Overview 7,773 matches · 0 in Waratek scope · 0 protected · 90 exploited · 78 CISA KEV · 113 public PoC · 23 EPSS ≥ 0.5
7,773matches
0in Waratek scope0.0%
0protected0.0%
90exploited1.2%
78CISA KEV1.0%
113public PoC1.5%
23EPSS ≥ 0.50.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
6
0.1%
Not applicable
7,767
99.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
7,773
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,945 / year
20041
Not applicable1
Medium1
not blocked1
No public exploit1
20050
20060
20070
20083
Not applicable3
Medium3
not blocked3
Working exploit published2
No public exploit1
200940
Not applicable40
High13
Medium26
Low1
not blocked40
Working exploit published10
No public exploit30
2010153
Not applicable153
Critical12
High84
Medium56
Low1
not blocked153
Working exploit published6
No public exploit147
2011277
Not applicable277
High117
Medium159
Low1
not blocked277
Exploited2
Working exploit published1
Proof of concept only1
No public exploit273
2012255
Not applicable255
Critical1
High118
Medium134
Low2
not blocked255
Working exploit published6
Proof of concept only3
No public exploit246
2013182
Not applicable182
High104
Medium78
not blocked182
Exploited1
Working exploit published2
No public exploit179
2014133
Not applicable133
Critical1
High97
Medium35
not blocked133
Exploited1
Working exploit published2
No public exploit130
2015186
Outside Waratek scope3
Not applicable183
Critical3
High103
Medium79
Low1
not blocked186
Working exploit published4
Proof of concept only1
No public exploit181
2016172
Not applicable172
Critical17
High94
Medium60
Low1
not blocked172
Exploited2
No public exploit170
2017156
Not applicable156
Critical4
High65
Medium85
Low2
not blocked156
Exploited3
No public exploit153
2018174
Not applicable174
Critical5
High81
Medium87
Low1
not blocked174
Exploited4
Working exploit published3
Proof of concept only1
No public exploit166
2019350
Outside Waratek scope1
Not applicable349
Critical11
High145
Medium192
Low2
not blocked350
Exploited5
Working exploit published10
Proof of concept only1
No public exploit334
2020263
Outside Waratek scope1
Not applicable262
Critical19
High135
Medium109
not blocked263
Exploited6
Working exploit published2
Proof of concept only2
No public exploit253
2021356
Not applicable356
Critical34
High219
Medium102
Low1
not blocked356
Exploited22
Proof of concept only5
No public exploit329
2022357
Not applicable357
Critical15
High242
Medium100
not blocked357
Exploited13
Working exploit published1
Proof of concept only29
Forecast only1
No public exploit313
2023303
Outside Waratek scope1
Not applicable302
Critical11
High177
Medium114
Low1
not blocked303
Exploited8
Proof of concept only8
Forecast only1
No public exploit286
2024260
Not applicable260
Critical21
High184
Medium54
Low1
not blocked260
Exploited7
Proof of concept only36
No public exploit217
2025207
Not applicable207
Critical5
High110
Medium90
Low2
not blocked207
Exploited8
Proof of concept only11
No public exploit188
20263,945
Not applicable3,945
Critical466
High1,747
Medium1,583
Low149
not blocked3,945
Exploited8
Proof of concept only40
No public exploit3,897
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-121105 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121104 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121103 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121102 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121100 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121099 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121098 | High | 2026-11-03 | Not applicable | No public exploit | Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121097 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121096 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) |
| CVE-2026-121095 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121094 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121093 | Medium | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121092 | High | 2026-11-03 | Not applicable | No public exploit | Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121091 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121090 | High | 2026-11-03 | Not applicable | No public exploit | Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121089 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121088 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121087 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121086 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121085 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121084 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121083 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121082 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121081 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121080 | Medium | 2026-11-03 | Not applicable | No public exploit | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121079 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121078 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121077 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121076 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121075 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121074 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121073 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121072 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121071 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121070 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121069 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121068 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121067 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121066 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121065 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121064 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low) |
| CVE-2026-121063 | High | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121062 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121061 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121060 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121059 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121057 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121055 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121054 | High | 2026-11-03 | Not applicable | No public exploit | Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121053 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121052 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121051 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121050 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121049 | Low | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium) |
| CVE-2026-121048 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121047 | High | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121046 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121045 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121044 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121043 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121042 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121041 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121040 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121039 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121038 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121037 | Critical | 2026-11-03 | Not applicable | No public exploit | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121036 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121035 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121034 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121033 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121032 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121031 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121030 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121029 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-120931 | Critical | 2026-11-03 | Not applicable | No public exploit | Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-120930 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76031 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76030 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76029 | High | 2026-10-30 | Not applicable | No public exploit | Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-76028 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76027 | Medium | 2026-10-30 | Not applicable | No public exploit | Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76026 | High | 2026-10-30 | Not applicable | No public exploit | Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76025 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76024 | Medium | 2026-10-30 | Not applicable | No public exploit | Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-119272 | Medium | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-119271 | High | 2026-10-30 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119270 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119269 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119268 | High | 2026-10-30 | Not applicable | No public exploit | Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119267 | High | 2026-10-30 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119266 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119265 | High | 2026-10-30 | Not applicable | No public exploit | Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-119264 | High | 2026-10-30 | Not applicable | No public exploit | Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119263 | Critical | 2026-10-30 | Not applicable | No public exploit | Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119262 | High | 2026-10-30 | Not applicable | No public exploit | Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119261 | Critical | 2026-10-30 | Not applicable | No public exploit | Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119260 | High | 2026-10-30 | Not applicable | No public exploit | Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118359 | High | 2026-10-27 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118358 | High | 2026-10-27 | Not applicable | No public exploit | Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118357 | High | 2026-10-27 | Not applicable | No public exploit | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |