Overview 16,400 matches · 16 in Waratek scope · 3 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
16,400matches
16in Waratek scope0.1%
3protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
3
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
13
0.1%
Outside Waratek scope
8
0.0%
Not applicable
16,376
99.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.0%
partly blocked
0
0.0%
not blocked
16,397
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
16,400
100.0%
split by
peak 4,523 / year
20032
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20040
20057
Not applicable7
Medium7
not blocked7
No public exploit7
20061
Not applicable1
Medium1
not blocked1
No public exploit1
20078
Not applicable8
High2
Medium6
not blocked8
No public exploit8
20082
Not applicable2
High1
Medium1
not blocked2
No public exploit2
200936
Not applicable36
High11
Medium24
Low1
not blocked36
No public exploit36
2010149
Not applicable149
Critical11
High83
Medium54
Low1
not blocked149
No public exploit149
2011289
Not applicable289
High122
Medium165
Low2
not blocked289
No public exploit289
2012267
Not applicable267
Critical1
High119
Medium144
Low3
not blocked267
No public exploit267
2013187
No exploit published1
Not applicable186
High104
Medium81
Low2
not blocked187
No public exploit187
2014149
Not applicable149
High109
Medium38
Low2
not blocked149
No public exploit149
2015294
Outside Waratek scope2
Not applicable292
Critical3
High176
Medium114
Low1
not blocked294
No public exploit294
2016678
Outside Waratek scope1
Not applicable677
Critical61
High411
Medium200
Low6
not blocked678
No public exploit678
2017988
Protected by Waratek1
Not applicable987
Critical111
High598
Medium272
Low7
blocked by ARMR today1
not blocked987
No public exploit988
2018774
Protected by Waratek1
Not applicable773
Critical79
High511
Medium179
Low5
blocked by ARMR today1
not blocked773
No public exploit774
2019850
No exploit published1
Outside Waratek scope1
Not applicable848
Critical33
High388
Medium417
Low12
not blocked850
No public exploit850
20201,217
No exploit published4
Outside Waratek scope2
Not applicable1,211
Critical189
High466
Medium528
Low34
not blocked1,217
No public exploit1,217
20211,188
No exploit published1
Not applicable1,187
Critical59
High563
Medium540
Low26
not blocked1,188
No public exploit1,188
20221,620
Protected by Waratek1
No exploit published4
Outside Waratek scope2
Not applicable1,613
Critical93
High691
Medium755
Low81
blocked by ARMR today1
not blocked1,619
No public exploit1,620
20231,719
No exploit published1
Not applicable1,718
Critical56
High534
Medium1,109
Low20
not blocked1,719
No public exploit1,719
2024822
No exploit published1
Not applicable821
Critical60
High436
Medium318
Low8
not blocked822
No public exploit822
2025630
Not applicable630
Critical22
High344
Medium258
Low6
not blocked630
No public exploit630
20264,523
Not applicable4,523
Critical508
High2,075
Medium1,767
Low173
not blocked4,523
No public exploit4,523
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126922 | Low | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126915 | High | 2026-11-11 | Not applicable | No public exploit | Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126907 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126906 | Medium | 2026-11-11 | Not applicable | No public exploit | Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-126903 | High | 2026-11-11 | Not applicable | No public exploit | Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126902 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126895 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126894 | Low | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126893 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126892 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126891 | Medium | 2026-11-11 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126890 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126889 | High | 2026-11-11 | Not applicable | No public exploit | Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126888 | High | 2026-11-11 | Not applicable | No public exploit | Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126887 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126886 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126885 | Critical | 2026-11-11 | Not applicable | No public exploit | Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126884 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126883 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126882 | Low | 2026-11-11 | Not applicable | No public exploit | Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126881 | High | 2026-11-11 | Not applicable | No public exploit | Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126880 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126879 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126878 | Medium | 2026-11-11 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126877 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126876 | High | 2026-11-11 | Not applicable | No public exploit | Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126875 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126874 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126873 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126872 | Critical | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126871 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126870 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126869 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126868 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126867 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126866 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-126865 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126864 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126863 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126862 | High | 2026-11-11 | Not applicable | No public exploit | Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High) |
| CVE-2026-126861 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126860 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126859 | Critical | 2026-11-11 | Not applicable | No public exploit | Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126858 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126857 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126856 | Medium | 2026-11-11 | Not applicable | No public exploit | Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126855 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126854 | Medium | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126853 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126850 | Medium | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126849 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126848 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126847 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126840 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125349 | Low | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-125348 | High | 2026-11-10 | Not applicable | No public exploit | Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125347 | Critical | 2026-11-10 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125345 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125344 | High | 2026-11-10 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125343 | High | 2026-11-10 | Not applicable | No public exploit | Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125342 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121257 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121256 | High | 2026-11-03 | Not applicable | No public exploit | Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121255 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121254 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121253 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121252 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121251 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121250 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121249 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121247 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121246 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121245 | Medium | 2026-11-03 | Not applicable | No public exploit | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121244 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121243 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121242 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121241 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121240 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121239 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121238 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121236 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121235 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121234 | Critical | 2026-11-03 | Not applicable | No public exploit | Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121233 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121232 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
| CVE-2026-121231 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121230 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121229 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121228 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121227 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121226 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121225 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121224 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-121223 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121222 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121221 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121219 | High | 2026-11-03 | Not applicable | No public exploit | Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121218 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121217 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121216 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |