CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93386

Google Chrome versions prior to 153.0.8010.52 are vulnerable to a UI misrepresentation in the WebAppInstalls component. A remote attacker can leverage social engineering to spoof UI elements by tricking a user into visiting a crafted HTML page. This issue has been addressed in version 153.0.8010....

EUVD-2026-82489

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-82486

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93383

Google Chrome versions prior to 153.0.8010.52 are vulnerable to an information leak in the Permissions component. This flaw allows a remote attacker to leak cross-origin data by interacting with a crafted HTML page. The vulnerability has been addressed in version 153.0.8010.52 (boo#1281123). Whil...

CVE-2026-93383

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93377

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-93387

A remote attacker can exploit improper state validation in the Skia component of Google Chrome (prior to version 153.0.8010.52) to obtain cross-origin data via a crafted HTML page. This vulnerability has been addressed in Chromium 153.0.8010.52 and corresponding distribution packages, such as 153...

CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-93379

Google Chrome versions prior to 153.0.8010.52 are vulnerable to CVE-2026-93379 due to an incorrect authorization in ORB . This flaw allows a remote attacker to bypass site isolation by serving a crafted HTML page. Security advisories for openSUSE, Fedora, and Debian indicate that the update to ve...

CVE-2026-93379

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93379

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-93382

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-93382

A Use after free vulnerability exists in the PDFium component of Google Chrome (prior to version 153.0.8010.52). This flaw allows a remote attacker to execute arbitrary code inside the sandbox by navigating to a crafted HTML page . Impacted systems include Fedora 44 , openSUSE Backports SLE-15-SP...

CVE-2026-93374

A use after free vulnerability exists in Dawn within the Google Chrome browser on Android (prior to version 153.0.8010.52 ). A remote attacker could potentially execute arbitrary code outside the sandbox by serving a crafted HTML page to the victim. This issue has been addressed in the 153.0.8010...

CVE-2026-93374

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

@platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

GHSA-QRFJ-MGW8-J9C6 @platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...