Overview 16,930 matches · 17 in Waratek scope · 3 protected · 124 exploited · 100 CISA KEV · 273 public PoC · 39 EPSS ≥ 0.5
16,930matches
17in Waratek scope0.1%
3protected0.0%
124exploited0.7%
100CISA KEV0.6%
273public PoC1.6%
39EPSS ≥ 0.50.2%
Protected by Waratek
3
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
14
0.1%
Outside Waratek scope
13
0.1%
Not applicable
16,900
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.0%
partly blocked
0
0.0%
not blocked
16,927
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 4,541 / year
20021
Not applicable1
Low1
not blocked1
Working exploit published1
20032
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20058
Not applicable8
High1
Medium7
not blocked8
Working exploit published1
No public exploit7
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
200712
Not applicable12
High4
Medium8
not blocked12
Working exploit published4
No public exploit8
20086
Not applicable6
High2
Medium4
not blocked6
Working exploit published4
No public exploit2
200946
Not applicable46
High13
Medium32
Low1
not blocked46
Working exploit published10
No public exploit36
2010157
Not applicable157
Critical12
High88
Medium56
Low1
not blocked157
Exploited1
Working exploit published7
No public exploit149
2011297
Not applicable297
High125
Medium170
Low2
not blocked297
Exploited3
Working exploit published4
Proof of concept only1
No public exploit289
2012280
Not applicable280
Critical1
High124
Medium151
Low4
not blocked280
Working exploit published9
Proof of concept only4
No public exploit267
2013192
No exploit published1
Not applicable191
High108
Medium82
Low2
not blocked192
Exploited1
Working exploit published4
No public exploit187
2014158
Not applicable158
Critical1
High114
Medium41
Low2
not blocked158
Exploited2
Working exploit published6
Proof of concept only1
No public exploit149
2015317
Outside Waratek scope3
Not applicable314
Critical3
High197
Medium115
Low2
not blocked317
Exploited3
Working exploit published9
Proof of concept only5
Forecast only6
No public exploit294
2016700
Outside Waratek scope1
Not applicable699
Critical64
High425
Medium205
Low6
not blocked700
Exploited4
Working exploit published11
Proof of concept only6
Forecast only1
No public exploit678
20171,006
Protected by Waratek1
Not applicable1,005
Critical112
High611
Medium276
Low7
blocked by ARMR today1
not blocked1,005
Exploited4
Working exploit published8
Proof of concept only6
No public exploit988
2018796
Protected by Waratek1
Not applicable795
Critical79
High527
Medium185
Low5
blocked by ARMR today1
not blocked795
Exploited5
Working exploit published14
Proof of concept only3
No public exploit774
2019875
No exploit published1
Outside Waratek scope3
Not applicable871
Critical33
High407
Medium423
Low12
not blocked875
Exploited7
Working exploit published15
Proof of concept only3
No public exploit850
20201,245
No exploit published4
Outside Waratek scope2
Not applicable1,239
Critical195
High481
Medium535
Low34
not blocked1,245
Exploited8
Working exploit published6
Proof of concept only14
No public exploit1,217
20211,220
No exploit published1
Not applicable1,219
Critical62
High584
Medium548
Low26
not blocked1,220
Exploited24
Working exploit published1
Proof of concept only7
No public exploit1,188
20221,771
Protected by Waratek1
No exploit published5
Outside Waratek scope2
Not applicable1,763
Critical100
High772
Medium818
Low81
blocked by ARMR today1
not blocked1,770
Exploited15
Working exploit published1
Proof of concept only134
Forecast only1
No public exploit1,620
20231,752
No exploit published1
Outside Waratek scope1
Not applicable1,750
Critical60
High554
Medium1,118
Low20
not blocked1,752
Exploited12
Proof of concept only20
Forecast only1
No public exploit1,719
2024880
No exploit published1
Not applicable879
Critical67
High476
Medium329
Low8
not blocked880
Exploited13
Proof of concept only45
No public exploit822
2025665
Not applicable665
Critical24
High362
Medium273
Low6
not blocked665
Exploited11
Proof of concept only24
No public exploit630
20264,541
Outside Waratek scope1
Not applicable4,540
Critical510
High2,091
Medium1,773
Low167
not blocked4,541
Exploited11
Proof of concept only51
No public exploit4,479
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-121174 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121173 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121172 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121171 | High | 2026-11-03 | Not applicable | No public exploit | Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121170 | High | 2026-11-03 | Not applicable | No public exploit | Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121169 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121168 | High | 2026-11-03 | Not applicable | No public exploit | Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121167 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121166 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) |
| CVE-2026-121165 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121164 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121163 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121162 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121161 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121160 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121159 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121158 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121157 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low) |
| CVE-2026-121156 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121148 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121143 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121142 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121141 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121140 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121138 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121137 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121136 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121135 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121134 | High | 2026-11-03 | Not applicable | No public exploit | Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121133 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-121132 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121131 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121130 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121129 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121128 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121127 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121126 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121125 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121124 | High | 2026-11-03 | Not applicable | No public exploit | Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121123 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121122 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121121 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121120 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121119 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121118 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121117 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121116 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121115 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121114 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121113 | High | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) |
| CVE-2026-121112 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121111 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121110 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121109 | High | 2026-11-03 | Not applicable | No public exploit | Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121108 | High | 2026-11-03 | Not applicable | No public exploit | Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121107 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121106 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium) |
| CVE-2026-121105 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121104 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121103 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121102 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121100 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121099 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121098 | High | 2026-11-03 | Not applicable | No public exploit | Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121097 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121096 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) |
| CVE-2026-121095 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121094 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121093 | Medium | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121092 | High | 2026-11-03 | Not applicable | No public exploit | Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121091 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121090 | High | 2026-11-03 | Not applicable | No public exploit | Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121089 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121088 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121087 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121086 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121085 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121084 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121083 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121082 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121081 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121080 | Medium | 2026-11-03 | Not applicable | No public exploit | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121079 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121078 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121077 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121076 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121075 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121074 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121073 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121072 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121071 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121070 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121069 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121068 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121067 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121066 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121065 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121064 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low) |
| CVE-2026-121063 | High | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121062 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |