Memory corruption, use-after-free, improper input validation and access control flaws across Chrome components (V8, Turbolev, Skia, ANGLE, Paint, FileSystem, FileAPI, Layout, Media, WebRTC, PDFium, SVG and more) let a remote attacker deliver a crafted HTML page that can potentially execute arbitrary code. Google rates 4 flaws Critical (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344); no in-the-wild exploitation is reported. Affects Google Chrome < 156.0.8078.73. Mitigate by upgrading to 156.0.8078.73/.74 (Windows/Mac) or 156.0.8078.73 (Linux) via the Stable Channel update.

Multiple curl/libcurl flaws enable credential leakage, TLS/SSH verification bypass, command injection and DoS. Credentials can leak to proxies, redirect targets or other origins (incl. AWS SigV4 headers); reused connections can inherit another handle’s TLS identity; wolfSSL pinning and SSH host-key checks can be bypassed; IMAP APPEND allows command injection (CVE-2026-87864). Upgrade to v8.23.0 to mitigate.

Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) lets an authenticated remote user, under certain conditions, obtain certificates (incl. subordinate CA certs) signed by a cluster-scoped issuer not allowed by their approval policy. Affects `

Multiple curl/libcurl issues allow state/cookie leakage, auth confusion, cert pin bypass, and multi-handle DoS: CURLOPT_AWS_SIGV4=NULL still sends Authorization: AWS4-HMAC-SHA256 to a new URL (CVE-2026-86409); redirects to sftp/scp skip SSH host verification options (CVE-2026-86410); FTP pool reuse can inherit STARTTLS+client-cert identity with CURLUSESSL_NONE (CVE-2026-86411); cookie-jar parsing can delete or ignore cookies (CVE-2026-86412/92386); missing final control line can bypass timeouts (CVE-2026-92387); wolfSSL builds can accept wrong pinned key via cert re-parse (CVE-2026-87866). Upgrade to v8.23.0 to mitigate.

Exploited in the wild: Linux kernel net stack bug where skb_try_coalesce() drops SKBFL_SHARED_FRAG, letting ESP-in-TCP (espintcp/esp4/esp6) decrypt in place over page-cache-backed frags. A local low-priv user can corrupt page-cache of readable files for reliable root LPE/possible container escape. Patch to stable kernels incl 5.10.257,5.15.208,6.1.174,6.6.141; or block esp4,esp6,rxrpc to mitigate.

Memory corruption in Chrome’s V8 engine lets a remote attacker deliver a crafted HTML page that can potentially execute arbitrary code inside the Chrome sandbox. Affects Google Chrome < 156.0.8078.73. Mitigate by upgrading to 156.0.8078.73+.