pwned.coffeeUpdated 37 min ago

The menu

Chrome

Major outage

1 live incident affecting Chrome, 1 critical, 1 not fully patched.

Today's specials

  1. criticalpartial fix ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and… fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0CVE-2026-616045 sources

11 spills in 12 months for Chrome

Week of 17 Nov 2025: 1 newWeek of 8 Dec 2025: 1 newWeek of 16 Feb 2026: 1 newWeek of 9 Mar 2026: 2 newWeek of 30 Mar 2026: 1 newWeek of 8 Jun 2026: 1 newWeek of 31 Aug 2026: 1 newWeek of 7 Sept 2026: 1 newWeek of 21 Sept 2026: 1 newWeek of 5 Oct 2026: 1 new
Worst week: 9 Mar 2026, 2 new spills.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium flowise (npm), flowise-components (npm) Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the `vm2/@flowiseai/nodevm` JavaScript sandbox. An authenticated user with access to the `/api/v1/node-custom-function` endpoint can escape the sandbox by supplying attacker-controlled executablePath and args parameters to puppeteer.launch(), which… fixed in flowise 3.1.3 +1CVE-2026-734834 sources
  2. highpatchedexploited Google Chromium V8 Out of Bounds Write Vulnerability Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-09-09 (federal deadline 2026-09-23). CVE-2026-874912 sources
  3. highpatchedexploited Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-09-04 (federal deadline 2026-09-18). CVE-2026-850462 sources
  4. highpatchedexploited Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-06-09 (federal deadline 2026-06-23). CVE-2026-116453 sources
  5. highpatchedexploited Google Dawn Use-After-Free Vulnerability Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-04-01 (federal deadline 2026-04-15). CVE-2026-52811 source
  6. highpatchedexploited Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-03-13 (federal deadline 2026-03-27). CVE-2026-39102 sources
  7. highpatchedexploited Google Skia Out-of-Bounds Write Vulnerability Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2026-03-13 (federal deadline 2026-03-27). CVE-2026-39091 source
  8. highpatchedexploited Google Chromium CSS Use-After-Free Vulnerability Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2026-02-17 (federal deadline 2026-03-10). CVE-2026-24412 sources
  9. highpatchedexploited Google Chromium Out of Bounds Memory Access Vulnerability Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-12-12 (federal deadline 2026-01-02). CVE-2025-141743 sources
  10. highpatchedexploited Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. Added to CISA KEV on 2025-11-19 (federal deadline 2025-12-10). CVE-2025-132232 sources

More in Devices & apps

Follow Chrome

RSS: /feed.xml?stack=chrome. JSON: /incidents.json?stack=chrome. Or add it to your usual for delivery.