3 actively exploited and 16 urgent items are open, out of 812 open in total.
Last scan started 2026-11-05 05:24:30 UTC, finished OK.
| Vulnerability | Affects | Severity | Exploitation | Fix | Status | |
|---|---|---|---|---|---|---|
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1 |
Node.js 22.16.0 App / API |
Critical 9.8 |
Exploited Fix by 2026-11-10 |
22.23.4, 24.22.1, 26.12.1 | New | |
| CVE-2023-38180 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 |
Exploited Fix by 2023-08-30 |
6.0.21, 7.0.10 | New | |
| CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
.NET 6 runtime 6.* App / API |
High 7.5 |
Exploited Fix by 2023-10-31 |
6.0.23, 7.0.12 | New | |
| CVE-2025-55315 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. |
ASP.NET Core 8 8.* App / API |
Critical 9.9 |
67% chance of exploit in the next 30 days |
8.0.21, 9.0.10 | New | |
| CVE-2023-36049 .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
.NET 6 runtime 6.* App / API |
Critical 9.8 |
7% chance of exploit in the next 30 days |
6.0.25, 7.0.14 | New | |
| CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
.NET 6 runtime 6.* App / API |
Critical 9.8 |
3% chance of exploit in the next 30 days |
6.0.26, 7.0.15 | New | |
| GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
Next.js 16.1.1 App / API |
Critical 9.5 |
No data | 16.4.1 | New | |
| GHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
Next.js 16.1.1 App / API |
Critical 9.5 |
No data | 16.3.3 | New | |
| GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
Next.js 16.1.1 App / API |
Critical 9.5 |
No data | 16.4.1 | New | |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. |
ASP.NET Core 8 8.* App / API |
Critical 9.4 |
1% chance of exploit in the next 30 days |
8.0.32, 9.0.21, 10.0.13 | New | |
| CVE-2026-73420 Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass |
NextAuth.js 4.24.13 App / API |
Critical 9.1 |
1% chance of exploit in the next 30 days |
4.24.15, 5.0.0-beta.32 | New | |
| CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20, |
Node.js 22.16.0 App / API |
Critical 9.1 |
2% chance of exploit in the next 30 days |
22.22.0, 24.13.0, 25.3.0 | New | |
| CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
Next.js 16.1.1 App / API |
Critical 9.0 |
2% chance of exploit in the next 30 days |
16.3.3 | New | |
| CVE-2026-44578 Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades |
Next.js 16.1.1 App / API |
High 8.6 |
36% chance of exploit in the next 30 days |
16.2.5 | New | |
| CVE-2021-43803 Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. |
Node.js 22.16.0 App / API |
High 7.5 |
47% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req |
Node.js 22.16.0 App / API |
High 7.5 |
25% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2024-1597 org.postgresql:postgresql vulnerable to SQL Injection via line comment generation |
PostgreSQL JDBC 42.7.* Test dependency |
Critical 10.0 |
5% chance of exploit in the next 30 days |
42.7.2 | New | |
| CVE-2026-64812 In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session |
IntelliJ IDEA CE 2025.3.2 Workstation tool |
Critical 10.0 |
0% chance of exploit in the next 30 days |
2026.2 | New | |
| CVE-2026-64813 In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session |
IntelliJ IDEA CE 2025.3.2 Workstation tool |
Critical 10.0 |
1% chance of exploit in the next 30 days |
2026.2 | New | |
| CVE-2025-54349 In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. |
iperf3 3.17 Workstation tool |
Critical 10.0 |
0% chance of exploit in the next 30 days |
3.19.1 | New | |
| CVE-2025-3277 An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution. |
SQLite 3.46.* Test dependency |
Critical 9.8 |
1% chance of exploit in the next 30 days |
3.49.1 | New | |
| CVE-2026-106016 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158. |
Mozilla Firefox latest Workstation tool |
Critical 9.8 |
0% chance of exploit in the next 30 days |
157.0.1 | New | |
| CVE-2025-55319 Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. |
VS Code 1.96.* Workstation tool |
Critical 9.8 |
1% chance of exploit in the next 30 days |
1.104.0 | New | |
| CVE-2026-59792 In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible |
IntelliJ IDEA CE 2025.3.2 Workstation tool |
Critical 9.8 |
1% chance of exploit in the next 30 days |
2026.1.4 | New | |
| CVE-2026-64815 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files |
IntelliJ IDEA CE 2025.3.2 Workstation tool |
Critical 9.8 |
0% chance of exploit in the next 30 days |
2026.2 | New | |
| CVE-2026-76886 C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service |
Wireshark 4.6.6 Workstation tool |
Critical 9.8 |
0% chance of exploit in the next 30 days |
4.6.8 | New | |
| CVE-2026-63073 Issue summary: OpenSSL CMP response validation passed an unexpected response
sender distinguished name directly as the format string to `ERR_raise_data()`.
Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client
that enforces an expected sender or uses a pinned server certificate whose
subject becomes the default expected sender.
CWE: CWE-134 (Use of Externally-Controlled Format String)
Description: When validating a received CMP message, ossl_cmp_msg_check_update()
con |
OpenSSL 3.6.2 Workstation tool |
Critical 9.8 |
1% chance of exploit in the next 30 days |
3.6.4, 4.0.2 | New | |
| CVE-2026-102322 Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106197 Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
1% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106211 Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106227 Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106234 Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106237 Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106239 Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106241 Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106281 Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106298 Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106323 Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106329 Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106358 Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
1% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106372 Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106375 Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106382 Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106401 Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106414 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106417 Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106419 Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110142 Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110149 Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
1% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110916 Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-112992 Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113007 Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113014 Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113020 Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113023 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113056 Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113072 Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113078 Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113084 Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113089 Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113116 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113126 Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113138 UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113169 UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113171 UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113186 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113189 Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113211 Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113222 Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113235 Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113252 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113261 Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113263 Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113270 Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113283 Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via physical access. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113300 Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113328 Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113336 Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113342 Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-118305 Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118306 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118308 Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118309 Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118310 Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118312 Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118316 Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118321 Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118332 Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118340 Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118342 Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118355 Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-119261 Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.79 | New | |
| CVE-2026-119263 Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.79 | New | |
| CVE-2026-121030 Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121035 Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121060 Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121071 Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121074 Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121076 Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121077 Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121086 Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121089 Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121104 Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121114 Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121126 Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121131 Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121148 Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121156 Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121185 Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121189 Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121200 Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121202 Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121214 Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121229 Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121234 Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121241 Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121246 Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121247 Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-121249 Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
157.0.8103.38 | New | |
| CVE-2026-120931 Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
Critical 9.6 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-47281 Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
VS Code 1.96.* Workstation tool |
Critical 9.6 |
1% chance of exploit in the next 30 days |
1.123.1 | New | |
| CVE-2026-81376 Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
VS Code 1.96.* Workstation tool |
Critical 9.6 |
1% chance of exploit in the next 30 days |
1.136.2 | New | |
| CVE-2026-118333 Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.3 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2026-118337 Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
Critical 9.3 |
0% chance of exploit in the next 30 days |
156.0.8078.73 | New | |
| CVE-2022-31631 In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities. |
SQLite 3.46.* Test dependency |
Critical 9.1 |
2% chance of exploit in the next 30 days |
Not listed | New | |
| CVE-2026-106195 Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.1 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106294 Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
Critical 9.1 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-34182 Issue Summary: Cryptographic Message Services (CMS) processing fails to perform
sufficient input validation on the cipher and tag length fields of
AuthEnvelopedData containers, leading to various potential compromises.
Impact Summary: Attackers making use of these vulnerabilities may achieve
key-equivalent functionality for a given CMS recipient and/or bypass integrity
validation for a given message.
In one use case, an attacker may send a CMS message containing
AuthEnvelopedData with the ciph |
OpenSSL 3.6.2 Workstation tool |
Critical 9.1 |
1% chance of exploit in the next 30 days |
3.6.3 | New | |
| CVE-2026-75803 Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty
ciphertext can report success without verifying the supplied authentication
tag when the operation is finalized by calling the EVP_Cipher() function.
Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and
expecting the call to check the AEAD tag may accept forged messages.
