CVE-2023-26226 is a critical use after free memory corruption flaw (CVSS 9.8) in Yandex Browser for Desktop. Versions before 24.4.0.682 are affected, and the vendor lists 24.4.0.682 as the fixed version. Update the browser to that release or newer, and remove it from machines where it has no business purpose.
What's affected
The CVE record says Yandex Browser for Desktop prior to version 24.4.0.682 is affected. Yandex's browser hall of fame page lists this CVE with the fixed version 24.4.0.682 and credits the reporter by handle.
The record gives no further technical detail, and the vendor page is a one line summary. Treat the version number as the whole answer: anything older than 24.4.0.682 is in range.
How to check if you're exposed
Open the browser, go to the About page in the settings menu and read the version. Yandex Browser checks for updates there, and will offer to install a newer build.
On managed Windows or macOS fleets, use your software inventory to list the installed version of Yandex Browser and flag anything below 24.4.0.682. If the browser is not on your approved software list, finding it at all is a result.
The browser is an end user application, so the dependency scan at gold.safeguard.sh/scan will not see it. Use endpoint inventory tools for this one.
What to do now
- Search your endpoint inventory for Yandex Browser installs.
- Update every install to 24.4.0.682 or later through the browser's own update mechanism or your software distribution tool.
- If the browser is not approved in your environment, remove it rather than patching it.
- Confirm that automatic updates are enabled so later fixes arrive without a ticket.
Why it matters
A use after free (CWE-416) happens when a program frees a block of memory and then keeps using the pointer to it. If an attacker can control what gets placed in that memory next, the program can be pushed to read or run something it did not intend. Browsers are a common home for this class because they parse large amounts of untrusted content in memory unsafe code.
The record scores the issue 9.8, with a network attack vector and no privileges required. The vendor page does not say that it was exploited, and the CVE is not on the CISA Known Exploited Vulnerabilities list. The usual advice for browser memory bugs applies: update promptly, and keep the browser version policy automatic.
It also helps to ask who actually uses the browser. A second browser that nobody owns is an unmanaged attack surface, because it will not appear in the patch reports your team reads each month. Decide whether Yandex Browser belongs on your approved list, and if it does, make sure the same update policy covers it as covers your main browser.
Quick check
Which version fixes it?
24.4.0.682, according to the vendor's hall of fame listing.
Will a dependency scan find this?
No. It is a desktop application. Use endpoint or software inventory tools.
Sources
Last reviewed: 19 October 2026.
