Overview 16,971 matches · 14 in Waratek scope · 0 protected · 124 exploited · 100 CISA KEV · 273 public PoC · 39 EPSS ≥ 0.5
16,971matches
14in Waratek scope0.1%
0protected0.0%
124exploited0.7%
100CISA KEV0.6%
273public PoC1.6%
39EPSS ≥ 0.50.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
14
0.1%
Outside Waratek scope
13
0.1%
Not applicable
16,944
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
16,971
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 4,585 / year
20021
Not applicable1
Low1
not blocked1
Working exploit published1
20032
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20058
Not applicable8
High1
Medium7
not blocked8
Working exploit published1
No public exploit7
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
200712
Not applicable12
High4
Medium8
not blocked12
Working exploit published4
No public exploit8
20086
Not applicable6
High2
Medium4
not blocked6
Working exploit published4
No public exploit2
200946
Not applicable46
High13
Medium32
Low1
not blocked46
Working exploit published10
No public exploit36
2010157
Not applicable157
Critical12
High88
Medium56
Low1
not blocked157
Exploited1
Working exploit published7
No public exploit149
2011297
Not applicable297
High125
Medium170
Low2
not blocked297
Exploited3
Working exploit published4
Proof of concept only1
No public exploit289
2012280
Not applicable280
Critical1
High124
Medium151
Low4
not blocked280
Working exploit published9
Proof of concept only4
No public exploit267
2013192
No exploit published1
Not applicable191
High108
Medium82
Low2
not blocked192
Exploited1
Working exploit published4
No public exploit187
2014158
Not applicable158
Critical1
High114
Medium41
Low2
not blocked158
Exploited2
Working exploit published6
Proof of concept only1
No public exploit149
2015317
Outside Waratek scope3
Not applicable314
Critical3
High197
Medium115
Low2
not blocked317
Exploited3
Working exploit published9
Proof of concept only5
Forecast only6
No public exploit294
2016700
Outside Waratek scope1
Not applicable699
Critical64
High425
Medium205
Low6
not blocked700
Exploited4
Working exploit published11
Proof of concept only6
Forecast only1
No public exploit678
20171,005
Not applicable1,005
Critical112
High611
Medium276
Low6
not blocked1,005
Exploited4
Working exploit published8
Proof of concept only6
No public exploit987
2018795
Not applicable795
Critical79
High527
Medium184
Low5
not blocked795
Exploited5
Working exploit published14
Proof of concept only3
No public exploit773
2019875
No exploit published1
Outside Waratek scope3
Not applicable871
Critical33
High407
Medium423
Low12
not blocked875
Exploited7
Working exploit published15
Proof of concept only3
No public exploit850
20201,245
No exploit published4
Outside Waratek scope2
Not applicable1,239
Critical195
High481
Medium535
Low34
not blocked1,245
Exploited8
Working exploit published6
Proof of concept only14
No public exploit1,217
20211,220
No exploit published1
Not applicable1,219
Critical62
High584
Medium548
Low26
not blocked1,220
Exploited24
Working exploit published1
Proof of concept only7
No public exploit1,188
20221,770
No exploit published5
Outside Waratek scope2
Not applicable1,763
Critical100
High771
Medium818
Low81
not blocked1,770
Exploited15
Working exploit published1
Proof of concept only134
Forecast only1
No public exploit1,619
20231,752
No exploit published1
Outside Waratek scope1
Not applicable1,750
Critical60
High554
Medium1,118
Low20
not blocked1,752
Exploited12
Proof of concept only20
Forecast only1
No public exploit1,719
2024880
No exploit published1
Not applicable879
Critical67
High476
Medium329
Low8
not blocked880
Exploited13
Proof of concept only45
No public exploit822
2025665
Not applicable665
Critical24
High362
Medium273
Low6
not blocked665
Exploited11
Proof of concept only24
No public exploit630
20264,585
Outside Waratek scope1
Not applicable4,584
Critical512
High2,115
Medium1,785
Low173
not blocked4,585
Exploited11
Proof of concept only51
No public exploit4,523
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126922 | Low | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126915 | High | 2026-11-11 | Not applicable | No public exploit | Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126907 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126906 | Medium | 2026-11-11 | Not applicable | No public exploit | Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-126903 | High | 2026-11-11 | Not applicable | No public exploit | Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126902 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126895 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126894 | Low | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126893 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126892 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126891 | Medium | 2026-11-11 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126890 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126889 | High | 2026-11-11 | Not applicable | No public exploit | Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126888 | High | 2026-11-11 | Not applicable | No public exploit | Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126887 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126886 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126885 | Critical | 2026-11-11 | Not applicable | No public exploit | Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126884 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126883 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126882 | Low | 2026-11-11 | Not applicable | No public exploit | Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126881 | High | 2026-11-11 | Not applicable | No public exploit | Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126880 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126879 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126878 | Medium | 2026-11-11 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126877 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126876 | High | 2026-11-11 | Not applicable | No public exploit | Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126875 | High | 2026-11-11 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126874 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126873 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126872 | Critical | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126871 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126870 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126869 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126868 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126867 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126866 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-126865 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126864 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126863 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126862 | High | 2026-11-11 | Not applicable | No public exploit | Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High) |
| CVE-2026-126861 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126860 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126859 | Critical | 2026-11-11 | Not applicable | No public exploit | Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126858 | Medium | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126857 | Medium | 2026-11-11 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126856 | Medium | 2026-11-11 | Not applicable | No public exploit | Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126855 | Medium | 2026-11-11 | Not applicable | No public exploit | Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126854 | Medium | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126853 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126850 | Medium | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126849 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126848 | Low | 2026-11-11 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126847 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126840 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125350 | High | 2026-11-10 | Not applicable | Exploited | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125349 | Low | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-125348 | High | 2026-11-10 | Not applicable | No public exploit | Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125347 | Critical | 2026-11-10 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125345 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125344 | High | 2026-11-10 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125343 | High | 2026-11-10 | Not applicable | No public exploit | Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125342 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121257 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121256 | High | 2026-11-03 | Not applicable | No public exploit | Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121255 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121254 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121253 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121252 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121251 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121250 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121249 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121248 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121247 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121246 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121245 | Medium | 2026-11-03 | Not applicable | No public exploit | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121244 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121243 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121242 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121241 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121240 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121239 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121238 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121237 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121236 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121235 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121234 | Critical | 2026-11-03 | Not applicable | No public exploit | Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121233 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121232 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
| CVE-2026-121231 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121230 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121229 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121228 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121227 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121226 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121225 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121224 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-121223 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121222 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121221 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121220 | High | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |