Chrome for Android Flaw CVE-2026-113341 Fixed in Version 156.0.8078.47

·2 views

A critical use-after-free vulnerability in Skia, the graphics component used to draw web content, has been identified in Google Chrome on Android before version 156.0.8078.47. Tracked as CVE-2026-113341, the flaw could allow a remote attacker using crafted HTML to execute code outside the browser sandbox, though user interaction is required. Public records do not describe the exact trigger or any incident, and no evidence of active exploitation has been confirmed. The vulnerability is scoped to Chrome on Android, and the fix is available in Chrome 156 stable builds. Users and administrators are advised to update to the fixed version and verify that the new package is installed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

North Korea Suspected Behind Record $6.3bn Crypto Hack, Binance Freezes $3bn

North Korea is believed to be responsible for what is described as the largest cryptocurrency heist in history, valued at about $6.3 billion. Binance reportedly froze roughly $3 billion of the stolen assets and announced it would fully compensate affected users. The attack has drawn attention to the security risks facing digital asset platforms. The article also draws a parallel between the incident and the importance of independently verifying assumptions, using a drug-discovery anecdote involving a mismatched protein structure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

git stash Is Shared Across Worktrees, Causing Parallel Agents to Pop Each Other's Work

Two coding agents working on the same repository in separate git worktrees each ran a stash-test-pop check and ended up restoring each other's stashed changes. The incident, reported in objectstack issue #5742 on August 6, 2026, occurred without any error, since git stash pop printed a normal success message. Git's documentation says only pseudo refs like HEAD and the index are per-worktree, while refs/stash is shared across all worktrees in a repository. As a result, a bare git stash pop takes the newest entry in the common stash list regardless of which worktree created it. The article demonstrates this with a reproducible example and suggests checking where git resolves each ref path to understand the behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BookLore Self-Hosted Library: 814 Title Matches Found, Identity Verification Advised

BookLore is a self-hosted, multi-user digital library supporting local and OIDC authentication, metadata enrichment and OPDS access. A count-only ZoomEye query on 2026-11-05 returned 814 exact title matches for BookLore but zero application fingerprint matches, which the article notes does not confirm running instances. The guidance stresses that library servers hold private books, reading data and credentials, so OPDS users and access scopes need verification. Administrators are advised to test login, setup and OPDS endpoints, review roles and OIDC mappings, and ensure removed users lose their credentials and sessions. Recovery procedures are also flagged, since the reviewed version lacked a password reset flow.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DreamHost Confirms Two-Month Breach of Its File Manager Platform

Web hosting provider DreamHost has confirmed that attackers accessed its File Manager platform over a span of about two months. The intrusion reportedly exposed customers' FTP and SFTP usernames and passwords, along with active webmail sessions. Security experts warn that these credentials could let attackers alter website code, inject malicious scripts, or delete directories, and hijacked sessions might bypass multi-factor authentication. DreamHost has not publicly disclosed how many accounts were affected or how the attackers first got in. Affected customers are advised to rotate their passwords, check their site files for tampering, and log out of webmail sessions.

0 comments Read more at DEV Community