Anthropic says Claude built critical exploit chains in Chrome, Safari and Android
Google assigned 62 critical or high Chrome CVEs, patched as of Chrome 156; Apple and Google say the Safari and Android issues are fixed.
Stories per day · 30 days
3 RSS
Relatedchrome3claude2android1bigsleep1chromium1coordinated-disclosure1crashpad1fuzzilli1fuzzing1google1gpt-5.6-sol1javascript1patch1prerender1project-zero1safari1sandbox-escape1use-after-free1
44 stories, newest first · one card per story
Stories tagged #v8
Project Zero: BigSleep beat Fuzzilli on V8 bugs, overlap partial
In six months BigSleep reported 45 V8 vulnerabilities to Fuzzilli's 37, and experiments put theoretical overlap near 60%.
Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google patched ten Chrome 155 flaws, including critical Prerender use-after-free CVE-2026-110922, with no known exploitation.
Security researchers spent 6 days doing their Chromework, built 1B user exploit
Xbow chained three Chrome zero-days with GPT-5.6 Sol into a Windows sandbox escape affecting about one billion users.
Update Chrome and ChromeOS to fix critical security issues
Google patched Chrome and ChromeOS, including critical sandbox-escape use-after-free bugs.
A Mere Mortal's Introduction to JIT Vulnerabilities in JavaScript Engines
TrustFoundry's guide explains JIT compiler bugs in JavaScript engines, using V8, D8, and a CTF example.
6
Google Releases Chrome Update With 32 Security Fixes for Windows, Mac and Linux
Google shipped Chrome 154 fixes for 32 flaws, including critical ANGLE bug CVE-2026-102331.
Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug
Google Chrome 154 patches 32 flaws including critical ANGLE buffer overflow CVE-2026-102331 and multiple V8 type-confusion bugs; no active exploitation reported.
Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
3
OpenAI Codex Sandbox Flaws Let Malicious Repositories Execute Commands on Host Systems
Two OpenAI Codex sandbox flaws, Overpatch and Heapjack, let malicious repositories execute unsandboxed commands on developer hosts; both are patched.
2
Researchers escape OpenAI Codex sandbox to run commands on host
Researchers found two OpenAI Codex sandbox escapes, including Heapjack, enabling unsandboxed command execution on developer machines; OpenAI fixed both within eight days.
8
Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws
Google released Chrome 153 fixing 16 flaws, including critical use-after-free in Dawn (CVE-2026-93374) and buffer overflow in WebGL (CVE-2026-93372).
Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities
Google released Chrome 153 fixing 16 vulnerabilities, including critical use-after-free in Dawn/WebGPU and a WebGL buffer overflow, across Windows, macOS, and Linux.
Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire
Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Attackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
Update Chrome now to protect against an actively exploited vulnerability
Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.
2
Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.
Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)
Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.
4
Google fixes the seventh actively exploited Chrome zero-day of 2026
Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.