Overview 7,153 matches · 4 in Waratek scope · 1 protected · 18 exploited · 11 CISA KEV · 74 public PoC · 7 EPSS ≥ 0.5
7,153matches
4in Waratek scope0.1%
1protected0.0%
18exploited0.3%
11CISA KEV0.2%
74public PoC1.0%
7EPSS ≥ 0.50.1%
Protected by Waratek
1
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
0.0%
Outside Waratek scope
3
0.0%
Not applicable
7,146
99.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.0%
partly blocked
0
0.0%
not blocked
7,152
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 1,773 / year
20031
Not applicable1
Medium1
not blocked1
No public exploit1
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20057
Not applicable7
Medium7
not blocked7
No public exploit7
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20078
Not applicable8
Medium8
not blocked8
Working exploit published2
No public exploit6
20084
Not applicable4
Medium4
not blocked4
Working exploit published3
No public exploit1
200932
Not applicable32
Medium32
not blocked32
Working exploit published8
No public exploit24
201056
Not applicable56
Medium56
not blocked56
Working exploit published2
No public exploit54
2011170
Not applicable170
Medium170
not blocked170
Working exploit published4
Proof of concept only1
No public exploit165
2012151
Not applicable151
Medium151
not blocked151
Working exploit published5
Proof of concept only2
No public exploit144
201382
No exploit published1
Not applicable81
Medium82
not blocked82
Working exploit published1
No public exploit81
201441
Not applicable41
Medium41
not blocked41
Exploited1
Working exploit published2
No public exploit38
2015115
Not applicable115
Medium115
not blocked115
Forecast only1
No public exploit114
2016205
Outside Waratek scope1
Not applicable204
Medium205
not blocked205
Exploited1
Working exploit published3
Proof of concept only1
No public exploit200
2017276
Not applicable276
Medium276
not blocked276
Working exploit published2
Proof of concept only2
No public exploit272
2018185
Protected by Waratek1
Not applicable184
Medium185
blocked by ARMR today1
not blocked184
Exploited1
Working exploit published3
Proof of concept only2
No public exploit179
2019423
No exploit published1
Not applicable422
Medium423
not blocked423
Exploited3
Working exploit published2
Proof of concept only1
No public exploit417
2020535
No exploit published1
Outside Waratek scope1
Not applicable533
Medium535
not blocked535
Working exploit published3
Proof of concept only4
No public exploit528
2021548
Not applicable548
Medium548
not blocked548
Exploited6
Proof of concept only2
No public exploit540
2022818
Outside Waratek scope1
Not applicable817
Medium818
not blocked818
Exploited1
Proof of concept only62
No public exploit755
20231,118
Not applicable1,118
Medium1,118
not blocked1,118
Exploited1
Proof of concept only8
No public exploit1,109
2024329
Not applicable329
Medium329
not blocked329
Exploited2
Proof of concept only9
No public exploit318
2025273
Not applicable273
Medium273
not blocked273
Exploited2
Proof of concept only13
No public exploit258
20261,773
Not applicable1,773
Medium1,773
not blocked1,773
Proof of concept only18
No public exploit1,755
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-125345 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125342 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121255 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121254 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121253 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121248 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121245 | Medium | 2026-11-03 | Not applicable | No public exploit | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121244 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121243 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121242 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121240 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121239 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121237 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121235 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121232 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
| CVE-2026-121231 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121225 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121223 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121216 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121215 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121213 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121209 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121206 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121199 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium) |
| CVE-2026-121194 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium) |
| CVE-2026-121193 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121190 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121187 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121186 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121177 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121176 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121175 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121172 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121169 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121165 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121164 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121162 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121161 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121159 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121158 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121142 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121141 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121138 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121136 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121132 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121130 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121125 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121122 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121121 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121116 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121115 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121111 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121110 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121106 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. (Chromium security severity: Medium) |
| CVE-2026-121105 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121103 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121099 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121096 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) |
| CVE-2026-121093 | Medium | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121091 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121088 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121085 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121081 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121080 | Medium | 2026-11-03 | Not applicable | No public exploit | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121075 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121072 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121067 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121066 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121059 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121055 | Medium | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121053 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121051 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121046 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121045 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121043 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121042 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121041 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121039 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121038 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121033 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121031 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121029 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-120930 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-59048 | Medium | 2026-11-02 | Not applicable | No public exploit | In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59047 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59046 | Medium | 2026-11-02 | Not applicable | No public exploit | In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59031 | Medium | 2026-11-02 | Not applicable | No public exploit | In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59022 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59021 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59020 | Medium | 2026-11-02 | Not applicable | No public exploit | In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59015 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59012 | Medium | 2026-11-02 | Not applicable | No public exploit | In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59011 | Medium | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59010 | Medium | 2026-11-02 | Not applicable | No public exploit | In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59008 | Medium | 2026-11-02 | Not applicable | No public exploit | In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59007 | Medium | 2026-11-02 | Not applicable | No public exploit | In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59006 | Medium | 2026-11-02 | Not applicable | No public exploit | In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2026-59003 | Medium | 2026-11-02 | Not applicable | No public exploit | In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59002 | Medium | 2026-11-02 | Not applicable | No public exploit | In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59001 | Medium | 2026-11-02 | Not applicable | No public exploit | In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |