Installer Security
The latest Installer Security coverage — news, analysis, and updates from the WindowsNews.AI desk.
Critical Chrome Updater Bug CVE-2026-14113 Hits Windows: Patch to 150.0.7871.47 Now
Google has released Chrome 150.0.7871.47 to fix CVE-2026-14113, a use-after-free bug in the browser's updater on Windows. The flaw could let an attacker with a foothold in the renderer break out of the sandbox, so all Windows Chrome users should update immediately. The patch addresses a less-examined attack surface and highlights the growing scrutiny on browser components beyond the renderer.
Google Issues Fix for WebProtect Use-After-Free Flaw in Chrome 150
Google released a Chrome update on June 30, 2026, fixing a low-severity use-after-free vulnerability in the WebProtect component (CVE-2026-14111). The flaw required user interaction to be exploited, making the risk low for most users. Chrome users should update to version 150.0.7871.47 immediately.
CVE-2026-14120: Chrome 150 Fixes DevTools Sandbox Escape
Google released Chrome 150 with a patch for CVE-2026-14120, a high-severity DevTools flaw that allowed sandbox escape after renderer compromise. All users should update to version 150.0.7871.47 immediately to protect against potential attacks.
Chrome 150 Patches Low-Severity Flaw That Could Leak Sensitive Data via DevTools
The June 30, 2026, release of Chrome 150.0.7871.47 addresses CVE-2026-14118, a low-severity DevTools validation issue that could leak cross-origin data. While the risk to average users is minimal, web developers should exercise caution. Windows users can secure their browsers by updating immediately.
Chrome for Android Fixes Autofill Spoofing Bug That Could Trick Users into Handing Over Passwords
Google has patched CVE-2026-14134, a low-severity Autofill UI spoofing vulnerability in Chrome for Android that could trick users into handing over saved passwords to malicious sites. The fix arrived in version 150.0.7871.47, and no active attacks have been reported. Users should update Chrome immediately and remain cautious when Autofill prompts appear on unfamiliar pages.
Chrome 150 Patches UI Spoofing Flaw CVE-2026-14135 – Why All Windows Users Should Update Immediately
Google patched CVE-2026-14135, a low-severity UI spoofing vulnerability in Chrome, with version 150.0.7871.47. The flaw requires an already-compromised renderer process, making it a secondary threat. All Windows users should update Chrome immediately to close this avenue in potential attack chains.
Chrome 150 Emergency Update Closes Accessibility Backdoor to Cross-Site Data
Google released Chrome 150.0.7871.47 to fix CVE-2026-13806, a vulnerability that allowed an attacker already inside the renderer process to bypass site isolation via an accessibility feature. Windows and Mac users are affected. The article details what the bug means for everyday users, power users, and IT administrators, provides step-by-step update instructions, and explains the history of site isolation bypasses.
Google Patches Chrome Updater Flaw That Let Attackers Escalate to System Privileges on Windows
Google released Chrome 150.0.7871.47 on June 30, 2026 to fix CVE-2026-13800, a high-severity flaw in the Chrome Updater that could let a local attacker gain system-level privileges on Windows. The article explains the vulnerability, steps to verify the update, and guidance for IT administrators and power users to protect their systems.
Critical Chrome Update Patches Sandbox Escape Vulnerability on Windows and Mac
Google has patched a high-severity sandbox escape vulnerability in Chrome for Windows and macOS. The flaw, CVE-2026-13796, involved an integer overflow in the Chromecast component. Users should update to version 150.0.7871.47 immediately.
Microsoft Patches Stealthy Edge Spoofing Flaw That Can Fake Any Website’s UI
Microsoft has released an urgent patch for CVE-2026-58524, a spoofing vulnerability in Edge and WebView2 that allows attackers to create convincing fake UI elements on any website. The fix is available in Edge Stable version 130.0.6723.59, and all users—home, enterprise, and developers—should update immediately to protect against phishing and malware attacks.
Edge 150.0.4078.48 Closes Spoofing Hole – Update Now Before Attackers Exploit It
Microsoft released Edge 150.0.4078.48 on July 3, 2026, fixing a medium-severity spoofing vulnerability (CVE-2026-58597) that could let attackers fake website identities and steal credentials. The patch is already rolling out automatically; users and IT admins should force an update immediately and restart the browser to remove the risk.
Microsoft Urges Edge for Android Users to Patch Path Traversal Flaw Immediately
Microsoft disclosed CVE-2026-58300, an Important path traversal vulnerability in Edge for Android, on July 3, 2026. The flaw could let attackers read sensitive data through a specially crafted website. Users must update to Edge version 150.0.4078.48 immediately via the Google Play Store to stay protected.
Microsoft Ships Urgent Fix for Edge Android Vulnerability CVE-2026-58297
Microsoft has released a security update for Edge on Android to patch a high-severity information disclosure flaw, CVE-2026-58297. The vulnerability affects versions prior to 150.0.407 and could allow unauthorized access to sensitive user data. Users are advised to update their browser immediately through the Google Play Store.