Chromium: 25 Vulnerabilities Disclosed Together, Affecting Multiple Components
A batch of 25 vulnerabilities affecting Debian's Chromium package were disclosed on July 1, 2026, with fixes available in version 150.0.7871.47.
Key findings
- 25 Chromium vulnerabilities disclosed on July 1, 2026, all patched in version 150.0.7871.47.
- Flaws include use-after-free, type confusion, and inappropriate implementation across multiple browser components.
- Vulnerabilities range in severity from Low to High, posing risks like code execution and data leakage.
- Exploitation often relies on remote attackers presenting crafted HTML pages or malicious extensions.
- Key affected components include Blink, Skia, XML, Bluetooth, and various platform-specific features.
On July 1, 2026, a significant batch of 25 vulnerabilities was disclosed for Debian's Chromium package, all fixed in version 150.0.7871.47. These vulnerabilities span various components of the browser, including Blink, XML, Skia, Bluetooth, and more, with reported severities ranging from Low to High. The disclosures highlight potential risks such as sensitive information disclosure, sandbox escapes, cross-origin data leaks, and UI spoofing, primarily exploitable via crafted HTML pages or malicious extensions.
Several vulnerabilities fall into common categories:
Inappropriate Implementation Flaws
A large number of CVEs, including CVE-2026-14062, CVE-2026-14151, CVE-2026-14000, CVE-2026-13885, CVE-2026-13835, CVE-2026-14086, CVE-2026-14072, CVE-2026-13881, CVE-2026-13887, CVE-2026-14007, CVE-2026-13941, and CVE-2026-14061, were attributed to "inappropriate implementation" in various modules like Views, AI, XML, Skia, HID, SplitView, WebAppInstalls, NFC, PermissionsPolicy, SiteSettings, and Dawn. These flaws collectively present risks ranging from sensitive information disclosure and UI spoofing to arbitrary script injection (UXSS) and heap corruption, often requiring a remote attacker to present a crafted HTML page to the user.
Use-After-Free Vulnerabilities
A critical set of "use-after-free" bugs were also disclosed, affecting components such as Skia (CVE-2026-13885), Headless (CVE-2026-13832), Chrome for iOS (CVE-2026-14099), Oilpan (CVE-2026-13965), and IME (CVE-2026-13811). These vulnerabilities, particularly CVE-2026-13832, CVE-2026-13811, and CVE-2026-13965, carry a High or Medium severity and could allow remote attackers to execute arbitrary code within the browser's sandbox or exploit heap corruption.
Insufficient Validation and Policy Enforcement
Vulnerabilities stemming from "insufficient validation of untrusted input" or "insufficient policy enforcement" were noted in Blink (CVE-2026-13959), Accessibility (CVE-2026-13806), ANGLE (CVE-2026-13834), GuestView (CVE-2026-13871), and HID (CVE-2026-14086). These issues could lead to bypasses of same-origin policies, site isolation, or navigation restrictions, and in some cases, sandbox escapes, typically through crafted HTML pages. Notably, CVE-2026-13806, CVE-2026-13834, and CVE-2026-13811 are rated High.
Other Notable Vulnerabilities
Additional vulnerabilities include "Type Confusion" in Bluetooth (CVE-2026-14119), "Out of bounds read" in SurfaceCapture (CVE-2026-14011), and "Uninitialized Use" in Media (CVE-2026-13970). These also contribute to the overall risk profile, with potential for sensitive information disclosure and memory read vulnerabilities.
All 25 vulnerabilities were addressed in Chromium version 150.0.7871.47. Users of Debian's Chromium package are strongly advised to update to this version to mitigate the identified risks. The sheer volume and variety of these vulnerabilities underscore the importance of timely patching for browser security.
The disclosures were made on July 1, 2026, with all CVEs published simultaneously, indicating a coordinated disclosure event. The affected version for all these vulnerabilities is prior to 150.0.7871.47.
This batch of vulnerabilities highlights the complex and multifaceted nature of browser security, with flaws found across numerous components and subsystems. Users should ensure their Chromium installations are up-to-date to protect against potential exploitation.
The vulnerabilities include: CVE-2026-14062, CVE-2026-14151, CVE-2026-13959, CVE-2026-14119, CVE-2026-14000, CVE-2026-13885, CVE-2026-13835, CVE-2026-14086, CVE-2026-14072, CVE-2026-14011, CVE-2026-13871, CVE-2026-13832, CVE-2026-13806, CVE-2026-13881, CVE-2026-13887, CVE-2026-14007, CVE-2026-13834, CVE-2026-14099, CVE-2026-13965, CVE-2026-13941, CVE-2026-14150, CVE-2026-13811, CVE-2026-14128, CVE-2026-13970, CVE-2026-14061.