VuXML: chromium -- security fixes

VuXML ID	da4d7162-4aa3-11f1-b189-a8a1599412c6
Discovery	2026-05-05
Entry	2026-05-08

Chrome Releases reports:

This update includes 127 security fixes:

Critical:

[493747582] CVE-2026-7896: Integer overflow in Blink.

[504069514] CVE-2026-7897: Use after free in Mobile.

[504587882] CVE-2026-7898: Use after free in Chromoting.

High:

[505481948] CVE-2026-7899: Out of bounds read and write in V8.

[496503799] CVE-2026-7900: Heap buffer overflow in ANGLE.

[497724490] CVE-2026-7901: Use after free in ANGLE.

[502030575] CVE-2026-7902: Out of bounds memory access in V8.

[491760376] CVE-2026-7903: Integer overflow in ANGLE.

[492350406] CVE-2026-7904: Out of bounds read in Fonts.

[495259842] CVE-2026-7905: Insufficient validation of untrusted input in Media.

[496284584] CVE-2026-7906: Use after free in SVG.

[496292089] CVE-2026-7907: Use after free in DOM.

[497436531] CVE-2026-7908: Use after free in Fullscreen.

[497437113] CVE-2026-7909: Inappropriate implementation in ServiceWorker.

[497543810] CVE-2026-7910: Use after free in Views.

[497548912] CVE-2026-7911: Use after free in Aura.

[497639714] CVE-2026-7912: Integer overflow in GPU.

[497936728] CVE-2026-7913: Insufficient policy enforcement in DevTools.

[498401609] CVE-2026-7914: Type Confusion in Accessibility.

[498454478] CVE-2026-7915: Insufficient data validation in DevTools.

[498720754] CVE-2026-7916: Insufficient data validation in InterestGroups.

[498752242] CVE-2026-7917: Use after free in Fullscreen.

[498780188] CVE-2026-7918: Use after free in GPU.

[498832921] CVE-2026-7919: Use after free in Aura.

[498989348] CVE-2026-7920: Use after free in Skia.

[499062376] CVE-2026-7921: Use after free in Passwords.

[499449324] CVE-2026-7922: Use after free in ServiceWorker.

[500080194] CVE-2026-7923: Out of bounds write in Skia.

[500087204] CVE-2026-7924: Uninitialized Use in Dawn.

[501833981] CVE-2026-7925: Use after free in Chromoting.

[502249087] CVE-2026-7926: Use after free in PresentationAPI.

[502830119] CVE-2026-7927: Type Confusion in Runtime.

[504612429] CVE-2026-7928: Use after free in WebRTC.

[504660052] CVE-2026-7929: Use after free in MediaRecording.

Medium:

[434825208] CVE-2026-7930: Insufficient validation of untrusted input in Cookies.

[474338157] CVE-2026-7931: Insufficient validation of untrusted input in iOS.

[481634116] CVE-2026-7932: Insufficient policy enforcement in Downloads.

[488585490] CVE-2026-7933: Out of bounds read in WebCodecs.

[489023922] CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker.

[489624550] CVE-2026-7935: Inappropriate implementation in Speech.

[490485402] CVE-2026-7936: Object lifecycle issue in V8.

[491766258] CVE-2026-7937: Insufficient policy enforcement in DevTools.

[492735384] CVE-2026-7938: Use after free in CSS.

[492963096] CVE-2026-7939: Inappropriate implementation in SanitizerAPI.

[493631402] CVE-2026-7940: Use after free in V8.

[493955234] CVE-2026-7941: Insufficient validation of untrusted input in Mobile.

[495363705] CVE-2026-7942: Integer overflow in ANGLE.

[495373657] CVE-2026-7943: Insufficient validation of untrusted input in ANGLE.

[495783187] CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache.

[495802788] CVE-2026-7945: Insufficient validation of untrusted input in COOP.

[496016840] CVE-2026-7946: Insufficient policy enforcement in WebUI.

[496169594] CVE-2026-7947: Insufficient validation of untrusted input in Network.

[496193452] CVE-2026-7948: Race in Chromoting.

[496206134] CVE-2026-7949: Out of bounds read in Skia.

[496259890] CVE-2026-7950: Out of bounds read and write in GFX.

[496266456] CVE-2026-7951: Out of bounds write in WebRTC.

[496279876] CVE-2026-7952: Insufficient policy enforcement in Extensions.

[496379792] CVE-2026-7953: Insufficient validation of untrusted input in Omnibox.

[496380960] CVE-2026-7954: Race in Shared Storage.

[496441232] CVE-2026-7955: Uninitialized Use in GPU.

[496463315] CVE-2026-7956: Use after free in Navigation.

[496607380] CVE-2026-7957: Out of bounds write in Media.

[496632973] CVE-2026-7958: Inappropriate implementation in ServiceWorker.

[496645205] CVE-2026-7959: Inappropriate implementation in Navigation.

[497007825] CVE-2026-7960: Race in Speech.

[497008295] CVE-2026-7961: Insufficient validation of untrusted input in Permissions.

[497081987] CVE-2026-7962: Insufficient policy enforcement in DirectSockets.

[497250399] CVE-2026-7963: Inappropriate implementation in ServiceWorker.

[497254383] CVE-2026-7964: Insufficient validation of untrusted input in FileSystem.

[497255035] CVE-2026-7965: Insufficient validation of untrusted input in DevTools.

[497341787] CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation.

[497365545] CVE-2026-7967: Insufficient validation of untrusted input in Navigation.

[497432281] CVE-2026-7968: Insufficient validation of untrusted input in CORS.

[497450574] CVE-2026-7969: Integer overflow in Network.

[497487462] CVE-2026-7970: Use after free in TopChrome.

[497529290] CVE-2026-7971: Inappropriate implementation in ORB.

[497546281] CVE-2026-7972: Uninitialized Use in GPU.

[497565944] CVE-2026-7973: Integer overflow in Dawn.

[497649372] CVE-2026-7974: Use after free in Blink.

[497735587] CVE-2026-7975: Use after free in DevTools.

[497736679] CVE-2026-7976: Use after free in Views.

[497821223] CVE-2026-7977: Inappropriate implementation in Canvas.

[497828892] CVE-2026-7978: Inappropriate implementation in Companion.

[497849876] CVE-2026-7979: Inappropriate implementation in Media.

[497859275] CVE-2026-7980: Use after free in WebAudio.

[497926602] CVE-2026-7981: Out of bounds read in Codecs.

[497952533] CVE-2026-7982: Uninitialized Use in WebCodecs.

[497975608] CVE-2026-7983: Out of bounds read in Dawn.

[498277368] CVE-2026-7984: Use after free in ReadingMode.

[498352423] CVE-2026-7985: Use after free in GPU.

[498396238] CVE-2026-7986: Insufficient policy enforcement in Autofill.

[498696266] CVE-2026-7987: Use after free in WebRTC.

[498753456] CVE-2026-7988: Type Confusion in WebRTC.

[498765082] CVE-2026-7989: Insufficient data validation in DataTransfer.

[498892267] CVE-2026-7990: Insufficient validation of untrusted input in Updater.

[499065126] CVE-2026-7991: Use after free in UI.

[499067529] CVE-2026-7992: Insufficient validation of untrusted input in UI.

[499099003] CVE-2026-7993: Insufficient validation of untrusted input in Payments.

[499116954] CVE-2026-7994: Inappropriate implementation in Chromoting.

[501745798] CVE-2026-7995: Out of bounds read in AdFilter.

Low:

[484547631] CVE-2026-7996: Insufficient validation of untrusted input in SSL.

[487960705] CVE-2026-7997: Insufficient validation of untrusted input in Updater.

[491676472] CVE-2026-7998: Insufficient validation of untrusted input in Dialog.

[493099941] CVE-2026-7999: Inappropriate implementation in V8.

[494464734] CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver.

[494764371] CVE-2026-8001: Use after free in Printing.

[495779613] CVE-2026-8002: Use after free in Audio.

[495985532] CVE-2026-8003: Insufficient validation of untrusted input in TabGroups.

[496189510] CVE-2026-8004: Insufficient policy enforcement in DevTools.

[496298665] CVE-2026-8005: Insufficient validation of untrusted input in Cast.

[496373088] CVE-2026-8006: Insufficient policy enforcement in DevTools.

[496399759] CVE-2026-8007: Insufficient validation of untrusted input in Cast.

[496426191] CVE-2026-8008: Inappropriate implementation in DevTools.

[496555077] CVE-2026-8009: Inappropriate implementation in Cast.

[496624084] CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation.

[496626029] CVE-2026-8011: Insufficient policy enforcement in Search.

[496628298] CVE-2026-8012: Inappropriate implementation in MHTML.

[497427430] CVE-2026-8013: Insufficient validation of untrusted input in FedCM.

[497490364] CVE-2026-8014: Inappropriate implementation in Preload.

[497548558] CVE-2026-8015: Inappropriate implementation in Media.

[497695401] CVE-2026-8016: Use after free in WebRTC.

[497722578] CVE-2026-8017: Side-channel information leakage in Media.

[498292657] CVE-2026-8018: Insufficient policy enforcement in DevTools.

[498353173] CVE-2026-8019: Insufficient policy enforcement in WebApp.

[498382925] CVE-2026-8020: Uninitialized Use in GPU.

[498417031] CVE-2026-8021: Script injection in UI.

[499194407] CVE-2026-8022: Inappropriate implementation in MHTML.

