ROS-20260915-73-0177

The vulnerability of the XR web browsers Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-87527

A flaw was found in the WebGL component of Chromium-based browsers. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be triggered by a specially crafted HTML page, potentially leading to a complete compromise...

ROS-20260911-73-0037

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260911-73-0077

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability can allow a remote attacker to trigger a service failure through a specially created HTML page...

ROS-20260911-73-0079

The vulnerability of the Journeys web browsers Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260908-73-0101

The vulnerability of the WTF web browsers Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Update your browser: Security fix for Chrome zero-day CVE‑2026‑85046

News, Security Update your browser: Security fix for Chrome zero-day CVE‑2026‑85046 Share September 8th, 2026 Hi everyone! The latest patches to Opera’s browsers address several recent vulnerabilities, including a zero-day exploit CVE‑2026‑85046. We recommend updating your browsers to the latest...

Chromoting DoS

The vulnerability of the Chromoting component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to cause service interruptions...

Google Chrome Microsoft Edge Memory Use After Free DoS

The vulnerability in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-78958

An uninitialized resource flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497205529...

CVE-2026-78938

A flaw was found in the V8 JavaScript engine used in Chromium-based browsers. This type confusion vulnerability allows a remote attacker to execute unauthorized code within the browser's security sandbox by tricking a user into visiting a specially crafted web page. This could lead to a compromis...

CVE-2026-50290

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-50290

SpecifyJS (@asymmetric-effort/specifyjs), a declarative TypeScript UI framework, had a CSS sanitization bypass in its renderToString function (core/src/server/render-to-string.ts:307-311). Prior to v0.2.136 , the regex-based filter for expression( and url(javascript: could be circumvented using C...

EUVD-2026-64123

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-50290 @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-50290

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped "expression" and "urljavascript:" using simple regex, but could be bypassed with CSS unicode escapes "\65xpression", null bytes, or CSS comments "exp//ression". These CSS...

CVE-2026-50290: Improper Neutralization of Input During Web Page Generation

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-74956

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

ANGLE DoS

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Skia DoS

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...