Chrome Sandbox Escapes Lead Daily Brief

Google Chrome is facing a barrage of vulnerabilities, with two critical use-after-free flaws in Autofill and Glic, tracked as CVE-2026-11002 and CVE-2026-10990 respectively, allowing for sandbox escapes. Several other medium-severity vulnerabilities, including UI spoofing via CVE-2026-11001 and information disclosure through uninitialized use (CVE-2026-10994) and heap buffer overflows (CVE-2026-10993), also affect Chrome versions prior to 149.0.7827.53. These issues stem from attackers compromising the renderer process or exploiting specific UI gestures, highlighting the need for prompt patching.

Open vSwitch versions prior to v3.6.90 are vulnerable to a denial-of-service attack due to a missing upper-bound check in the udpif_set_threads() function. Tracked as CVE-2026-36499, this vulnerability allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads, potentially crashing the service. This highlights a critical need for network administrators to update their Open vSwitch deployments to mitigate the risk of service disruption.

The Linux kernel has addressed a misleadingly named function, '__copy_user_nocache()', through an update that renames it for clarity. While not a direct security vulnerability in itself, the change, noted as CVE-2026-43073, reflects ongoing efforts to improve code quality and maintainability within the kernel. As reported by Rapid7 Blog, this update was part of broader security patches.