Eight more Chromium vulnerabilities were confirmed exploited over the past year, beyond the two V8 sandbox bugs already covered in this series — spanning V8, the Dawn graphics API, the Skia rendering library, ANGLE, and Chromium's CSS implementation.
| CVE | CVSS | Component | Root cause |
|---|---|---|---|
| CVE-2025-10585 | 9.8 | V8 | Type confusion |
| CVE-2026-11645 | 8.8 | V8 | Out-of-bounds read/write |
| CVE-2026-5281 | 8.8 | Dawn | Use-after-free |
| CVE-2026-3910 | 8.8 | V8 | Inappropriate implementation |
| CVE-2026-3909 | 8.8 | Skia | Out-of-bounds write |
| CVE-2026-2441 | 8.8 | CSS | Use-after-free |
| CVE-2025-14174 | 8.8 | ANGLE (macOS) | Out-of-bounds access |
| CVE-2025-13223 | 8.8 | V8 | Type confusion |
Why the component spread matters as much as the count
Ten total Chromium CVEs confirmed exploited across this year's KEV additions — the two already covered plus these eight — touch five distinct rendering and graphics components: V8 (JavaScript engine), Dawn (the WebGPU implementation), Skia (2D graphics rendering), ANGLE (the cross-platform graphics abstraction layer), and Chromium's CSS engine. That spread illustrates something specific about browser security: a modern browser is really several large, independently complex subsystems bundled together, each processing untrusted, attacker-controlled input from arbitrary web content, and each therefore an independent source of memory-safety findings rather than a single monolithic attack surface with one dominant weak point.
Dawn's inclusion is particularly notable — it's a comparatively newer component (implementing the WebGPU standard for browser-based GPU compute and graphics) than the long-established V8 engine, and its appearance in this list this early in its exploitation history suggests new browser subsystems inherit meaningful attack surface from the moment they ship, not after years of hardening the way V8 has undergone.
What this means beyond Chrome specifically
Every Chromium-based browser — Edge, Brave, Opera, and others — shares this same underlying engine and therefore, in most cases, the same vulnerabilities, patched on each browser's own release schedule which frequently lags Chrome's by days or weeks. An organization managing browser deployment across a mixed fleet needs visibility into every Chromium-derivative in use, not just Chrome itself, to have an accurate picture of exposure to this entire cluster.
What to check this week
Verify update currency across every Chromium-based browser in your environment, not Chrome alone. Ten confirmed-exploited CVEs in a year is a meaningful cumulative exposure if patch tracking only covers one browser brand while others quietly lag behind.
Treat browser patch cadence as equivalent in urgency to server-side critical patching. Ten confirmed-exploited findings in twelve months across a piece of software installed on nearly every managed endpoint represents sustained, ongoing real-world risk, not an occasional inconvenience.
Pay attention to which specific component each CVE affects when assessing risk for specialized deployments — a kiosk or embedded browser instance that disables WebGPU, for instance, has a smaller practical exposure to Dawn-specific findings than a general-purpose browser deployment would.
Why rendering-engine bugs deserve equal weight to V8 findings
It's tempting to treat V8-specific CVEs as the primary browser risk category simply because V8 processes JavaScript directly and has the longest public history of exploitation research. This cluster's inclusion of Dawn, Skia, ANGLE, and CSS-engine findings is a reminder that any component parsing or rendering attacker-supplied web content is an equally valid target, and a security review focused narrowly on "JavaScript engine vulnerabilities" misses a meaningful share of this year's actual confirmed-exploited browser findings.
A closing note on kiosk and embedded deployments
Organizations running Chromium in a locked-down kiosk or embedded configuration should specifically confirm their update mechanism still functions in that constrained deployment mode, since locked-down configurations sometimes unintentionally disable the automatic update channel a general-purpose desktop deployment would otherwise rely on by default.
A final consideration on extension and add-on exposure
Browser extensions granted broad permissions run within the same rendering and scripting context these vulnerabilities affect, meaning an organization's extension policy is itself a relevant control here — restricting extension permissions reduces the surface an exploited rendering bug could combine with, independent of the browser's own patch level.
How Safeguard helps
Safeguard's continuous inventory tracks browser versions across every Chromium-derivative in an environment, not just the primary browser brand an organization has standardized on, closing exactly the visibility gap that lets a lagging secondary browser quietly carry exposure to a component-level vulnerability the primary browser has already patched.
