CVE-2026-87537: Missing Authorization

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-87533: Use After Free

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87530: Uncontrolled Search Path Element

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87528: Access of Resource Using Incompatible Type

Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87509: Incorrect Authorization

Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Low...

CVE-2026-87479: Reliance on Untrusted Inputs in a Security Decision

Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity:...

CVE-2026-87470: Improper Validation of Specified Quantity in Input

Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87467: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-87464: Use After Free

Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-87457: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

CVE-2026-87444: Improper Restriction of Operations within the Bounds of a Memory Buffer

Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87440: Out-of-bounds Read

Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-87430: Heap-based Buffer Overflow

Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-36433

Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 contains a vulnerability allowing a physically proximate attacker to execute arbitrary code . The flaw exists within the Production.dll and RdiskUpgrade.exe components, which form the company's firmware update toolkit. The root cau...

ALSA-2026:65887 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...

EUVD-2026-75133

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmxprocess function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6...

PT-2026-89137

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx process function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6...

PT-2026-89144

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media tools/dvb mpe.c, descriptorTime slice fec identifier and gf m2ts ipdatagram reader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

CVE-2026-71612: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmxprocess function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6...

CVE-2026-71614: Improper Control of Generation of Code

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier and gfm2tsipdatagramreader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...