CVE-2026-91725

An observable discrepancy in CSS within Google Chrome (prior to version 153.0.8010.47) allows a remote attacker to leak sensitive information via a crafted HTML page. This vulnerability is addressed in Microsoft Edge as it ingests Chromium updates. Remediation includes updating to version 153.0.8...

Chromium CVE-2026-87550: Improper encoding or escaping of output in CSS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-91725: Observable Discrepancy

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

ROS-20260915-73-0105

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

ROS-20260915-73-0008

The vulnerability of the CSS components in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0007

The vulnerability of the CSS components in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0032

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a...

ROS-20260915-73-0172

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and compromise its integrity through a specially...

ROS-20260915-73-0014

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

PT-2026-93143

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description An observable discrepancy in CSS allows a remote attacker to leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to version...

CVE-2026-18119

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...

OESA-2026-3762 python-soupsieve security update

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. It aims to provide selecting, matching, and filtering using modern CSS selectors. Soup Sieve currently provides selectors from the CSS level 1 specifications up through the latest CSS level 4 drafts and beyond though...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in CSS in Google Chrome before version 147.0.7727.101 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Golang-1.19

Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates that contain multiple actions separated by a '/' character may cause the CSS context to close unexpectedly, allowing for the injection of unexpected HTML, if executed with untrusted input...

Astra Linux – Vulnerability in Chromium

The use of “after free” in CSS in Google Chrome before version 127.0.6533.72 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox and Thunderbird

Applying a CSS filter effect could have access to out-of-bound memory. This could lead to a heap-buffer-overflow, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

Astra Linux – Vulnerability in libcroco

The crparserparseselectorcore function in cr-parser.c within libcroco 0.6.12 allows remote attackers to cause a denial of service infinite loop and CPU consumption through a crafted CSS file...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor might be drawn over the browser UI, potentially causing confusion for users or leading to spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...