Overview 3,147 matches · 0 in Waratek scope · 0 protected · 11 exploited · 6 CISA KEV · 35 public PoC · 5 EPSS ≥ 0.5
3,147matches
0in Waratek scope0.0%
0protected0.0%
11exploited0.3%
6CISA KEV0.2%
35public PoC1.1%
5EPSS ≥ 0.50.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
3,147
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
3,147
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,583 / year
20041
Not applicable1
Medium1
not blocked1
No public exploit1
20050
20060
20070
20083
Not applicable3
Medium3
not blocked3
Working exploit published2
No public exploit1
200926
Not applicable26
Medium26
not blocked26
Working exploit published8
No public exploit18
201056
Not applicable56
Medium56
not blocked56
Working exploit published2
No public exploit54
2011159
Not applicable159
Medium159
not blocked159
Working exploit published1
Proof of concept only1
No public exploit157
2012134
Not applicable134
Medium134
not blocked134
Working exploit published4
Proof of concept only1
No public exploit129
201378
Not applicable78
Medium78
not blocked78
Working exploit published1
No public exploit77
201435
Not applicable35
Medium35
not blocked35
Working exploit published1
No public exploit34
201579
Not applicable79
Medium79
not blocked79
No public exploit79
201660
Not applicable60
Medium60
not blocked60
Exploited1
No public exploit59
201785
Not applicable85
Medium85
not blocked85
No public exploit85
201887
Not applicable87
Medium87
not blocked87
Working exploit published1
Proof of concept only1
No public exploit85
2019192
Not applicable192
Medium192
not blocked192
Exploited3
Working exploit published2
No public exploit187
2020109
Not applicable109
Medium109
not blocked109
Working exploit published1
Proof of concept only1
No public exploit107
2021102
Not applicable102
Medium102
not blocked102
Exploited5
Proof of concept only2
No public exploit95
2022100
Not applicable100
Medium100
not blocked100
Exploited1
Proof of concept only8
No public exploit91
2023114
Not applicable114
Medium114
not blocked114
Proof of concept only1
No public exploit113
202454
Not applicable54
Medium54
not blocked54
Proof of concept only8
No public exploit46
202590
Not applicable90
Medium90
not blocked90
Exploited1
Proof of concept only8
No public exploit81
20261,583
Not applicable1,583
Medium1,583
not blocked1,583
Proof of concept only17
No public exploit1,566
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126906 | Medium | 2026-11-11 | Not applicable | No public exploit | Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-126891 | Medium | 2026-11-11 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126884 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126878 | Medium | 2026-11-11 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126871 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126870 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126858 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126857 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126856 | Medium | 2026-11-11 | Not applicable | No public exploit | Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126855 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126854 | Medium | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126850 | Medium | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125345 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125342 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121255 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121254 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121253 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121248 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121245 | Medium | 2026-11-03 | Not applicable | No public exploit | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121244 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121243 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121242 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121240 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121239 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121237 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121235 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121232 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
| CVE-2026-121231 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121225 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121223 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121216 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121215 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121213 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121209 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121206 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121199 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium) |
| CVE-2026-121194 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium) |
| CVE-2026-121193 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121190 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121187 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121186 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121177 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121176 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121175 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121172 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121169 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121165 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121164 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121162 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121161 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121159 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121158 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121142 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121141 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121138 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121136 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121132 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121130 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121125 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121122 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121121 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121116 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121115 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121111 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121110 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121106 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium) |
| CVE-2026-121105 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121103 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121099 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121096 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) |
| CVE-2026-121093 | Medium | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121091 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121088 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121085 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121081 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121080 | Medium | 2026-11-03 | Not applicable | No public exploit | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121075 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121072 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121067 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121066 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121059 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121055 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121053 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121051 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121046 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121045 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121043 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121042 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121041 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121039 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121038 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121033 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121031 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121029 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-120930 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76027 | Medium | 2026-10-30 | Not applicable | No public exploit | Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-76024 | Medium | 2026-10-30 | Not applicable | No public exploit | Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-119272 | Medium | 2026-10-30 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-118322 | Medium | 2026-10-27 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118319 | Medium | 2026-10-27 | Not applicable | No public exploit | Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |