The Exploit Bulletin

• Friday, October 16, 2026

  Full-chain renderer-to-host code execution via V8, WebP and Crashpad bugs, fixed in 152.0.7977.82 (Google Chrome)

• Saturday, September 5, 2026

  V8 type confusion in Chromium lets a crafted page run code in the browser sandbox (CVE-2026-85046)

All software