35
60
CISA adds Chrome, Redis bugs to Known Exploited Vulnerabilities Catalog
60
50
35
35
35
35
30
30
47
30
30
30
60
60
30
57
30
42
57
47
42
42
60
60
30
30
60
60
50
60
60
60
47
60
60
CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36
CVE-2026-87464 is a critical use-after-free in Chrome's WebGL allowing sandbox-escaping RCE via crafted HTML pages, fixed in 153.0.8010.36.
Google Chrome prior to 153.0.8010.36 contains a use-after-free in WebGL that allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Google rates it as Chromium security severity Critical, though tracker details are restricted. Debian indicates all current Chromium packages are affected, and the flaw likely impacts Chromium-derived browsers. No active exploitation is mentioned in the disclosure.
78
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
Mozilla revoked the Firefox and Thunderbird Linux RPM signing subkey after an unencrypted copy landed in a private repo; no unauthorized access found.
Mozilla revoked the OpenPGP signing subkey (fingerprint 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256) used for Firefox and Thunderbird Linux downloads after an unencrypted copy was committed to one of its private repositories, citing reason code 2, 'key material has been compromised.' Audit records showed no sign of unauthorized access, and a replacement subkey (827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) valid until August 5, 2028 was published. Users who verify signatures manually or install from Mozilla RPM packages may need to import the new key and remove the old one. The rotation came roughly seven months ahead of Mozilla's usual two-year subkey cycle.
45
50