Vulnerabilities
Chromium CVE-2026-95336: Information Leak in Transactions Platform
A new CVE‑2026‑95336 in Chromium’s Transactions Platform can leak sensitive data. The flaw affects Chrome and all Chromium‑based browsers, including Microsoft Edge. Defenders should apply the latest browser updates and verify the patch is in place.
What happened
A vulnerability (CVE‑2026‑95336) was discovered in Chromium’s Transactions Platform that can lead to unintended information disclosure. The flaw originates from improper handling of transaction data, allowing an attacker to read data that should be isolated.
Impact
Any user running Chrome or a Chromium‑based browser that has not applied the latest update is potentially exposed. Sensitive data such as cookies, local storage, or transaction details could be leaked to malicious scripts or network observers.
What to do
- Update Chrome and all Chromium‑based browsers (including Microsoft Edge) to the latest stable release.
- Verify that the update includes the CVE‑2026‑95336 fix by checking the release notes or the browser’s about:version page.
- Disable or restrict the Transactions Platform feature if it is not required for your environment.
- Monitor browser logs and network traffic for anomalous data exfiltration patterns.
- Apply any additional mitigations recommended by the vendor, such as enabling strict site isolation.
Google Chrome releases the fix in the current stable channel, ensuring the vulnerability is mitigated for all supported browsers.
Related vulnerabilities
OpenSSL and WolfSSL Patch High‑Severity DTLS Vulnerabilities (CVE‑2026‑84782, CVE‑2026‑84783)
OpenSSL and WolfSSL released updates fixing a dozen critical bugs, including CVE‑2026‑84782 that lets unauthenticated attackers leak heap fragments or crash DTLS sessions. The flaw can be triggered during a DTLS handshake and is exploitable over the network without credentials. Defenders should upgrade to the latest releases and verify DTLS configurations.
Read briefing
Microsoft Edge Mobile UI Misrepresentation – CVE-2026-95288
Microsoft Edge on mobile devices is affected by CVE-2026-95288, a Chromium-based UI misrepresentation flaw. The issue is fixed in newer Chromium builds; update Edge to the latest version to mitigate.
Read briefing
Chromium CVE-2026-95312: Password Information Leak in Edge
A flaw in Chromium’s password handling can leak credentials. Microsoft Edge users are affected and should update immediately. Defenders should verify patch status and monitor for exposed data.
Read briefing
Chromium CVE-2026-95327: Information Leak in Networking
A flaw in Chromium’s networking stack allows sensitive data leakage. Microsoft Edge (Chromium‑based) is affected. Defenders should update to the latest Edge release to mitigate the risk.
Read briefing