[source]

CVE Name	CVE-2026-7896
CVE Name	CVE-2026-7897
CVE Name	CVE-2026-7898
CVE Name	CVE-2026-7899
CVE Name	CVE-2026-7900
CVE Name	CVE-2026-7901
CVE Name	CVE-2026-7902
CVE Name	CVE-2026-7903
CVE Name	CVE-2026-7904
CVE Name	CVE-2026-7905
CVE Name	CVE-2026-7906
CVE Name	CVE-2026-7907
CVE Name	CVE-2026-7908
CVE Name	CVE-2026-7909
CVE Name	CVE-2026-7910
CVE Name	CVE-2026-7911
CVE Name	CVE-2026-7912
CVE Name	CVE-2026-7913
CVE Name	CVE-2026-7914
CVE Name	CVE-2026-7915
CVE Name	CVE-2026-7916
CVE Name	CVE-2026-7917
CVE Name	CVE-2026-7918
CVE Name	CVE-2026-7919
CVE Name	CVE-2026-7920
CVE Name	CVE-2026-7921
CVE Name	CVE-2026-7922
CVE Name	CVE-2026-7923
CVE Name	CVE-2026-7924
CVE Name	CVE-2026-7925
CVE Name	CVE-2026-7926
CVE Name	CVE-2026-7927
CVE Name	CVE-2026-7928
CVE Name	CVE-2026-7929
CVE Name	CVE-2026-7930
CVE Name	CVE-2026-7931
CVE Name	CVE-2026-7932
CVE Name	CVE-2026-7933
CVE Name	CVE-2026-7934
CVE Name	CVE-2026-7935
CVE Name	CVE-2026-7936
CVE Name	CVE-2026-7937
CVE Name	CVE-2026-7938
CVE Name	CVE-2026-7939
CVE Name	CVE-2026-7940
CVE Name	CVE-2026-7941
CVE Name	CVE-2026-7942
CVE Name	CVE-2026-7943
CVE Name	CVE-2026-7944
CVE Name	CVE-2026-7945
CVE Name	CVE-2026-7946
CVE Name	CVE-2026-7947
CVE Name	CVE-2026-7948
CVE Name	CVE-2026-7949
CVE Name	CVE-2026-7950
CVE Name	CVE-2026-7951
CVE Name	CVE-2026-7952
CVE Name	CVE-2026-7953
CVE Name	CVE-2026-7954
CVE Name	CVE-2026-7955
CVE Name	CVE-2026-7956
CVE Name	CVE-2026-7957
CVE Name	CVE-2026-7958
CVE Name	CVE-2026-7959
CVE Name	CVE-2026-7960
CVE Name	CVE-2026-7961
CVE Name	CVE-2026-7962
CVE Name	CVE-2026-7963
CVE Name	CVE-2026-7964
CVE Name	CVE-2026-7965
CVE Name	CVE-2026-7966
CVE Name	CVE-2026-7967
CVE Name	CVE-2026-7968
CVE Name	CVE-2026-7969
CVE Name	CVE-2026-7970
CVE Name	CVE-2026-7971
CVE Name	CVE-2026-7972
CVE Name	CVE-2026-7973
CVE Name	CVE-2026-7974
CVE Name	CVE-2026-7975
CVE Name	CVE-2026-7976
CVE Name	CVE-2026-7977
CVE Name	CVE-2026-7978
CVE Name	CVE-2026-7979
CVE Name	CVE-2026-7980
CVE Name	CVE-2026-7981
CVE Name	CVE-2026-7982
CVE Name	CVE-2026-7983
CVE Name	CVE-2026-7984
CVE Name	CVE-2026-7985
CVE Name	CVE-2026-7986
CVE Name	CVE-2026-7987
CVE Name	CVE-2026-7988
CVE Name	CVE-2026-7989
CVE Name	CVE-2026-7990
CVE Name	CVE-2026-7991
CVE Name	CVE-2026-7992
CVE Name	CVE-2026-7993
CVE Name	CVE-2026-7994
CVE Name	CVE-2026-7995
CVE Name	CVE-2026-7996
CVE Name	CVE-2026-7997
CVE Name	CVE-2026-7998
CVE Name	CVE-2026-7999
CVE Name	CVE-2026-8000
CVE Name	CVE-2026-8001
CVE Name	CVE-2026-8002
CVE Name	CVE-2026-8003
CVE Name	CVE-2026-8004
CVE Name	CVE-2026-8005
CVE Name	CVE-2026-8006
CVE Name	CVE-2026-8007
CVE Name	CVE-2026-8008
CVE Name	CVE-2026-8009
CVE Name	CVE-2026-8010
CVE Name	CVE-2026-8011
CVE Name	CVE-2026-8012
CVE Name	CVE-2026-8013
CVE Name	CVE-2026-8014
CVE Name	CVE-2026-8015
CVE Name	CVE-2026-8016
CVE Name	CVE-2026-8017
CVE Name	CVE-2026-8018
CVE Name	CVE-2026-8019
CVE Name	CVE-2026-8020
CVE Name	CVE-2026-8021
CVE Name	CVE-2026-8022
URL	https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html

chromium -- security fixes

Details

References