Due falle di sicurezza fatali mettono in pericolo chi visita siti web dannosi

Google sta rilasciando rapidamente un nuovo aggiornamento per Chrome, uno dei browser più diffusi e utilizzati al mondo, per correggere almeno 26 falle di sicurezza, due delle quali gravi che mettono in pericolo chi visita siti web dannosi. Se utilizzi anche tu questo browser per navigare online devi assolutamente verificare di avere a disposizione la versione aggiornata:

• versione 152.0.7977.75/.76 per Windows e Mac;
• versione 152.0.7977.75 per Linux.

Nel comunicato stampa ufficiale pubblicato da Google si legge: “Il canale stabile è stato aggiornato alla versione 152.0.7977.75/.76 per Windows e Mac e alla versione 152.0.7977.75 per Linux, e il rilascio avverrà nei prossimi giorni/settimane“.

La prima vulnerabilità grave, CVE-2026-84353, consentiva a un utente malintenzionato remoto, sfruttando tecniche di ingegneria sociale, di eseguire codice arbitrario al di fuori della sandbox tramite una pagina HTML appositamente creata.

La seconda vulnerabilità grave, CVE-2026-84352, consentiva a un utente malintenzionato remoto di eseguire codice arbitrario al di fuori della sandbox tramite una pagina HTML appositamente creata.

Le 26 falle di sicurezza in Chrome che mettono in pericolo chi visita siti web dannosi

Google ha pubblicato ufficialmente le 26 falle di sicurezza che in Chrome mettono in pericolo gli utenti, due delle quali gravi per chi visita siti web dannosi.

• [N/A][522307103] Critical CVE-2026-84353: Use after free in Shared Tab Groups. Reported by Google on 2026-06-10
• [N/A][546260492] Critical CVE-2026-84352: Use after free in WebGL. Reported by Google on 2026-08-14
• [N/A][498839176] High CVE-2026-84354: Incorrect authorization in FileSystem. Reported by Google on 2026-04-02
• [N/A][514078656] High CVE-2026-84359: Information leak in Skia. Reported by Google on 2026-05-17
• [N/A][523208474] High CVE-2026-84357: Improper input validation in Omnibox. Reported by Google on 2026-06-12
• [N/A][533534913] High CVE-2026-84324: Use after free in Proxy. Reported by Google on 2026-07-10
• [N/A][537105664] High CVE-2026-84349: Use after free in Browser. Reported by Google on 2026-07-21
• [TBD][547936520] High CVE-2026-84326: Uninitialized resource in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17
• [N/A][549311485] High CVE-2026-84333: Use after free in Dawn. Reported by Google on 2026-08-19
• [TBD][551593376] High CVE-2026-84351: Buffer overflow in GPU. Reported by Cassio Lima on 2026-08-24
• [N/A][553117928] High CVE-2026-84325: Improper input validation in DataTransfer. Reported by Google on 2026-08-26
• [N/A][498710886] Medium CVE-2026-84328: Missing authorization in FileSystem. Reported by Google on 2026-04-01
• [N/A][501679156] Medium CVE-2026-84347: Use after free in WebRTC. Reported by Google on 2026-04-11
• [N/A][502411391] Medium CVE-2026-84323: Missing authorization in FileSystem. Reported by Google on 2026-04-14
• [N/A][511774376] Medium CVE-2026-84355: Incorrect authorization in Navigation. Reported by Google on 2026-05-10
• [N/A][514006886] Medium CVE-2026-84358: Improper privilege management in Downloads. Reported by Google on 2026-05-17
• [N/A][514489238] Medium CVE-2026-84332: Incorrect authorization in SiteSettings. Reported by Google on 2026-05-19
• [N/A][517091927] Medium CVE-2026-84330: UI misrepresentation in FullScreen. Reported by Google on 2026-05-27
• [N/A][517798926] Medium CVE-2026-84334: Incorrect authorization in Chromoting. Reported by Google on 2026-05-29
• [N/A][518100026] Medium CVE-2026-84348: Information leak in MediaCapture. Reported by Google on 2026-05-30
• [N/A][522302504] Medium CVE-2026-84335: Incorrect authorization in TabStrip. Reported by Google on 2026-06-10
• [N/A][498725213] Low CVE-2026-84327: Incorrect authorization in Autofill. Reported by Google on 2026-04-01
• [N/A][498850269] Low CVE-2026-84329: Confused deputy in CredentialProvider. Reported by Google on 2026-04-02
• [TBD][503787232] Low CVE-2026-84356: UI misrepresentation in FullScreen. Reported by Francesco Topol (k4tedu) on 2026-04-18
• [N/A][513713427] Low CVE-2026-84350: Use after free in TabStrip. Reported by Google on 2026-05-16
• [N/A][521753402] Low CVE-2026-84331: Incorrect authorization in Actor. Reported by Google on 2026-06-09

A fine agosto Google aveva pubblicato un altro aggiornamento per correggere varie vulnerabilità in Chrome.