Microsoft Security Response CenterCVE-2026-18002

Chromium: CVE-2026-18002 Insufficient validation of untrusted input in Google Lens

Severity not listed 1 CVE Published Jul 31, 2026 at 7:00 AM UTC

Get alerts for Microsoft Edge (Chromium-based)

Summary

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Products covered

Microsoft Edge (Chromium-based)

Remediation

Release Notes

Vendor-listed fixes

151.0.4129.59

CVEs in this advisory 1

CVE-2026-18002

Updates

Jul 31, 2026 at 7:00 AM UTC
Published by Microsoft Security Response Center
The publication date reported by the vendor.
Sep 2, 2026 at 11:20 PM UTC
Added to SecurityAlert
We collected the advisory from the official source.
Oct 29, 2026 at 4:05 AM UTC
Confirmed at the source
Our collector saw this advisory during a later source check.

Source

Details collected from Microsoft Security Response Center.

Vendor: Microsoft Security Response Center
Advisory ID: CVE-2026-18002
Last source check: Oct 29, 2026 at 10:10 AM UTC

Official bulletin How SecurityAlert builds this record

Your environment

Check the systems you actually run

A vendor advisory can tell you what may be affected. It cannot tell you whether that product and version are installed in your environment.

Confirm the product and installed version.
Read the vendor's prerequisites and exceptions.
Test the update or mitigation through your normal change process.

Watch Microsoft Edge (Chromium-based)

Keep following

Get new Microsoft Security Response Center advisories

Use the vendor-specific RSS feed or set up alerts for a product your team relies on.

Follow this vendor's RSS feed

Summary

Products covered

Remediation

Vendor-listed fixes

CVEs in this advisory 1

Updates

Related advisories from Microsoft Security Response Center

yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.

yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.

yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. Note: Multiple third parties dispute this as a bug and not a vulnerability according to the YASM security policy.

firmware: arm_scmi: Validate SENSOR_UPDATE payload size

s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation