35
Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.
58
Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.
55
Is It the Beginning of the End For Use-After
60
Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.
82
60
60
60
60
Update Google Chrome to Patch New Zero
60
47
ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses a Linux kernel crypto subsystem use-after-free (CVE-2026-31719, CVSS 8.8) letting local low-privileged attackers escalate to root.
ZDI advisory ZDI-26-680 covers a use-after-free vulnerability in the Linux kernel crypto subsystem, tracked as CVE-2026-31719 with a CVSS score of 8.8. A local attacker who can already execute low-privileged code can exploit it to escalate privileges on affected installations. The advisory does not report any exploitation in the wild.
45
ZDI-26-700: Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses Linux Kernel QFQ Plus scheduler use-after-free (CVE-2026-22999, CVSS 7.8) enabling local privilege escalation on affected systems.
ZDI advisory ZDI-26-700 covers a use-after-free in the Linux Kernel QFQ Plus scheduler, tracked as CVE-2026-22999 with a CVSS score of 7.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to escalate privileges. No in-the-wild exploitation is mentioned.
30
ZDI-26-683: Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-72463, a CVSS 7.5 use-after-free in the Linux Kernel IPv6 VTI subsystem enabling privilege escalation.
ZDI-26-683 covers a use-after-free in the Linux Kernel IPv6 VTI subsystem that allows local attackers to escalate privileges. Exploitation requires first obtaining the ability to execute high-privileged code on the target system, limiting practical impact. ZDI assigned a CVSS rating of 7.5 and CVE-2026-72463.
22
ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability
ZDI discloses Linux Kernel Open vSwitch use-after-free (CVE-2026-80994) letting low-privileged local attackers disclose sensitive kernel information, CVSS 6.4.
ZDI-26-687 covers a use-after-free information disclosure vulnerability in the Linux Kernel's Open vSwitch flow deletion handling, tracked as CVE-2026-80994 with a CVSS rating of 6.4. Exploitation requires the ability to execute low-privileged code on the target system. The flaw allows local attackers to disclose sensitive information from affected installations.
25
ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-23413, a use-after-free in the Linux kernel net scheduler clsact qdisc allowing local privilege escalation, CVSS 8.2.
ZDI advisory ZDI-26-694 describes a use-after-free vulnerability in the Linux kernel's net scheduler clsact qdisc component. Successful exploitation allows local attackers to escalate privileges on affected installations, and ZDI assigned a CVSS score of 8.2. The flaw is tracked as CVE-2026-23413. The advisory notes an attacker must first obtain the ability to execute high-privileged code on the target system to exploit the vulnerability.
35
ZDI-26-675: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed a CVSS 7.8 use-after-free remote code execution flaw (CVE-2026-81976) in Adobe Acrobat Reader DC triggered via malicious PDFs.
The Zero Day Initiative published advisory ZDI-26-675 describing a use-after-free remote code execution vulnerability in Adobe Acrobat Reader DC, tracked as CVE-2026-81976 with a CVSS 7.8 score. The flaw resides in the annotation feature. Exploitation requires user interaction: the target must visit a malicious page or open a malicious file. The advisory reports no evidence of in-the-wild exploitation.
40
ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability
ZDI-26-623 details a use-after-free in Linux kernel IPv6 multicast routing enabling local privilege escalation, rated CVSS 8.8.
The Zero Day Initiative published ZDI-26-623 describing a use-after-free vulnerability in the Linux kernel's IPv6 multicast routing implementation. A local attacker who can execute low-privileged code on an affected installation can exploit the flaw to escalate privileges. ZDI assigned a CVSS rating of 8.8; the advisory does not name a CVE id or state that exploitation has been observed.
42
ZDI-26-597: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57252, CVSS 7.8) allowing remote code execution via malicious AcroForm content.
ZDI-26-597 describes a use-after-free vulnerability in the AcroForm feature of Foxit PDF Reader, tracked as CVE-2026-57252 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
30
ZDI-26-610: Apple Safari JavaScriptCore B3 ReduceStrength Phase Use-After-Free Remote Code Execution Vulnerability
ZDI details a use-after-free in Apple Safari's JavaScriptCore (CVE-2026-64715) that allows remote code execution after a user visits a malicious page.
The Zero Day Initiative published advisory ZDI-26-610 for a use-after-free in the B3 ReduceStrength phase of Apple Safari's JavaScriptCore. Successful exploitation allows remote attackers to execute arbitrary code, but user interaction is required, such as visiting a malicious page or opening a malicious file. ZDI rates the vulnerability 8.8 on CVSS and assigned CVE-2026-64715. The advisory does not report exploitation in the wild.
30
ZDI-26-604: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader use-after-free flaw (CVE-2026-13126) allows remote code execution when users open malicious files; CVSS 7.8 per ZDI advisory.
ZDI-26-604 describes a use-after-free vulnerability in Foxit PDF Reader's annotation handling, tracked as CVE-2026-13126 and rated CVSS 7.8. Exploitation requires user interaction, with the target visiting a malicious page or opening a malicious file, and allows remote attackers to execute arbitrary code. The advisory was published by the Zero Day Initiative on August 24, 2026.
25
ZDI-26-600: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader annotation use-after-free (CVE-2026-57237, CVSS 3.3) can disclose sensitive information when users open malicious PDFs.
ZDI-26-600 documents a use-after-free in Foxit PDF Reader annotation handling that allows remote information disclosure, tracked as CVE-2026-57237 with CVSS 3.3. Exploitation requires user interaction such as opening a malicious file or visiting a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.
