Overview 387 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
387matches
3in Waratek scope0.8%
1protected0.3%
0exploited0.0%
0CISA KEV0.0%
3public PoC0.8%
1EPSS ≥ 0.50.3%
Protected by Waratek
1
0.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
0.5%
Outside Waratek scope
1
0.3%
Not applicable
383
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.3%
partly blocked
0
0.0%
not blocked
386
99.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
0.3%
Proof of concept only
2
0.5%
Forecast only
0
0.0%
No public exploit
384
99.2%
split by
peak 167 / year
20021
Not applicable1
Low1
not blocked1
Working exploit published1
20030
20040
20050
20060
20070
20080
20091
Not applicable1
Low1
not blocked1
No public exploit1
20101
Not applicable1
Low1
not blocked1
No public exploit1
20112
Not applicable2
Low2
not blocked2
No public exploit2
20124
Not applicable4
Low4
not blocked4
Proof of concept only1
No public exploit3
20132
Not applicable2
Low2
not blocked2
No public exploit2
20142
Not applicable2
Low2
not blocked2
No public exploit2
20152
Outside Waratek scope1
Not applicable1
Low2
not blocked2
Proof of concept only1
No public exploit1
20166
Not applicable6
Low6
not blocked6
No public exploit6
20177
Protected by Waratek1
Not applicable6
Low7
blocked by ARMR today1
not blocked6
No public exploit7
20185
Not applicable5
Low5
not blocked5
No public exploit5
201912
Not applicable12
Low12
not blocked12
No public exploit12
202034
No exploit published2
Not applicable32
Low34
not blocked34
No public exploit34
202126
Not applicable26
Low26
not blocked26
No public exploit26
202281
Not applicable81
Low81
not blocked81
No public exploit81
202320
Not applicable20
Low20
not blocked20
No public exploit20
20248
Not applicable8
Low8
not blocked8
No public exploit8
20256
Not applicable6
Low6
not blocked6
No public exploit6
2026167
Not applicable167
Low167
not blocked167
No public exploit167
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-125349 | Low | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121049 | Low | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file. (Chromium security severity: Medium) |
| CVE-2026-58926 | Low | 2026-11-02 | Not applicable | No public exploit | A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process. |
| CVE-2026-110141 | Low | 2026-10-13 | Not applicable | No public exploit | Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-106399 | Low | 2026-10-06 | Not applicable | No public exploit | Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low) |
| CVE-2026-106339 | Low | 2026-10-06 | Not applicable | No public exploit | Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-106224 | Low | 2026-10-06 | Not applicable | No public exploit | Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-106210 | Low | 2026-10-06 | Not applicable | No public exploit | Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-106180 | Low | 2026-10-06 | Not applicable | No public exploit | Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-58856 | Low | 2026-10-05 | Not applicable | No public exploit | In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-95359 | Low | 2026-09-29 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-95324 | Low | 2026-09-29 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-95317 | Low | 2026-09-29 | Not applicable | No public exploit | Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-95316 | Low | 2026-09-29 | Not applicable | No public exploit | Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low) |
| CVE-2026-95312 | Low | 2026-09-29 | Not applicable | No public exploit | Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-95308 | Low | 2026-09-29 | Not applicable | No public exploit | Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-95302 | Low | 2026-09-29 | Not applicable | No public exploit | Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium) |
| CVE-2026-102319 | Low | 2026-09-29 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-102315 | Low | 2026-09-29 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-102311 | Low | 2026-09-29 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-93384 | Low | 2026-09-17 | Not applicable | No public exploit | Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-93380 | Low | 2026-09-17 | Not applicable | No public exploit | Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-93378 | Low | 2026-09-17 | Not applicable | No public exploit | Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium) |
| CVE-2026-91747 | Low | 2026-09-15 | Not applicable | No public exploit | Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-91730 | Low | 2026-09-15 | Not applicable | No public exploit | Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-91708 | Low | 2026-09-15 | Not applicable | No public exploit | Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-87657 | Low | 2026-09-09 | Not applicable | No public exploit | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87652 | Low | 2026-09-09 | Not applicable | No public exploit | Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87647 | Low | 2026-09-09 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-87614 | Low | 2026-09-09 | Not applicable | No public exploit | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-87611 | Low | 2026-09-09 | Not applicable | No public exploit | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87576 | Low | 2026-09-09 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87539 | Low | 2026-09-09 | Not applicable | No public exploit | Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87531 | Low | 2026-09-09 | Not applicable | No public exploit | Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87525 | Low | 2026-09-09 | Not applicable | No public exploit | Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program. (Chromium security severity: High) |
