Threat Brief — 2026-07-29 — Chromium WebGL UAFs and Ghost Cloud Identities

Executive summary: A batch of four Chromium CVEs — including three use-after-free bugs in WebGL and WebView — highlights continued memory-safety pressure in browser graphics stacks. Dormant non-human identities in cloud environments are flagged as a growing blind spot, with a new open-source detection tool released. The exposed-BMC story from yesterday develops further: adversaries are now actively exploiting the 2002-era flaw for offline password cracking against data-center controllers.

Top items

• Chromium batch: four CVEs spanning WebGL, GPU, and WebView. CVE-2026-13028 and CVE-2026-13032 are use-after-free flaws in WebGL; CVE-2026-13030 is an uninitialized-value issue in the GPU process; CVE-2026-13037 is a use-after-free in WebView. All were assigned by Chrome and affect Microsoft Edge (Chromium-based) via upstream ingestion. UAF bugs in WebGL/WebView are consistent with prior sandbox-escape and RCE chains — prioritise patching when the corresponding Chrome release lands. (src: MSRC CVE-2026-13028), (src: MSRC CVE-2026-13030), (src: MSRC CVE-2026-13032), (src: MSRC CVE-2026-13037)

• Dormant non-human identities create hidden cloud attack paths. Researcher Aleksandr Krasnov demonstrates that inactive service accounts and machine identities can form trust-path blind spots that attackers traverse to escalate access. He released NHI Hound, an open-source tool to map these dormant identity chains in cloud environments. Relevant to any team managing cloud IAM at scale. (src: Dark Reading)

• Exposed BMC flaw: adversaries now actively exploiting. The 2002-era vulnerability in server management controllers — first reported yesterday as exposing 24,000+ BMCs — has now drawn active adversary attention for offline password-cracking attacks against Internet-exposed data-center infrastructure. First reported 2026-07-28 by BleepingComputer. (src: Dark Reading)

• CVE-2026-50422 (Windows NTFS EoP) — informational update only. MSRC published an acknowledgement update for this previously disclosed NTFS elevation-of-privilege vulnerability. No new technical detail or exploitation indicator. (src: MSRC CVE-2026-50422)

Themes

Memory-safety in browser graphics pipelines — three of four Chromium CVEs this cycle are use-after-free or uninitialized-value bugs in WebGL, GPU, or WebView components. These subsystems remain a consistent source of high-impact memory-corruption findings, reinforcing the value of sandboxing and rapid patch cadences for browser-dependent workloads.

Non-human identity sprawl — the NHI Hound release joins a growing thread of cloud-identity research this month (confused-deputy flaws in GCP/Azure, shadow AI agents). Dormant service accounts are emerging as a preferred lateral-movement vector precisely because they lack the monitoring applied to human identities.