Overview 8,067 matches · 9 in Waratek scope · 1 protected · 90 exploited · 73 CISA KEV · 176 public PoC · 27 EPSS ≥ 0.5
8,067matches
9in Waratek scope0.1%
1protected0.0%
90exploited1.1%
73CISA KEV0.9%
176public PoC2.2%
27EPSS ≥ 0.50.3%
Protected by Waratek
1
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
8
0.1%
Outside Waratek scope
8
0.1%
Not applicable
8,050
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.0%
partly blocked
0
0.0%
not blocked
8,066
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 2,091 / year
20031
Not applicable1
High1
not blocked1
No public exploit1
20040
20051
Not applicable1
High1
not blocked1
Working exploit published1
20060
20074
Not applicable4
High4
not blocked4
Working exploit published2
No public exploit2
20082
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
200913
Not applicable13
High13
not blocked13
Working exploit published2
No public exploit11
201088
Not applicable88
High88
not blocked88
Exploited1
Working exploit published4
No public exploit83
2011125
Not applicable125
High125
not blocked125
Exploited3
No public exploit122
2012124
Not applicable124
High124
not blocked124
Working exploit published4
Proof of concept only1
No public exploit119
2013108
Not applicable108
High108
not blocked108
Exploited1
Working exploit published3
No public exploit104
2014114
Not applicable114
High114
not blocked114
Working exploit published4
Proof of concept only1
No public exploit109
2015197
Outside Waratek scope2
Not applicable195
High197
not blocked197
Exploited3
Working exploit published9
Proof of concept only4
Forecast only5
No public exploit176
2016425
Not applicable425
High425
not blocked425
Exploited3
Working exploit published6
Proof of concept only5
No public exploit411
2017611
Not applicable611
High611
not blocked611
Exploited4
Working exploit published6
Proof of concept only3
No public exploit598
2018527
Not applicable527
High527
not blocked527
Exploited4
Working exploit published11
Proof of concept only1
No public exploit511
2019407
Outside Waratek scope3
Not applicable404
High407
not blocked407
Exploited4
Working exploit published13
Proof of concept only2
No public exploit388
2020481
Outside Waratek scope1
Not applicable480
High481
not blocked481
Exploited6
Working exploit published1
Proof of concept only8
No public exploit466
2021584
No exploit published1
Not applicable583
High584
not blocked584
Exploited15
Working exploit published1
Proof of concept only5
No public exploit563
2022772
Protected by Waratek1
No exploit published5
Outside Waratek scope1
Not applicable765
High772
blocked by ARMR today1
not blocked771
Exploited12
Working exploit published1
Proof of concept only67
Forecast only1
No public exploit691
2023554
No exploit published1
Outside Waratek scope1
Not applicable552
High554
not blocked554
Exploited9
Proof of concept only10
Forecast only1
No public exploit534
2024476
No exploit published1
Not applicable475
High476
not blocked476
Exploited7
Proof of concept only33
No public exploit436
2025362
Not applicable362
High362
not blocked362
Exploited8
Proof of concept only10
No public exploit344
20262,091
Not applicable2,091
High2,091
not blocked2,091
Exploited10
Proof of concept only30
No public exploit2,051
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126883 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126881 | High | 2026-11-11 | Not applicable | No public exploit | Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126880 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126879 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126877 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126861 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126860 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126849 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126847 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126840 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125350 | High | 2026-11-10 | Not applicable | Exploited | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125348 | High | 2026-11-10 | Not applicable | No public exploit | Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125344 | High | 2026-11-10 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125343 | High | 2026-11-10 | Not applicable | No public exploit | Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121256 | High | 2026-11-03 | Not applicable | No public exploit | Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121252 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121251 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121238 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121236 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121233 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121230 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121228 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121227 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121226 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121224 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-121222 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121221 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121220 | High | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121219 | High | 2026-11-03 | Not applicable | No public exploit | Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121218 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121217 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121212 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121211 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121210 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121208 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121207 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121205 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121204 | High | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121203 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121201 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121198 | High | 2026-11-03 | Not applicable | No public exploit | Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121197 | High | 2026-11-03 | Not applicable | Proof of concept only | Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121196 | High | 2026-11-03 | Not applicable | No public exploit | Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121195 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121188 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121184 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121183 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121182 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121181 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121180 | High | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121179 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121178 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121174 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121173 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121171 | High | 2026-11-03 | Not applicable | No public exploit | Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121170 | High | 2026-11-03 | Not applicable | No public exploit | Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121168 | High | 2026-11-03 | Not applicable | No public exploit | Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121167 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121166 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) |
| CVE-2026-121163 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121160 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121143 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121140 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121137 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121135 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121134 | High | 2026-11-03 | Not applicable | No public exploit | Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121133 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-121129 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121128 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121127 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121124 | High | 2026-11-03 | Not applicable | No public exploit | Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121123 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121120 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121119 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121118 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121117 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121113 | High | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) |
| CVE-2026-121112 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121109 | High | 2026-11-03 | Not applicable | No public exploit | Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121108 | High | 2026-11-03 | Not applicable | No public exploit | Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121107 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121102 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121100 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121098 | High | 2026-11-03 | Not applicable | No public exploit | Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121097 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121095 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121094 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121092 | High | 2026-11-03 | Not applicable | No public exploit | Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121090 | High | 2026-11-03 | Not applicable | No public exploit | Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121087 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121084 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121083 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121082 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121079 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121078 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121070 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121069 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121068 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121065 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121064 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low) |