pwn.watch: Chrome incident updates

[critical] Fearless Wallet browser extension leaked private keys for ~20 months

Thu, 22 Oct 2026 16:15:27 GMT

The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.

Status: live · Patch: unpatched

Latest updates:

2026-10-21: Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost. (source)
2026-10-10: Last known period the exfiltration code was active (it could be re-enabled). (source)
2025-02-19: Malicious code merged into the extension's public source as part of a 'TON ecosystem' PR. (source)

[high] Chrome zero-day CVE-2026-87491 (V8 OOB write)

Wed, 09 Sep 2026 00:00:00 GMT

September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.

Status: closed · Patch: patched · Fixed in: 153.0.8010.36+, 153.0.8010.37+

CVEs: CVE-2026-87491

[high] Chrome zero-day CVE-2026-85046 (V8 type confusion)

Fri, 04 Sep 2026 00:00:00 GMT

September 4 2026 Chrome update patched CVE-2026-85046, a V8 type confusion zero-day Google said was exploited in the wild. Fixed in Chrome 152.0.7977.82/.83. Later added to CISA KEV.

Status: closed · Patch: patched · Fixed in: 152.0.7977.82+, 152.0.7977.83+

CVEs: CVE-2026-85046

[high] Chrome zero-day CVE-2026-11645 (V8 OOB)

Tue, 30 Jun 2026 00:00:00 GMT

June 2026 Chrome emergency update patched CVE-2026-11645, an out-of-bounds read/write in V8 exploited in the wild (fifth Chrome zero-day of 2026 at the time). Stable builds 149.0.7827.102/.103.

Status: closed · Patch: patched · Fixed in: 149.0.7827.102+, 149.0.7827.103+

CVEs: CVE-2026-11645

[high] Chrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)

Thu, 30 Apr 2026 00:00:00 GMT

April 2026 Chrome patch for CVE-2026-5281, a use-after-free in Dawn (WebGPU), actively exploited in the wild.

Status: closed · Patch: patched · Fixed in: April 2026 Chrome Stable

CVEs: CVE-2026-5281

[high] Chrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)

Tue, 31 Mar 2026 00:00:00 GMT

March 2026 Chrome updates fixed two actively exploited zero-days: CVE-2026-3909 (out-of-bounds write in Skia) and CVE-2026-3910 (inappropriate implementation in V8).

Status: closed · Patch: patched · Fixed in: March 2026 Chrome Stable updates

CVEs: CVE-2026-3909, CVE-2026-3910

[high] Chrome zero-day CVE-2026-2441 (CSS use-after-free)

Mon, 16 Feb 2026 00:00:00 GMT

First actively exploited Chrome zero-day of 2026. Google patched CVE-2026-2441, a high-severity use-after-free in CSS (CSSFontFeatureValuesMap), in mid-February Chrome 145 updates. Google stated an exploit existed in the wild.

Status: closed · Patch: patched · Fixed in: 145.0.7632.75+, 144.0.7559.75+ (Linux per reports)

CVEs: CVE-2026-2441

[high] Google Chromium: Chromium Out of Bounds Memory Access Vulnerability

Fri, 12 Dec 2025 00:00:00 GMT

Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-12-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-12: CISA added CVE-2025-14174 to the KEV catalog (due 2026-01-02).

CVEs: CVE-2025-14174

[high] Google Chromium V8: Chromium V8 Type Confusion Vulnerability

Wed, 19 Nov 2025 00:00:00 GMT

Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. Added to CISA KEV on 2025-11-19.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-11-19: CISA added CVE-2025-13223 to the KEV catalog (due 2025-12-10).

CVEs: CVE-2025-13223

[high] Google Chromium V8: Chromium V8 Type Confusion Vulnerability

Tue, 23 Sep 2025 00:00:00 GMT

Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. Added to CISA KEV on 2025-09-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-23: CISA added CVE-2025-10585 to the KEV catalog (due 2025-10-14).

CVEs: CVE-2025-10585

[high] Google Chromium: Chromium ANGLE and GPU Improper Input Validation Vulnerability

Tue, 22 Jul 2025 00:00:00 GMT

Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-07-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-07-22: CISA added CVE-2025-6558 to the KEV catalog (due 2025-08-12).

CVEs: CVE-2025-6558

[high] Google Chromium V8: Chromium V8 Type Confusion Vulnerability

Wed, 02 Jul 2025 00:00:00 GMT

Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-07-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-07-02: CISA added CVE-2025-6554 to the KEV catalog (due 2025-07-23).

CVEs: CVE-2025-6554

[high] Google Chromium V8: Chromium V8 Out-of-Bounds Read and Write Vulnerability

Thu, 05 Jun 2025 00:00:00 GMT

Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-06-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-05: CISA added CVE-2025-5419 to the KEV catalog (due 2025-06-26).

CVEs: CVE-2025-5419

[high] Google Chromium Mojo: Chromium Mojo Sandbox Escape Vulnerability

Thu, 27 Mar 2025 00:00:00 GMT

Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-03-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-27: CISA added CVE-2025-2783 to the KEV catalog (due 2025-04-17).