15
ZDI-26-603: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a second annotation use-after-free vulnerability (CVE-2026-13127, CVSS 7.8) allowing remote code execution via malicious files or pages.
ZDI-26-603 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13127 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
30
ZDI-26-609: Linux Kernel Net Scheduler Packet Classifier Use-After-Free Local Privilege Escalation Vulnerability
The Linux kernel net scheduler packet classifier has a use-after-free (CVSS 7.8) allowing local attackers to escalate privileges from low-privileged code.
ZDI-26-609 describes a use-after-free vulnerability in the Linux kernel's network scheduler packet classifier, with a CVSS score of 7.8. An attacker must first be able to execute low-privileged code on the target system before escalating privileges. The advisory text does not list an assigned CVE identifier.
35
ZDI-26-599: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
ZDI published advisory ZDI-26-599 for a use-after-free information disclosure flaw (CVE-2026-57238, CVSS 3.3) in Foxit PDF Reader requiring user interaction.
The Zero Day Initiative released advisory ZDI-26-599 describing a use-after-free vulnerability in Foxit PDF Reader's annotation handling. The flaw allows remote attackers to disclose sensitive information when a target opens a malicious file or visits a malicious page. ZDI rated the issue CVSS 3.3 and assigned CVE-2026-57238.
12
ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability
The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.
ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.
25
ZDI-26-601: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-13129, CVSS 3.3) allowing sensitive information disclosure when a user opens malicious content.
ZDI-26-601 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-13129 with a CVSS score of 3.3. Successful exploitation allows remote attackers to disclose sensitive information, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
15
ZDI-26-598: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader AcroForm use-after-free (CVE-2026-57242, CVSS 7.8) permits remote code execution through malicious PDF files or pages.
ZDI-26-598 details a use-after-free in the AcroForm component of Foxit PDF Reader, tracked as CVE-2026-57242 and rated CVSS 7.8. A remote attacker can execute arbitrary code if the target opens a malicious file or visits a malicious page. The advisory was published by the Zero Day Initiative on August 24, 2026.
25
ZDI-26-602: Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability
ZDI disclosed a use-after-free in Foxit PDF Reader (CVE-2026-13128) enabling remote code execution when a user opens a malicious file.
Zero Day Initiative advisory ZDI-26-602 describes a use-after-free flaw in Foxit PDF Reader's document object handling. Exploitation yields arbitrary code execution but requires the target to open a malicious page or file. ZDI assigned CVSS 7.8 and CVE-2026-13128. The advisory does not report active exploitation.
24
ZDI-26-595: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57254, CVSS 7.8) allowing remote code execution when a user opens a malicious file or page.
ZDI-26-595 describes a use-after-free vulnerability in the annotation feature of Foxit PDF Reader, tracked as CVE-2026-57254 with a CVSS score of 7.8. Successful exploitation allows remote attackers to execute arbitrary code, but requires user interaction such as visiting a malicious page or opening a malicious file. The advisory does not mention any exploitation in the wild.
30
ZDI-26-571: Linux Kernel Net Scheduler Packet Classifier API Use-After-Free Local Privilege Escalation Vulnerability
ZDI disclosed a use-after-free local privilege escalation flaw (CVE-2026-64530) in the Linux Kernel net scheduler packet classifier API.
The Zero Day Initiative published ZDI-26-571 describing a use-after-free in the Linux Kernel net scheduler packet classifier API. Local attackers who can already execute low-privileged code can escalate privileges. ZDI assigned a CVSS score of 8.8 and the identifier CVE-2026-64530.
30
ZDI-26-540: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Information Disclosure Vulnerability
ZDI discloses CVE-2026-65776, a Pwn2Own win32kfull use-after-free in Windows enabling local information disclosure, CVSS 6.5.
ZDI-26-540 describes a use-after-free vulnerability in Microsoft Windows win32kfull, demonstrated at Pwn2Own, that allows local attackers to disclose sensitive information. Exploitation requires the attacker to first execute low-privileged code on the target system. ZDI assigned a CVSS score of 6.5, tracked as CVE-2026-65776.
30
ZDI-26-541: (Pwn2Own) Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses a Pwn2Own Windows win32kfull use-after-free local privilege escalation flaw (CVE-2026-65775, CVSS 8.8) requiring existing low-privileged code execution.
ZDI advisory ZDI-26-541 describes a use-after-free in Microsoft Windows win32kfull that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute low-privileged code on the target system. The flaw carries a CVSS score of 8.8 and is assigned CVE-2026-65775; it was demonstrated at Pwn2Own.
30
ZDI-26-544: Microsoft Windows Deployment Services Use-After-Free Remote Code Execution Vulnerability
ZDI discloses an unauthenticated use-after-free remote code execution flaw in Windows Deployment Services (CVE-2026-62893, CVSS 7.5).
ZDI advisory ZDI-26-544 describes a use-after-free in Microsoft Windows Server Deployment Services that allows network-adjacent attackers to execute arbitrary code without authentication. Only systems with Windows Deployment Services enabled are vulnerable. The flaw carries a CVSS rating of 7.5 and is tracked as CVE-2026-62893.
30
60
Vulnerability Spotlight: Use-after-free vulnerabilities in Foxit Reader could lead to arbitrary code execution
60
60
60
Google Releases Urgent Chrome Update to Patch 2 Actively Exploited 0
60
60