Multiple vulnerabilities in Google Chrome (July 2, 2026)
Multiple vulnerabilities have been discovered in Google Chrome. They allow an attacker to cause an unspecified security issue by the vendor.
CSIRTS triage
- What
- Multiple vulnerabilities allow an attacker to cause an unspecified security issue.
- Who is affected
- Users of Google Chrome.
- Urgency
- Remediation is necessary as the vulnerabilities could lead to security issues, though exploitation status is currently unknown.
- Action
- Update to the latest version of Google Chrome.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Chrome
Get an email when a new Chrome advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0829/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-138480.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-140980.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-137910.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-141040.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-139340.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-140800.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-138060.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-141000.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-139330.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-143920.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all EPSS-scored CVEs.
Referenced CVEs
+12 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownMultiple vulnerabilities in Palo Alto Networks products (August 13, 2026)cert-fr-avis
- highPAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)paloalto
- high[UPDATE] [high] Google Chrome: Multiple vulnerabilities allow unspecified attackcert-bund
- unknownMultiple vulnerabilities in Microsoft Edge (July 15, 2026)cert-fr-avis
- unknownCVE-2026-13906: Chromium: CVE-2026-13906 Out of bounds read in Codecsmsrc
- unknownCVE-2026-13839: Chromium: CVE-2026-13839 Inappropriate implementation in CSSmsrc
- unknownCVE-2026-14134: Chromium: CVE-2026-14134 Inappropriate implementation in Autofillmsrc
- unknownCVE-2026-14063: Chromium: CVE-2026-14063 Out of bounds memory access in Chromecastmsrc
- unknownCVE-2026-14100: Chromium: CVE-2026-14100 Insufficient data validation in NetworkCachemsrc
- unknownCVE-2026-13838: Chromium: CVE-2026-13838 Inappropriate implementation in CSSmsrc
- unknownCVE-2026-14093: Chromium: CVE-2026-14093 Use after free in Castmsrc
- unknownCVE-2026-13840: Chromium: CVE-2026-13840 Insufficient policy enforcement in Canvasmsrc
Recent advisories for Google Chrome
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownGoogle Chrome Multiple Vulnerabilitieshkcert · 2026-08-26
- unknownCVE-2026-79293: Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacke…nvd · 2026-08-25
- unknownCVE-2026-79292: Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attack…nvd · 2026-08-25
- unknownCVE-2026-79291: Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to o…nvd · 2026-08-25
- unknownCVE-2026-79290: Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to ex…nvd · 2026-08-25
- unknownCVE-2026-79289: Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0…nvd · 2026-08-25
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
- unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
- unknownVulnerability in SPIP (August 21, 2026)2026-08-21