Overview 16,900 matches · 0 in Waratek scope · 0 protected · 120 exploited · 97 CISA KEV · 268 public PoC · 34 EPSS ≥ 0.5
16,900matches
0in Waratek scope0.0%
0protected0.0%
120exploited0.7%
97CISA KEV0.6%
268public PoC1.6%
34EPSS ≥ 0.50.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
16,900
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
16,900
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 4,540 / year
20021
Not applicable1
Low1
not blocked1
Working exploit published1
20032
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20058
Not applicable8
High1
Medium7
not blocked8
Working exploit published1
No public exploit7
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
200712
Not applicable12
High4
Medium8
not blocked12
Working exploit published4
No public exploit8
20086
Not applicable6
High2
Medium4
not blocked6
Working exploit published4
No public exploit2
200946
Not applicable46
High13
Medium32
Low1
not blocked46
Working exploit published10
No public exploit36
2010157
Not applicable157
Critical12
High88
Medium56
Low1
not blocked157
Exploited1
Working exploit published7
No public exploit149
2011297
Not applicable297
High125
Medium170
Low2
not blocked297
Exploited3
Working exploit published4
Proof of concept only1
No public exploit289
2012280
Not applicable280
Critical1
High124
Medium151
Low4
not blocked280
Working exploit published9
Proof of concept only4
No public exploit267
2013191
Not applicable191
High108
Medium81
Low2
not blocked191
Exploited1
Working exploit published4
No public exploit186
2014158
Not applicable158
Critical1
High114
Medium41
Low2
not blocked158
Exploited2
Working exploit published6
Proof of concept only1
No public exploit149
2015314
Not applicable314
Critical3
High195
Medium115
Low1
not blocked314
Exploited3
Working exploit published9
Proof of concept only4
Forecast only6
No public exploit292
2016699
Not applicable699
Critical64
High425
Medium204
Low6
not blocked699
Exploited4
Working exploit published11
Proof of concept only6
Forecast only1
No public exploit677
20171,005
Not applicable1,005
Critical112
High611
Medium276
Low6
not blocked1,005
Exploited4
Working exploit published8
Proof of concept only6
No public exploit987
2018795
Not applicable795
Critical79
High527
Medium184
Low5
not blocked795
Exploited5
Working exploit published14
Proof of concept only3
No public exploit773
2019871
Not applicable871
Critical33
High404
Medium422
Low12
not blocked871
Exploited5
Working exploit published15
Proof of concept only3
No public exploit848
20201,239
Not applicable1,239
Critical194
High480
Medium533
Low32
not blocked1,239
Exploited8
Working exploit published6
Proof of concept only14
No public exploit1,211
20211,219
Not applicable1,219
Critical62
High583
Medium548
Low26
not blocked1,219
Exploited24
Working exploit published1
Proof of concept only7
No public exploit1,187
20221,763
Not applicable1,763
Critical100
High765
Medium817
Low81
not blocked1,763
Exploited15
Working exploit published1
Proof of concept only133
Forecast only1
No public exploit1,613
20231,750
Not applicable1,750
Critical60
High552
Medium1,118
Low20
not blocked1,750
Exploited11
Proof of concept only20
Forecast only1
No public exploit1,718
2024879
Not applicable879
Critical67
High475
Medium329
Low8
not blocked879
Exploited13
Proof of concept only45
No public exploit821
2025665
Not applicable665
Critical24
High362
Medium273
Low6
not blocked665
Exploited11
Proof of concept only24
No public exploit630
20264,540
Not applicable4,540
Critical509
High2,091
Medium1,773
Low167
not blocked4,540
Exploited10
Proof of concept only51
No public exploit4,479
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126883 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126881 | High | 2026-11-11 | Not applicable | No public exploit | Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126880 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126879 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-126877 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126861 | High | 2026-11-11 | Not applicable | No public exploit | Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126860 | High | 2026-11-11 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126859 | Critical | 2026-11-11 | Not applicable | No public exploit | Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126849 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126847 | High | 2026-11-11 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-126840 | High | 2026-11-11 | Not applicable | No public exploit | Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125350 | High | 2026-11-10 | Not applicable | Exploited | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125349 | Low | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-125348 | High | 2026-11-10 | Not applicable | No public exploit | Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125347 | Critical | 2026-11-10 | Not applicable | No public exploit | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125345 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125344 | High | 2026-11-10 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125343 | High | 2026-11-10 | Not applicable | No public exploit | Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-125342 | Medium | 2026-11-10 | Not applicable | No public exploit | Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121257 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121256 | High | 2026-11-03 | Not applicable | No public exploit | Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121255 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121254 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121253 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121252 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121251 | High | 2026-11-03 | Not applicable | No public exploit | Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121250 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121249 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121248 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121247 | Critical | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121246 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121245 | Medium | 2026-11-03 | Not applicable | No public exploit | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121244 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121243 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121242 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) |
| CVE-2026-121241 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121240 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121239 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121238 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121237 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121236 | High | 2026-11-03 | Not applicable | No public exploit | Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121235 | Medium | 2026-11-03 | Not applicable | No public exploit | Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121234 | Critical | 2026-11-03 | Not applicable | No public exploit | Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121233 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121232 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
| CVE-2026-121231 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121230 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121229 | Critical | 2026-11-03 | Not applicable | No public exploit | Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121228 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121227 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121226 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121225 | Medium | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121224 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-121223 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121222 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121221 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121220 | High | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121219 | High | 2026-11-03 | Not applicable | No public exploit | Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121218 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121217 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low) |
| CVE-2026-121216 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121215 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121214 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121213 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121212 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121211 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) |
| CVE-2026-121210 | High | 2026-11-03 | Not applicable | No public exploit | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121209 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121208 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121207 | High | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121206 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121205 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121204 | High | 2026-11-03 | Not applicable | No public exploit | Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121203 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2026-121202 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121201 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121200 | Critical | 2026-11-03 | Not applicable | No public exploit | Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121199 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium) |
| CVE-2026-121198 | High | 2026-11-03 | Not applicable | No public exploit | Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121197 | High | 2026-11-03 | Not applicable | Proof of concept only | Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121196 | High | 2026-11-03 | Not applicable | No public exploit | Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121195 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121194 | Medium | 2026-11-03 | Not applicable | No public exploit | Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium) |
| CVE-2026-121193 | Medium | 2026-11-03 | Not applicable | Proof of concept only | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) |
| CVE-2026-121190 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Low) |
| CVE-2026-121189 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121188 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121187 | Medium | 2026-11-03 | Not applicable | No public exploit | Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121186 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121185 | Critical | 2026-11-03 | Not applicable | No public exploit | Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121184 | High | 2026-11-03 | Not applicable | No public exploit | Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121183 | High | 2026-11-03 | Not applicable | No public exploit | Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121182 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121181 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121180 | High | 2026-11-03 | Not applicable | No public exploit | Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121179 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121178 | High | 2026-11-03 | Not applicable | No public exploit | Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-121177 | Medium | 2026-11-03 | Not applicable | No public exploit | UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121176 | Medium | 2026-11-03 | Not applicable | No public exploit | Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-121175 | Medium | 2026-11-03 | Not applicable | No public exploit | Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |