English German
Breadcrumbs

ISN 2026-39: Critical Chromium Vulnerabilities

First published 28 September 2026 (Pre-Notification)

CVSS:3.1: 9.6 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Summary

Security vulnerabilities have been found in Chromium, a web browser used in IGEL OS. This affects the following product versions:

  • IGEL OS 12

  • IGEL OS 11

Details

A use-after-free vulnerability has been discovered in Chromium’s Extensions component. It could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension (CVE-2026-93373). Google rates this issue as high, CISA-ADP rates it as critical.

The Workers are affected by a use-after-free as well (CVE-2026-91749, critical). So is the Internals component (CVE-2026-91721, high).

WebGL contains two instances of use-after-free, both critical (CVE-2026-87464, CVE-2026-87488). Apart from these, it contains an out-of-bounds-write (CVE-2026-87438, critical) and a buffer overflow (CVE-2026-87527, critical).

Other findings are a buffer overflow in PDFium, the PDF viewer component (CVE-2026-93381, high) and a type confusion in the V8 JavaScript engine (CVE-2026-93381, high).

In total, almost 300 vulnerabilities have been addressed – full lists can be found in the References.

Update Instructions

  • OS 12: Upgrade the Chromium app to version 153.0.8010.52 as soon as it is available on the IGEL APP Portal.

  • OS 11: IGEL OS 11 reached End of Maintenance in June 2026. To ensure continued access to security updates and support, we recommend migrating to IGEL OS 12.

References