| CVE-2026-87521 | Low | 2026-09-09 | Not applicable | No public exploit | Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87517 | Low | 2026-09-09 | Not applicable | No public exploit | Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-87498 | Low | 2026-09-09 | Not applicable | No public exploit | Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-87485 | Low | 2026-09-09 | Not applicable | No public exploit | Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87456 | Low | 2026-09-09 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87452 | Low | 2026-09-09 | Not applicable | No public exploit | Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87451 | Low | 2026-09-09 | Not applicable | No public exploit | Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87442 | Low | 2026-09-09 | Not applicable | No public exploit | Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-87434 | Low | 2026-09-09 | Not applicable | No public exploit | Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-55290 | Low | 2026-09-08 | Not applicable | No public exploit | In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-49895 | Low | 2026-09-08 | Not applicable | No public exploit | In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45525 | Low | 2026-09-08 | Not applicable | No public exploit | In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45521 | Low | 2026-09-08 | Not applicable | No public exploit | In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-45519 | Low | 2026-09-08 | Not applicable | No public exploit | In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28671 | Low | 2026-09-08 | Not applicable | No public exploit | In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28660 | Low | 2026-09-08 | Not applicable | No public exploit | In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28652 | Low | 2026-09-08 | Not applicable | No public exploit | In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28638 | Low | 2026-09-08 | Not applicable | No public exploit | In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28630 | Low | 2026-09-08 | Not applicable | No public exploit | In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28623 | Low | 2026-09-08 | Not applicable | No public exploit | In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28622 | Low | 2026-09-08 | Not applicable | No public exploit | In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28582 | Low | 2026-09-08 | Not applicable | No public exploit | In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0054 | Low | 2026-09-08 | Not applicable | No public exploit | In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-85052 | Low | 2026-09-03 | Not applicable | No public exploit | Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-84359 | Low | 2026-09-02 | Not applicable | No public exploit | Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-84355 | Low | 2026-09-02 | Not applicable | No public exploit | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-84331 | Low | 2026-09-02 | Not applicable | No public exploit | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-84328 | Low | 2026-09-02 | Not applicable | No public exploit | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79289 | Low | 2026-08-25 | Not applicable | No public exploit | Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-79272 | Low | 2026-08-25 | Not applicable | No public exploit | Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79255 | Low | 2026-08-25 | Not applicable | No public exploit | Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79228 | Low | 2026-08-25 | Not applicable | No public exploit | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79203 | Low | 2026-08-25 | Not applicable | No public exploit | Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79191 | Low | 2026-08-25 | Not applicable | No public exploit | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79186 | Low | 2026-08-25 | Not applicable | No public exploit | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79103 | Low | 2026-08-25 | Not applicable | No public exploit | Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79066 | Low | 2026-08-25 | Not applicable | No public exploit | Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79059 | Low | 2026-08-25 | Not applicable | No public exploit | Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79053 | Low | 2026-08-25 | Not applicable | No public exploit | Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79034 | Low | 2026-08-25 | Not applicable | No public exploit | Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79031 | Low | 2026-08-25 | Not applicable | No public exploit | Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79007 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79004 | Low | 2026-08-25 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-79002 | Low | 2026-08-25 | Not applicable | No public exploit | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78986 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-78984 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78958 | Low | 2026-08-25 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78953 | Low | 2026-08-25 | Not applicable | No public exploit | Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium) |
| CVE-2026-78949 | Low | 2026-08-25 | Not applicable | No public exploit | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium) |
| CVE-2026-78943 | Low | 2026-08-25 | Not applicable | No public exploit | Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78941 | Low | 2026-08-25 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78936 | Low | 2026-08-25 | Not applicable | No public exploit | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium) |
| CVE-2026-78903 | Low | 2026-08-25 | Not applicable | No public exploit | Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-78894 | Low | 2026-08-25 | Not applicable | No public exploit | Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-76042 | Low | 2026-08-18 | Not applicable | No public exploit | Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-19167 | Low | 2026-08-06 | Not applicable | No public exploit | Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-19161 | Low | 2026-08-06 | Not applicable | No public exploit | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-19160 | Low | 2026-08-06 | Not applicable | No public exploit | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-18011 | Low | 2026-07-30 | Not applicable | No public exploit | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Low) |
| CVE-2026-18000 | Low | 2026-07-30 | Not applicable | No public exploit | Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-17997 | Low | 2026-07-30 | Not applicable | No public exploit | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-17984 | Low | 2026-07-30 | Not applicable | No public exploit | Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-17980 | Low | 2026-07-30 | Not applicable | No public exploit | Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-17957 | Low | 2026-07-30 | Not applicable | No public exploit | Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-17902 | Low | 2026-07-30 | Not applicable | No public exploit | Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |