Overview 625 matches · 0 in Waratek scope · 0 protected · 15 exploited · 15 CISA KEV · 7 public PoC · 2 EPSS ≥ 0.5
625matches
0in Waratek scope0.0%
0protected0.0%
15exploited2.4%
15CISA KEV2.4%
7public PoC1.1%
2EPSS ≥ 0.50.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
625
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
625
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 466 / year
201012
Not applicable12
Critical12
not blocked12
Working exploit published1
No public exploit11
20110
20121
Not applicable1
Critical1
not blocked1
No public exploit1
20130
20141
Not applicable1
Critical1
not blocked1
Exploited1
20153
Not applicable3
Critical3
not blocked3
No public exploit3
201617
Not applicable17
Critical17
not blocked17
No public exploit17
20174
Not applicable4
Critical4
not blocked4
No public exploit4
20185
Not applicable5
Critical5
not blocked5
No public exploit5
201911
Not applicable11
Critical11
not blocked11
No public exploit11
202019
Not applicable19
Critical19
not blocked19
Exploited2
No public exploit17
202134
Not applicable34
Critical34
not blocked34
Exploited3
No public exploit31
202215
Not applicable15
Critical15
not blocked15
Exploited2
No public exploit13
202311
Not applicable11
Critical11
not blocked11
Exploited2
Proof of concept only1
No public exploit8
202421
Not applicable21
Critical21
not blocked21
Exploited4
Proof of concept only2
No public exploit15
20255
Not applicable5
Critical5
not blocked5
Exploited1
No public exploit4
2026466
Not applicable466
Critical466
not blocked466
Proof of concept only1
No public exploit465
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126885 | Critical | 2026-11-11 | Not applicable | No public exploit | Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126872 | Critical | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126859 | Critical | 2026-11-11 | Not applicable | No public exploit | Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125347 | Critical | 2026-11-10 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121257 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121250 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121249 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121247 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121246 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121241 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121234 | Critical | 2026-11-03 | Not applicable | No public exploit | Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121229 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121214 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121202 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121200 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121189 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121185 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121157 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low) |
| CVE-2026-121156 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121148 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121131 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121126 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121114 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121104 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121089 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121086 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121077 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121076 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121074 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121073 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121071 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121060 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121037 | Critical | 2026-11-03 | Not applicable | No public exploit | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121035 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121034 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121030 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-120931 | Critical | 2026-11-03 | Not applicable | No public exploit | Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-119263 | Critical | 2026-10-30 | Not applicable | No public exploit | Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-119261 | Critical | 2026-10-30 | Not applicable | No public exploit | Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118355 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118342 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118340 | Critical | 2026-10-27 | Not applicable | No public exploit | Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118337 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118333 | Critical | 2026-10-27 | Not applicable | No public exploit | Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118332 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118321 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118316 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118312 | Critical | 2026-10-27 | Not applicable | No public exploit | Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-118310 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118309 | Critical | 2026-10-27 | Not applicable | No public exploit | Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118308 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118306 | Critical | 2026-10-27 | Not applicable | No public exploit | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-118305 | Critical | 2026-10-27 | Not applicable | No public exploit | Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-113342 | Critical | 2026-10-20 | Not applicable | No public exploit | Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113336 | Critical | 2026-10-20 | Not applicable | No public exploit | Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-113328 | Critical | 2026-10-20 | Not applicable | No public exploit | Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113300 | Critical | 2026-10-20 | Not applicable | No public exploit | Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-113283 | Critical | 2026-10-20 | Not applicable | No public exploit | Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via physical access. (Chromium security severity: Medium) |
| CVE-2026-113270 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113263 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113261 | Critical | 2026-10-20 | Not applicable | No public exploit | Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113252 | Critical | 2026-10-20 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-113235 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113222 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-113211 | Critical | 2026-10-20 | Not applicable | No public exploit | Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113189 | Critical | 2026-10-20 | Not applicable | No public exploit | Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113186 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low) |
| CVE-2026-113171 | Critical | 2026-10-20 | Not applicable | No public exploit | UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Medium) |
| CVE-2026-113169 | Critical | 2026-10-20 | Not applicable | No public exploit | UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Low) |
| CVE-2026-113138 | Critical | 2026-10-20 | Not applicable | No public exploit | UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113126 | Critical | 2026-10-20 | Not applicable | No public exploit | Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113116 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-113089 | Critical | 2026-10-20 | Not applicable | No public exploit | Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-113084 | Critical | 2026-10-20 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113078 | Critical | 2026-10-20 | Not applicable | No public exploit | Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113072 | Critical | 2026-10-20 | Not applicable | No public exploit | Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-113056 | Critical | 2026-10-20 | Not applicable | No public exploit | Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-113023 | Critical | 2026-10-20 | Not applicable | No public exploit | Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-113020 | Critical | 2026-10-20 | Not applicable | No public exploit | Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-113014 | Critical | 2026-10-20 | Not applicable | No public exploit | Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113007 | Critical | 2026-10-20 | Not applicable | No public exploit | Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-112992 | Critical | 2026-10-20 | Not applicable | No public exploit | Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-110916 | Critical | 2026-10-15 | Not applicable | No public exploit | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-110165 | Critical | 2026-10-13 | Not applicable | No public exploit | Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-110161 | Critical | 2026-10-13 | Not applicable | No public exploit | Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical) |
| CVE-2026-110159 | Critical | 2026-10-13 | Not applicable | No public exploit | Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) |
| CVE-2026-110152 | Critical | 2026-10-13 | Not applicable | No public exploit | Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-110149 | Critical | 2026-10-13 | Not applicable | No public exploit | Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-110144 | Critical | 2026-10-13 | Not applicable | No public exploit | Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) |
| CVE-2026-110142 | Critical | 2026-10-13 | Not applicable | No public exploit | Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-110136 | Critical | 2026-10-13 | Not applicable | No public exploit | Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-106419 | Critical | 2026-10-06 | Not applicable | No public exploit | Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-106417 | Critical | 2026-10-06 | Not applicable | No public exploit | Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-106414 | Critical | 2026-10-06 | Not applicable | No public exploit | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-106401 | Critical | 2026-10-06 | Not applicable | No public exploit | Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-106382 | Critical | 2026-10-06 | Not applicable | No public exploit | Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-106375 | Critical | 2026-10-06 | Not applicable | No public exploit | Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-106372 | Critical | 2026-10-06 | Not applicable | No public exploit | Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-106358 | Critical | 2026-10-06 | Not applicable | No public exploit | Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-106329 | Critical | 2026-10-06 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |