Chromium — CraftedSignal Threat Feed

Chromium Use-After-Free Vulnerability in ANGLE (CVE-2026-7359)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:40 +0000

CVE-2026-7359 describes a use-after-free vulnerability present in ANGLE (Almost Native Graphics Layer Engine), a crucial component of the Chromium open-source project. This vulnerability impacts applications that utilize the Chromium engine, most notably Google Chrome and Microsoft Edge. While the provided source does not give specific exploitation details, use-after-free vulnerabilities can allow for arbitrary code execution. Google Chrome has already addressed this vulnerability, and Microsoft Edge has incorporated the fix from Chromium. This vulnerability matters to defenders because successful exploitation could lead to compromise of the browser and potentially the underlying system.

Attack Chain

An attacker crafts a malicious web page containing JavaScript code that leverages a flaw in ANGLE’s memory management.
A user visits the malicious web page through Chrome or Edge.
The JavaScript code triggers the use-after-free vulnerability by freeing a memory object in ANGLE and then attempting to access it again.
This memory corruption leads to a controlled crash or allows the attacker to overwrite memory with arbitrary data.
The attacker leverages the memory overwrite to inject malicious code into the browser process.
The injected code executes within the context of the browser, granting the attacker access to user data, cookies, and other sensitive information.
The attacker may then use this access to perform actions on behalf of the user, such as stealing credentials, installing malware, or spreading the attack to other systems.
The attacker achieves arbitrary code execution on the user’s system, potentially leading to full system compromise.

Impact

A successful exploit of CVE-2026-7359 could allow an attacker to execute arbitrary code within the context of the affected browser (Chrome or Edge). This can lead to sensitive information disclosure, data theft, and potentially full system compromise. The scope of impact is broad, affecting any user who visits a malicious webpage while using a vulnerable version of Chrome or Edge. Since Chrome and Edge are widely used, this vulnerability poses a significant risk.

Recommendation

Deploy the Sigma rule Detect Suspicious WebGL Usage to identify potential exploitation attempts targeting ANGLE via WebGL.
Monitor web server logs for suspicious requests (cs-uri-query) that may be related to the exploitation of CVE-2026-7359.
Ensure that all Chrome and Edge installations are updated to the latest versions to patch CVE-2026-7359.

Chromium Use-After-Free Vulnerability in Media Component (CVE-2026-7355)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7355 is a critical use-after-free vulnerability residing in the Media component of the Chromium browser engine. This vulnerability affects Google Chrome and Microsoft Edge, as Edge incorporates Chromium. A use-after-free vulnerability occurs when an application attempts to use memory after it has been freed, which can lead to crashes, arbitrary code execution, or other unexpected behavior. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser. This vulnerability was reported and patched by the Chromium project.

Attack Chain

An attacker crafts a malicious webpage containing specially crafted media content.
A user opens the malicious webpage in a vulnerable version of Chrome or Edge.
The browser attempts to process the malicious media content, triggering the use-after-free vulnerability in the Media component.
The vulnerable code attempts to access a freed memory region.
The attacker gains control of the memory region due to the use-after-free condition.
The attacker injects malicious code into the controlled memory region.
The browser executes the attacker-controlled code.
The attacker achieves arbitrary code execution within the context of the browser process, potentially leading to system compromise.

Impact

Successful exploitation of CVE-2026-7355 can lead to arbitrary code execution within the context of the browser process. An attacker could potentially gain control of the user’s system, steal sensitive information, or install malware. Given the widespread use of Chrome and Edge, a successful exploit could impact a large number of users across various sectors.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7355.
Deploy the Sigma rule “Detect Chromium Use-After-Free in Media Component” to identify potential exploitation attempts.
Enable process creation logging to capture events related to potential exploitation attempts, facilitating detection rule functionality.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7357)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7357 is a critical use-after-free vulnerability residing within the GPU component of the Chromium rendering engine. This flaw directly impacts Google Chrome and, due to Microsoft Edge’s reliance on Chromium, also affects Edge users. A remote attacker could potentially exploit this vulnerability to execute arbitrary code on a targeted system. The vulnerability stems from improper memory management within the GPU processing routines. While the specific exploitation details are not provided in this brief, successful exploitation generally involves crafting malicious web content to trigger the vulnerability during GPU operations.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that triggers specific GPU functions.
User visits the malicious website using Chrome or Edge.
The browser’s rendering engine processes the malicious JavaScript, leading to the allocation and subsequent freeing of a memory region in the GPU component.
The attacker’s JavaScript code then attempts to access the previously freed memory region, triggering the use-after-free vulnerability.
By manipulating the memory layout, the attacker can overwrite the freed memory with controlled data.
The overwritten memory is later accessed by the GPU, leading to the execution of attacker-controlled code.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker leverages the code execution to escalate privileges or perform other malicious activities.

Impact

Successful exploitation of CVE-2026-7357 can lead to arbitrary code execution on the victim’s machine. The attacker could potentially install malware, steal sensitive data, or take control of the affected system. Given the widespread use of Chrome and Edge, this vulnerability poses a significant risk to a large number of users.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7357.
Apply the latest security updates for Microsoft Edge to address CVE-2026-7357.
Deploy the Sigma rule “Detect Suspicious WebAssembly Execution” to identify potential exploitation attempts involving WebAssembly.

Chromium Use-After-Free Vulnerability in GPU Component (CVE-2026-7333)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7333 is a critical use-after-free vulnerability residing in the GPU component of the Chromium browser engine. This flaw allows an attacker to potentially corrupt memory and execute arbitrary code in the context of the browser process. As Microsoft Edge is built upon the Chromium engine, it is also susceptible to this vulnerability. Public details are limited, but exploitation likely involves crafting malicious web content that triggers the use-after-free condition within the GPU processing routines. This vulnerability poses a significant threat as it could allow attackers to compromise user systems simply by visiting a malicious website.

Attack Chain

Attacker crafts a malicious HTML page containing JavaScript that interacts with the GPU functionality of the browser.
The user visits the malicious page via a phishing email or drive-by download.
The JavaScript code triggers the use-after-free vulnerability in the Chromium GPU component.
The vulnerability allows the attacker to corrupt memory allocated for GPU processing.
The attacker manipulates memory to gain control of program execution.
The attacker injects malicious code into the browser process.
The injected code executes with the privileges of the browser process, allowing the attacker to perform actions such as stealing cookies, credentials, or installing malware.
The attacker gains persistent access to the compromised system and exfiltrates sensitive data.

Impact

A successful exploitation of CVE-2026-7333 could allow an attacker to execute arbitrary code on a user’s system. This could lead to the theft of sensitive information, installation of malware, or complete system compromise. Given the widespread use of Chromium-based browsers such as Chrome and Edge, this vulnerability has the potential to affect millions of users. The impact is considered critical due to the ease of exploitation and the potential for widespread damage.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7333.
Deploy the Sigma rule “Detect Suspicious GPU Process Creation” to identify potential exploitation attempts.
Enable process creation logging with command-line arguments to detect suspicious processes spawned by the browser (logsource: process_creation).

Chromium Use-After-Free Vulnerability in Cast (CVE-2026-7349)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7349 is a use-after-free vulnerability found in the Cast component of the Chromium browser engine. This vulnerability affects Google Chrome and, by extension, Microsoft Edge, as Edge is built upon Chromium. Use-after-free vulnerabilities can allow an attacker to execute arbitrary code or cause a denial-of-service. While the original report comes from Chrome, the nature of Chromium’s shared codebase means that other Chromium-based browsers are also vulnerable. Successful exploitation of this vulnerability could lead to code execution within the context of the browser process. Defenders need to prioritize patching and monitoring for unusual browser behavior.

Attack Chain

An attacker crafts a malicious webpage designed to trigger the use-after-free vulnerability in the Cast component.
The user visits the malicious webpage using a vulnerable version of Chrome or Edge.
The Cast component attempts to access a freed memory location.
The attacker exploits the use-after-free condition to corrupt memory.
The attacker overwrites a function pointer or other critical data structure in memory.
The attacker triggers the execution of the corrupted function pointer or data structure.
The attacker gains arbitrary code execution within the context of the browser process.
The attacker could potentially escalate privileges or perform other malicious activities, such as installing malware or stealing sensitive data.

Impact

Successful exploitation of CVE-2026-7349 could allow an attacker to execute arbitrary code within the context of the browser, potentially leading to data theft, malware installation, or further system compromise. Given the widespread use of Chrome and Edge, this vulnerability has a significant impact. The specific number of potential victims is dependent on the speed of patching, but could potentially affect millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7349.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.
Monitor browser process execution for unexpected code loading or memory access patterns using process creation logs.
Implement memory protection techniques such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) to mitigate the impact of successful exploitation.

Chromium Heap Buffer Overflow Vulnerability (CVE-2026-7353)

hello@craftedsignal.io — Fri, 01 May 2026 02:21:27 +0000

CVE-2026-7353 is a critical heap buffer overflow vulnerability residing within the Skia graphics library, a core component of the Chromium open-source project. This vulnerability impacts applications that utilize Chromium, including Google Chrome and Microsoft Edge. While the specific details of exploitation are not provided in this brief, the nature of a heap buffer overflow suggests a high potential for arbitrary code execution. Successful exploitation could allow an attacker to gain control of the affected browser process. Given the widespread use of Chromium-based browsers, this vulnerability poses a significant risk to a large user base. Defenders should prioritize patching and consider implementing mitigations to detect and prevent potential exploitation attempts.

Attack Chain

An attacker crafts a malicious web page or injects malicious content into a trusted website.
The victim visits the malicious web page or interacts with the injected content using a Chromium-based browser (Chrome or Edge).
The browser’s rendering engine, utilizing the Skia library, processes the malicious content, triggering the heap buffer overflow in Skia.
The overflow allows the attacker to overwrite adjacent memory regions in the heap.
By carefully crafting the overflowed data, the attacker can overwrite critical data structures within the browser process.
The attacker gains control of the execution flow by overwriting function pointers or other control data.
The attacker executes arbitrary code within the context of the browser process.
The attacker could then perform actions such as installing malware, stealing sensitive data, or further compromising the system.

Impact

Successful exploitation of CVE-2026-7353 allows for arbitrary code execution within the context of the affected browser process. This can lead to a complete compromise of the user’s browser session, potentially enabling the attacker to steal credentials, inject malicious code into other websites, or install malware on the victim’s system. Given the widespread use of Chrome and Edge, the potential impact is significant, affecting potentially millions of users.

Recommendation

Apply the latest security updates for Google Chrome and Microsoft Edge to patch CVE-2026-7353.
Deploy the following Sigma rule to detect potential exploitation attempts based on suspicious process execution originating from the browser (see “Detect Suspicious Process Creation from Browser”).
Enable enhanced browser security features such as site isolation to mitigate the impact of successful exploitation.

Gotenberg Chromium Deny-List Bypass via Case-Insensitive URL Scheme

hello@craftedsignal.io — Mon, 30 Mar 2026 16:16:57 +0000

Gotenberg, a popular Docker-based solution for converting HTML, Markdown, and Office documents to PDF, is susceptible to a critical vulnerability in versions prior to 8.29.0. This flaw allows for unauthenticated arbitrary file read due to a bypass in the Chromium deny-list. The vulnerability stems from the application’s failure to enforce case-sensitivity when validating URL schemes against the deny-list, implemented to prevent access to sensitive files. An attacker can exploit this by using…

CVE-2026-7337 Type Confusion Vulnerability in Chromium V8 Engine

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

CVE-2026-7337 is a type confusion vulnerability residing within the V8 JavaScript engine, the core component of Chromium-based browsers. This vulnerability impacts Google Chrome and Microsoft Edge (Chromium-based), as Edge incorporates the Chromium project. The vulnerability stems from improper handling of object types within the V8 engine during JavaScript execution, potentially leading to exploitable conditions. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser. Public details are available via the Google Chrome Releases blog and the Microsoft Security Response Center (MSRC). Defenders should prioritize patching to the latest available versions of Chrome and Edge.

Attack Chain

An attacker crafts a malicious web page containing JavaScript code designed to trigger the type confusion vulnerability in the V8 engine.
The victim visits the malicious web page using a vulnerable version of Google Chrome or Microsoft Edge.
The browser’s V8 engine attempts to execute the attacker-controlled JavaScript code.
Due to the type confusion vulnerability, the V8 engine misinterprets the type of a JavaScript object.
This misinterpretation leads to memory corruption within the browser process.
The attacker leverages the memory corruption to overwrite critical data structures within the browser’s memory space.
The attacker gains control of the browser process’s execution flow.
The attacker executes arbitrary code on the victim’s machine within the security context of the browser process, potentially leading to information disclosure, data theft, or further system compromise.

Impact

Successful exploitation of CVE-2026-7337 allows an attacker to execute arbitrary code within the context of the user’s browser. This could lead to sensitive information being stolen, such as cookies, browsing history, and stored credentials. Attackers could also potentially use this vulnerability to install malware or gain further access to the victim’s system. Given the widespread use of Chromium-based browsers, this vulnerability poses a significant threat to a large number of users.

Recommendation

Apply the latest security updates for Google Chrome to address CVE-2026-7337. Refer to the Google Chrome Releases blog for details.
Apply the latest security updates for Microsoft Edge (Chromium-based) to address CVE-2026-7337 as described in the MSRC advisory.
Implement a web proxy with content filtering to block access to known malicious websites that may attempt to exploit this vulnerability.