Astra Linux – Vulnerability in Firefox and Thunderbird

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor might be drawn over the browser UI, potentially causing confusion for users or leading to spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Chromium

The use of after-free in CSS in Google Chrome before version 145.0.7632.75 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the CSS of Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Ruby-Nokogiri

A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...

Astra Linux – Vulnerability in Chromium

Using “after free” in CSS in Google Chrome before version 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In Google Chrome, memory access out of bounds in CSS before version 116.0.5845.110 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in libcroco

The crtknzrparsecomment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service memory allocation error through a crafted CSS file...

ROS-20260914-73-0028

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0242

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to manipulate data integrity through a specially crafted HTML page...

ROS-20260911-73-0240

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...

ROS-20260911-73-0241

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to manipulate data integrity through a specially crafted HTML page...

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

GHSA-X7M8-JRM8-HPVX @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

SUSE CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-95998

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

ROS-20260910-73-0039

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and compromise its integrity through a specially...

ROS-20260910-73-0118

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to improper protection against attacks through external physical channels. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260910-73-0059

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260910-73-0113

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...