CWE: CWE-354 (Improper Validation of Integrity Check Value)
Description: The EVP_Cipher() API call for AEAD ciphers behaves like a |
OpenSSL 3.6.2 Workstation tool |
Critical 9.1 |
0% chance of exploit in the next 30 days |
3.6.4, 4.0.2 | New | |
| CVE-2026-2004 Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.2 | New | |
| CVE-2026-2005 Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.2 | New | |
| CVE-2026-2006 Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.2 | New | |
| CVE-2026-6473 Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.4 | New | |
| CVE-2026-6475 Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the fi |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.4 | New | |
| CVE-2026-6477 Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.4 | New | |
| CVE-2026-6637 Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Vers |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.4 | New | |
| CVE-2026-6638 SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.4 | New | |
| CVE-2026-14662 Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-20 |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14664 Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14669 Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14670 Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14671 Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14676 Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14677 Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-14680 Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-15741 SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-15742 Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-16238 Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-16239 Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-18408 Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-for |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-19385 Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. |
PostgreSQL 18.* Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
18.5 | New | |
| CVE-2026-106190 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106193 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106200 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106201 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106203 Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106204 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106207 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106212 Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106220 Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106225 Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106235 Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106240 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106248 Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106249 Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106252 Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106255 Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106256 Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106257 Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106268 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106269 Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106274 Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106278 Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106283 Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106291 Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106308 Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106309 Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106314 Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106315 Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106318 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106334 Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106335 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106341 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106342 Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106346 Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106347 Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106349 Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106350 Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106352 Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106357 Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106371 Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106373 Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106374 Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106383 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106387 Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106411 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106421 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-106423 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.39 | New | |
| CVE-2026-110137 Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110139 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110140 Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110147 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110148 Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110151 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110153 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110154 Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110155 Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110157 Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110162 Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110163 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110164 Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110166 Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110167 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110168 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110169 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110171 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110172 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.79 | New | |
| CVE-2026-110913 Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-110914 Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-110915 Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-110919 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-110920 Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-110921 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-110922 Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
155.0.8059.84 | New | |
| CVE-2026-112993 Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-112994 UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-112995 Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-112996 Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-112997 Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-112998 Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-112999 Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113000 Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113001 Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113003 Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113004 Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted file. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113005 Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113006 Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113008 Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113009 UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113011 Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113012 Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113013 Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113015 Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113016 Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113017 Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113018 Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113019 Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113021 Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113022 Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted PDF file. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113024 Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113025 UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113027 Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113028 Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113029 Out of bounds write in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113030 Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113031 Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113032 Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113033 Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113034 Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113036 Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113037 Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113039 Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113040 Use after free in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113041 Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113042 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113043 Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113044 Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113046 UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113048 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113049 Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113052 Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113053 Incorrect authorization in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113055 UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113057 Observable discrepancy in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113058 Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113059 Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113060 UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoof UI elements via a malicious peripheral. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113061 Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113062 Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113063 Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113064 Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113065 Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted media file. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113067 UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113068 UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113069 Missing authorization in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113071 Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113073 Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113074 Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113075 Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113076 Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113079 UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113080 UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113081 Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113083 Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-installed app. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113085 Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113086 Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113087 Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113088 UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113090 UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113091 Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113092 Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113093 Use after free in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113094 Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113095 Use after free in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113096 UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113097 Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113099 Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113100 Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113101 Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113103 Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted PDF file. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113104 Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113105 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113106 Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113107 Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113108 Information loss in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113109 Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113110 Missing authorization in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113111 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113112 Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113113 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113114 Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113115 Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113117 Out of bounds read in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113118 Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113119 Improper certificate validation in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113120 Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113121 Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113123 Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113124 Improper input validation in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113125 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113127 Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113128 Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113130 Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113131 Incorrect authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113132 Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113133 Use after free in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113134 Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113135 Use after free in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113136 Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113137 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113140 Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113141 Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113143 Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113145 UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113146 Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113147 Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113148 Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113149 UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113150 Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113152 Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113153 Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113154 Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113155 Missing authorization in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113156 UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113158 Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113160 Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113161 Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113162 Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113163 Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113164 Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113165 Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113166 Improper input validation in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113167 Observable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113168 Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113170 UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113172 Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113173 UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113174 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113175 Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113176 Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113177 Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113179 Missing authorization in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113180 Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113181 Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113182 UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113183 Incorrect authorization in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113184 Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113185 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113187 Missing authorization in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113188 Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113190 Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113191 UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113192 Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113194 Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113195 Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113197 Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113198 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113200 Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113202 Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113203 Observable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113204 UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113205 Insufficient verification of data authenticity in Variations in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113206 UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113207 Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113208 Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113210 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113213 Injection in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113214 Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113215 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113216 Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113217 Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113218 Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113219 Missing authorization in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113220 Missing authorization in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113221 Privilege elevation in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113226 UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113227 Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113228 Incorrect authorization in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113229 Improper signature verification in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113230 UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113231 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113232 Use after free in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113233 Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113234 Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113236 Improper input validation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113238 Information loss in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113239 Race condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113240 Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113241 UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113242 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113243 Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113244 Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113245 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113247 Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113248 Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113249 Missing authorization in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113250 Integer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113251 Improper input validation in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113253 Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113254 Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113255 Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113256 Improper privilege management in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113257 Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113258 Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113259 Missing authorization in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113260 Improper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113262 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113264 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113265 Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113266 Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113267 Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113268 Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113269 Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113271 Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113272 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113273 Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113274 Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113275 Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113276 Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113278 UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113279 Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113280 Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113281 Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113282 Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113284 Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113285 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113286 Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113287 Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113288 Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113289 Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113290 Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113291 UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113292 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113293 Out of bounds write in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113294 Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113298 UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113299 Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113301 Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113302 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113303 Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Google Chrome latest Workstation tool |
High 8.8 |
1% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113305 Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113306 Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted file. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113307 UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113308 Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113311 Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113312 UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113313 Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113314 Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113315 Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113316 Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113317 Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113318 Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113319 Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113320 UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113321 Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113323 UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113324 Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113327 Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113330 Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113331 Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113332 Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113334 Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113335 Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113337 Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New | |
| CVE-2026-113338 Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Google Chrome latest Workstation tool |
High 8.8 |
0% chance of exploit in the next 30 days |
156.0.8078.47 | New |