DataTransfer Prior to 153.0.8010.52
- Cross-Origin Data Leak via Improper State Validation in Google Chrome Skia
- SVG memory corruption in Google Chrome before 155.0.8059.84
Appears with
- Googlevendor · 20
- Chromeproduct · 12
- Microsoftvendor · 11
- Microsoft Edgeproduct · 6
- Windowsproduct · 6
- Googleorganization · 6
- Google Chromeproduct · 6
- Proofpointvendor · 5
- V8product · 4
- UNK_QuietRacketthreat actor · 3
- TA412threat actor · 3
- APT31threat actor · 3
- UNK_DoubleCheckthreat actor · 3
- Telegramproduct · 3
- Firefoxproduct · 3
- CISAorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.