cve-2026-40369-exploit

Aquí se hace referencia a https://voidsec.com/cve-2026-40369-browser-sandbox-escape/, el enfoque difiere considerablemente del de https://github.com/orinimron123/CVE-2026-40369-EXPLOIT, y como no he visto que hayan publicado un exploit, lo he documentado...

PT-2026-91217

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XML documents rather than passive bitmap images. While scripts inside SVG do not execute when the SVG is rendered through a normal , they can execute when the S...

CVE-2026-87630

A flaw was found in WebRTC in Chromium-browser. A remote attacker could exploit an integer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory within the browser's sandbox environment...

ROS-20260908-73-0084

The vulnerability of Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the browser’s sandbox through the created HTML page...

ROS-20260907-73-0017

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within the browser’s sandbox through the created...

CVE-2026-85053

A flaw was found in Google Chrome's CacheStorage component. This improper resource exposure vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a compromise of the user's system...

CVE-2026-85046

A flaw was found in V8, the JavaScript engine in Google Chrome. This type confusion vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a compromise of the user's system...

CVE-2026-84347

An use after free flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501679156...

CVE-2026-82072

An out of bounds read flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=534416978 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-79263

A flaw was found in Extensions in Google Chrome. This race condition vulnerability allows a remote attacker to execute arbitrary code. The attacker can achieve this by sending specially crafted network traffic, leading to code execution within the browser's security sandbox...

CVE-2026-78956

A flaw was found in Chromium's V8 JavaScript engine. This type confusion vulnerability could allow a remote attacker, through social engineering, to execute arbitrary code within the browser's sandbox by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized...

CVE-2026-78934

A flaw was found in Google Chrome's ReadAloud component. A race condition vulnerability allows a remote attacker, by leveraging social engineering and a crafted HTML page, to execute arbitrary code within the browser's sandbox. This could lead to unauthorized access or control over the affected...

CVE-2026-76020

A race condition flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=541837151...

CVE-2026-76047

A flaw was found in chromium-browser. A remote attacker could exploit a type confusion vulnerability in the V8 JavaScript engine by enticing a user to visit a specially crafted HTML page. This could allow the attacker to execute arbitrary code within the browser's sandbox, potentially compromisin...

CVE-2026-19558

A flaw was found in Google Chrome Extensions. This use-after-free vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user is convinced to install a specially crafted malicious extension...

CVE-2026-19168

A flaw was found in V8 in Google Chrome. An inappropriate implementation allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to unauthorized code execution...

CVE-2026-19174

A flaw was found in V8, the JavaScript engine used in Google Chrome. This integer overflow vulnerability allows a remote attacker to execute arbitrary code within the browser's security sandbox—a protective environment that limits what a program can do. This can occur when a user visits a special...

CVE-2026-19150

A flaw was found in V8, the JavaScript engine used in Google Chrome. An inappropriate implementation vulnerability allowed a remote attacker to execute arbitrary code within the browser's sandbox. This could be achieved by enticing a user to visit a specially crafted HTML page. The primary impact...

ROS-20260720-73-0064

The vulnerability of the MediaRecording component in Google Chrome browser relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code within the browser’s sandbox, using a specially created HTML page...

CVE-2026-61613 Cursor: Cloud Agent Browser Sandbox Escape

Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker-controlled web content to connect from inside the agent container to an unauthenticated local agent endpoint, enabling code execution...