CVE-2026-13822

CVE-2026-13822 affects Google Chrome on Android prior to version 150.0.7871.47. The issue is an inappropriate implementation in Chrome Extensions that lets an attacker who persuades a user to install a malicious extension bypass the same-origin policy via a crafted Chrome Extension. Impact is des...

CVE-2026-13816

Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-13816

CVE-2026-13816 affects Google Chrome on Android prior to 150.0.7871.47, due to insufficient validation of untrusted input in the File Input component. This vulnerability can allow a remote attacker to leak cross-origin data via a crafted HTML page. The connected documents confirm the same descrip...

CVE-2026-13816

Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-13816

Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-13788

Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-13788

CVE-2026-13788 is a Use-After-Free in the Fullscreen handling of Google Chrome on Android, allowing remote code execution via a crafted HTML page. Affected software: Google Chrome for Android prior to version 150.0.7871.47 (Chromium-based). Root cause: use-after-free in Fullscreen. Impact: remote...

CVE-2026-13788

Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: Critical...

RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS

A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin's XLab have tracked it since February 2026, and say the...

PT-2026-54133

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the Speech component allows a remote attacker who has already compromised the renderer process to perform privilege escalation b...

PT-2026-54143

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An improper input implementation allows a remote attacker who has already compromised the renderer process to bypass site isolation by using a specially crafted HTML page. Si...

PT-2026-54204

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the UI allows a local attacker to perform privilege escalation by using a malicious file. Recommendations Update Google Chrome o...

PT-2026-54230

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient policy enforcement in XML allows a remote attacker to obtain potentially sensitive information from process memory by inducing the user to visit a crafted HTML...

PT-2026-54389

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the WebAppInstalls component allows a local attacker to perform UI spoofing by using a malicious file. UI spoofing is a technique where an...

PT-2026-54309

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in WebXR allows a remote attacker to bypass navigation restrictions by using a crafted HTML page. Recommendations Update Google Chrome on...

PT-2026-54187

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient policy enforcement in WebXR allows a remote attacker to leak cross-origin data through a crafted HTML page. WebXR is an API that enables the creation of virtual...

PT-2026-54355

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in the TabSwitcher component allows a remote attacker to bypass navigation restrictions through the use of malicious network traffi...

PT-2026-54281

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description A use after free issue exists in the Omnibox, where a remote attacker could potentially exploit heap corruption through a crafted HTML page. This requires the attacker to...

PT-2026-54065

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description A use after free issue exists in the Fullscreen component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption....

PT-2026-54099

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the Extensions component allows an attacker to bypass the same origin policy—a security mechanism that restricts how a document or script...