CVEs: CVE-2025-2783

[high] Google Chromium V8 Inappropriate Implementation

Wed, 28 Aug 2024 00:00:00 GMT

Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-08-28.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-28: CISA added CVE-2024-7965 to the KEV catalog (federal deadline 2024-09-18) (source)
2024-08-21: CVE-2024-7965 published (source)

CVEs: CVE-2024-7965

[high] Google Chromium V8 Type Confusion

Mon, 26 Aug 2024 00:00:00 GMT

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-08-26.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-26: CISA added CVE-2024-7971 to the KEV catalog (federal deadline 2024-09-16) (source)
2024-08-21: CVE-2024-7971 published (source)

CVEs: CVE-2024-7971

[high] Google Chromium V8 Type Confusion

Tue, 28 May 2024 00:00:00 GMT

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-05-28.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-28: CVE-2024-5274 published (source)
2024-05-28: CISA added CVE-2024-5274 to the KEV catalog (federal deadline 2024-06-18) (source)

CVEs: CVE-2024-5274

[critical] Google Chromium V8 Type Confusion

Mon, 20 May 2024 00:00:00 GMT

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. Added to the CISA KEV catalog on 2024-05-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-20: CISA added CVE-2024-4947 to the KEV catalog (federal deadline 2024-06-10) (source)
2024-05-15: CVE-2024-4947 published (source)

CVEs: CVE-2024-4947

[high] Google Chromium V8 Out-of-Bounds Memory Write

Thu, 16 May 2024 00:00:00 GMT

Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-05-16.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-16: CISA added CVE-2024-4761 to the KEV catalog (federal deadline 2024-06-06) (source)
2024-05-14: CVE-2024-4761 published (source)

CVEs: CVE-2024-4761

[critical] Google Chromium Visuals Use-After-Free

Mon, 13 May 2024 00:00:00 GMT

Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-05-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-13: CISA added CVE-2024-4671 to the KEV catalog (federal deadline 2024-06-03) (source)
2024-05-09: CVE-2024-4671 published (source)

CVEs: CVE-2024-4671

[high] Google Chromium V8 Type Confusion

Tue, 06 Feb 2024 00:00:00 GMT

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-02-06: CISA added CVE-2023-4762 to the KEV catalog (federal deadline 2024-02-27) (source)

CVEs: CVE-2023-4762

[high] Google Chromium V8 Out-of-Bounds Memory Access

Wed, 17 Jan 2024 00:00:00 GMT

Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-01-17.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-17: CISA added CVE-2024-0519 to the KEV catalog (federal deadline 2024-02-07) (source)
2024-01-16: CVE-2024-0519 published (source)

CVEs: CVE-2024-0519

[high] Google Chromium WebRTC Heap Buffer Overflow

Tue, 02 Jan 2024 00:00:00 GMT

Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome. Added to the CISA KEV catalog on 2024-01-02. CVE-2023-7024 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-02: CISA added CVE-2023-7024 to the KEV catalog (federal deadline 2024-01-23) (source)

CVEs: CVE-2023-7024

[critical] Google Chromium Skia: Integer Overflow (CVE-2023-6345)

Thu, 30 Nov 2023 00:00:00 GMT

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2023-11-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-11-30: CISA added CVE-2023-6345 to the KEV catalog (due 2023-12-21).

CVEs: CVE-2023-6345

[high] Google Chromium libvpx: Heap Buffer Overflow (CVE-2023-5217)

Mon, 02 Oct 2023 00:00:00 GMT

Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome. Added to CISA KEV on 2023-10-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-02: CISA added CVE-2023-5217 to the KEV catalog (due 2023-10-23).

CVEs: CVE-2023-5217

[high] libwebp heap overflow exploited in the wild (CVE-2023-4863)

Wed, 13 Sep 2023 00:00:00 GMT

A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.

Status: closed · Patch: patched · Fixed in: Chrome 116.0.5845.187, libwebp 1.3.2, Bundling apps/libraries: see each vendor's advisory

Latest updates:

2023-09-13: CISA adds CVE-2023-4863 to the KEV catalog
2023-09-11: Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild (source)

CVEs: CVE-2023-4863

[high] Google Chromium V8: Type Confusion (CVE-2023-3079)

Wed, 07 Jun 2023 00:00:00 GMT

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2023-06-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-07: CISA added CVE-2023-3079 to the KEV catalog (due 2023-06-28).

CVEs: CVE-2023-3079

[critical] Google Chromium Skia: Chrome Skia Integer Overflow (CVE-2023-2136)

Fri, 21 Apr 2023 00:00:00 GMT

Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2023-04-21.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-21: CISA added CVE-2023-2136 to the KEV catalog (due 2023-05-12).

CVEs: CVE-2023-2136

[high] Google Chromium V8: Type Confusion (CVE-2023-2033)

Mon, 17 Apr 2023 00:00:00 GMT

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-17: CISA added CVE-2023-2033 to the KEV catalog (due 2023-05-08).

CVEs: CVE-2023-2033

[high] Google Chromium Network Service: Use-After-Free (CVE-2022-3038)

Thu, 30 Mar 2023 00:00:00 GMT

Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2023-03-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-03-30: CISA added CVE-2022-3038 to the KEV catalog (due 2023-04-20).

CVEs: CVE-2022-3038