Overview 16,974 matches · 17 in Waratek scope · 3 protected · 124 exploited · 100 CISA KEV · 273 public PoC · 39 EPSS ≥ 0.5
16,974matches
17in Waratek scope0.1%
3protected0.0%
124exploited0.7%
100CISA KEV0.6%
273public PoC1.6%
39EPSS ≥ 0.50.2%
Protected by Waratek
3
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
14
0.1%
Outside Waratek scope
13
0.1%
Not applicable
16,944
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.0%
partly blocked
0
0.0%
not blocked
16,971
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 4,585 / year
20021
Not applicable1
Low1
not blocked1
Working exploit published1
20032
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20058
Not applicable8
High1
Medium7
not blocked8
Working exploit published1
No public exploit7
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
200712
Not applicable12
High4
Medium8
not blocked12
Working exploit published4
No public exploit8
20086
Not applicable6
High2
Medium4
not blocked6
Working exploit published4
No public exploit2
200946
Not applicable46
High13
Medium32
Low1
not blocked46
Working exploit published10
No public exploit36
2010157
Not applicable157
Critical12
High88
Medium56
Low1
not blocked157
Exploited1
Working exploit published7
No public exploit149
2011297
Not applicable297
High125
Medium170
Low2
not blocked297
Exploited3
Working exploit published4
Proof of concept only1
No public exploit289
2012280
Not applicable280
Critical1
High124
Medium151
Low4
not blocked280
Working exploit published9
Proof of concept only4
No public exploit267
2013192
No exploit published1
Not applicable191
High108
Medium82
Low2
not blocked192
Exploited1
Working exploit published4
No public exploit187
2014158
Not applicable158
Critical1
High114
Medium41
Low2
not blocked158
Exploited2
Working exploit published6
Proof of concept only1
No public exploit149
2015317
Outside Waratek scope3
Not applicable314
Critical3
High197
Medium115
Low2
not blocked317
Exploited3
Working exploit published9
Proof of concept only5
Forecast only6
No public exploit294
2016700
Outside Waratek scope1
Not applicable699
Critical64
High425
Medium205
Low6
not blocked700
Exploited4
Working exploit published11
Proof of concept only6
Forecast only1
No public exploit678
20171,006
Protected by Waratek1
Not applicable1,005
Critical112
High611
Medium276
Low7
blocked by ARMR today1
not blocked1,005
Exploited4
Working exploit published8
Proof of concept only6
No public exploit988
2018796
Protected by Waratek1
Not applicable795
Critical79
High527
Medium185
Low5
blocked by ARMR today1
not blocked795
Exploited5
Working exploit published14
Proof of concept only3
No public exploit774
2019875
No exploit published1
Outside Waratek scope3
Not applicable871
Critical33
High407
Medium423
Low12
not blocked875
Exploited7
Working exploit published15
Proof of concept only3
No public exploit850
20201,245
No exploit published4
Outside Waratek scope2
Not applicable1,239
Critical195
High481
Medium535
Low34
not blocked1,245
Exploited8
Working exploit published6
Proof of concept only14
No public exploit1,217
20211,220
No exploit published1
Not applicable1,219
Critical62
High584
Medium548
Low26
not blocked1,220
Exploited24
Working exploit published1
Proof of concept only7
No public exploit1,188
20221,771
Protected by Waratek1
No exploit published5
Outside Waratek scope2
Not applicable1,763
Critical100
High772
Medium818
Low81
blocked by ARMR today1
not blocked1,770
Exploited15
Working exploit published1
Proof of concept only134
Forecast only1
No public exploit1,620
20231,752
No exploit published1
Outside Waratek scope1
Not applicable1,750
Critical60
High554
Medium1,118
Low20
not blocked1,752
Exploited12
Proof of concept only20
Forecast only1
No public exploit1,719
2024880
No exploit published1
Not applicable879
Critical67
High476
Medium329
Low8
not blocked880
Exploited13
Proof of concept only45
No public exploit822
2025665
Not applicable665
Critical24
High362
Medium273
Low6
not blocked665
Exploited11
Proof of concept only24
No public exploit630
20264,585
Outside Waratek scope1
Not applicable4,584
Critical512
High2,115
Medium1,785
Low173
not blocked4,585
Exploited11
Proof of concept only51
No public exploit4,523
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-121105 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121104 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121103 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121102 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121100 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121099 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121098 | High | 2026-11-03 | Not applicable | No public exploit | Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121097 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121096 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) |
| CVE-2026-121095 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121094 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121093 | Medium | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121092 | High | 2026-11-03 | Not applicable | No public exploit | Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121091 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121090 | High | 2026-11-03 | Not applicable | No public exploit | Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121089 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121088 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121087 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121086 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121085 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121084 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121083 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121082 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121081 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121080 | Medium | 2026-11-03 | Not applicable | No public exploit | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121079 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121078 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121077 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121076 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121075 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121074 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121073 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121072 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121071 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121070 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121069 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121068 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121067 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121066 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121065 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121064 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low) |
| CVE-2026-121063 | High | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121062 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121061 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121060 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121059 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121057 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121055 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121054 | High | 2026-11-03 | Not applicable | No public exploit | Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121053 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121052 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121051 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121050 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121049 | Low | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium) |
| CVE-2026-121048 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121047 | High | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121046 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121045 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121044 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121043 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121042 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121041 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121040 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121039 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121038 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121037 | Critical | 2026-11-03 | Not applicable | No public exploit | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121036 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121035 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121034 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121033 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121032 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121031 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121030 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121029 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-120931 | Critical | 2026-11-03 | Not applicable | No public exploit | Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-120930 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-59048 | Medium | 2026-11-02 | Not applicable | No public exploit | In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59047 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59046 | Medium | 2026-11-02 | Not applicable | No public exploit | In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59045 | High | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59044 | High | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59043 | High | 2026-11-02 | Not applicable | No public exploit | In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59042 | High | 2026-11-02 | Not applicable | No public exploit | In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59031 | Medium | 2026-11-02 | Not applicable | No public exploit | In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59028 | High | 2026-11-02 | Not applicable | No public exploit | In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59022 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59021 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59020 | Medium | 2026-11-02 | Not applicable | No public exploit | In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59016 | High | 2026-11-02 | Not applicable | No public exploit | In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59015 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59014 | High | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59012 | Medium | 2026-11-02 | Not applicable | No public exploit | In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59011 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59010 | Medium | 2026-11-02 | Not applicable | No public exploit | In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59008 | Medium | 2026-11-02 | Not applicable | No public exploit | In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59007 | Medium | 2026-11-02 | Not applicable | No public exploit | In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59006 | Medium | 2026-11-02 | Not applicable | No public exploit | In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2026-59005 | High | 2026-11-02 | Not applicable | No public exploit | In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59004 | High | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59003 | Medium | 2026-11-02 | Not applicable | No public exploit | In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |