Early Stable Update for Desktop
VULNERABILITYCVE-2026-119261redteam/daily · 1 source
- Highest CVSS
- 9.6
- Exploited
- Not known
- Sources
- 1
What happened
No summary yet. The timeline below shows what each source reported, in order.
From 1 source · Wrong?
What to do
- Update Google Chrome to 156.0.8078.79 or later (fixes CVE-2026-119261).
- Update Google Chrome to 156.0.8078.79 or later (fixes CVE-2026-119263).
- Check whether you use Google Chrome: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-119261CVSS 9.6Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119263CVSS 9.6Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119264CVSS 8.8Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119265CVSS 8.8Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119266CVSS 8.8Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119267CVSS 8.8Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119268CVSS 8.8Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119269CVSS 8.8Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119270CVSS 8.8Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119271CVSS 8.8Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76031CVSS 8.8Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119262CVSS 8.8Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76029CVSS 8.8Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76030CVSS 8.8Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-119260CVSS 8.8Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76025CVSS 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76026CVSS 8.8Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76028CVSS 8.8Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-76024CVSS 6.5Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-119272CVSS 4.3Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-76027CVSS 4.3Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Full story timeline · 24 updates
- Thu 22 OctoberEarly Stable Update for DesktopChrome Releases
- Wed 28 OctoberEarly Stable Update for DesktopChrome Releases
- Thu 29 OctoberStable Channel Update for DesktopChrome Releases
- Fri 30 OctoberCVE-2026-119260 published, CVSS 8.8NVD
- CVE-2026-119261 published, CVSS 9.6NVD
- CVE-2026-119262 published, CVSS 8.8NVD
- CVE-2026-119263 published, CVSS 9.6NVD
- CVE-2026-119264 published, CVSS 8.8NVD
- CVE-2026-119265 published, CVSS 8.8NVD
- CVE-2026-119266 published, CVSS 8.8NVD
- CVE-2026-119267 published, CVSS 8.8NVD
- CVE-2026-119268 published, CVSS 8.8NVD
- CVE-2026-119269 published, CVSS 8.8NVD
- CVE-2026-119270 published, CVSS 8.8NVD
- CVE-2026-119271 published, CVSS 8.8NVD
- CVE-2026-119272 published, CVSS 4.3NVD
- CVE-2026-76024 published, CVSS 6.5NVD
- CVE-2026-76025 published, CVSS 8.8NVD
- CVE-2026-76026 published, CVSS 8.8NVD
- CVE-2026-76027 published, CVSS 4.3NVD
- CVE-2026-76028 published, CVSS 8.8NVD
- CVE-2026-76029 published, CVSS 8.8NVD
- CVE-2026-76030 published, CVSS 8.8NVD
- CVE-2026-76031 published, CVSS 8.8NVD
Who reported · 1 outlet
Chrome Releases