CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture Cross-Origin Information Disclosure. Safari Rot/Grün/Blau/Weiß Reparierte Version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Prinzip GPUDevice.importExternalTexturesource: HTMLVideoElement importiert ein Video als GPU-abtastba...

CVE-2025-55462

CVE-2025-55462 Zusammenfassung der Schwachstelle In Eramba Community- und Enterprise-Editionen v3.26.0 wurde eine Fehlkonfiguration von Cross-Origin Resource Sharing CORS festgestellt. Die Anwendung spiegelt vom Angreifer kontrollierte Origin-Header im Antwort-Header Access-Control-Allow-Origin d...

theftfuzzer

root@kitploit: ┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introduzione: TheftFuzzer è uno strumento che effettua fuzzing delle implementazioni Cross-Origin Resource Sharing alla ricerca di configurazioni errate comuni. Utilizzo: python...

live-server-evil-crawler

Live Server Evil Crawler Um site do GitHub Pages para demonstrar a vulnerabilidade da extensão Live Server do VSCode CVE-2025-65717. Visão Geral Esta ferramenta demonstra uma vulnerabilidade em que o Live Server permite requisições de qualquer origem, possibilitando que páginas web maliciosas...

cve-2020-16012

Questo repository contiene PoC per CVE-2020-16012, una vulnerabilità di canale laterale nell'implementazione di CanvasRenderingContext2D.drawImage in Firefox e Chromium. Leggi un articolo su questa vulnerabilità sul blog Mozilla Attack & Defense. All'interno di benchmark si trova il codice per...

dns-rebind-toolkit

مجموعة أدوات إعادة ربط DNS عرض توضيحي | إشعار أمني | الحمولات المضمنة | الأسئلة الشائعة إخلاء مسؤولية: هذا البرنامج لأغراض تعليمية فقط. لا ينبغي استخدام هذا البرنامج في أنشطة غير قانونية. المؤلف غير مسؤول عن استخدامه. لا تكن وغدًا. مجموعة أدوات إعادة ربط DNS هي إطار عمل JavaScript أمامي لتطوير...

CVE-2026-78896

CVE-2026-78896 is an information leak in the StorageAccessAPI component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit this flaw via a crafted HTML page to obtain cross-origin data . The Chromium project rates the security severity as Low . Remediation is to upd...

CVE-2026-79034

Google Chrome prior to 152.0.7977.65 is affected by an information leak in its CORS implementation. A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to leak cross-origin data . Chromium classified this vulnerability with a Medium security sever...

CVE-2026-78960

CVE-2026-78960 is an information leak in the Extensions component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering could obtain cross-origin data through a crafted Chrome extension. The vulnerability is rated Medium severity by Chromiu...

CVE-2026-78962

An uninitialized resource vulnerability in WebXR within Google Chrome prior to version 152.0.7977.65 allowed a remote attacker, leveraging social engineering , to potentially leak cross-origin data through a crafted HTML page. Chromium rated this as Medium severity. The fix is included in Chrome ...

CVE-2026-79252

CVE-2026-79252 is an information leak in the ServiceWorker component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit this via a crafted HTML page to obtain cross-origin data . Chromium rates the severity as Medium . The fix is included in Chrome 152.0....

CVE-2026-79258

CVE-2026-79258 is an incorrect authorization vulnerability in WebXR within Google Chrome prior to version 152.0.7977.65 . A remote attacker leveraging social engineering could use a crafted HTML page to obtain cross-origin data , bypassing expected origin restrictions. Chromium classifies the sev...

CVE-2026-79059

CVE-2026-79059 is an information leak in the BFCache (Back/Forward Cache) of Google Chrome prior to 152.0.7977.65 . A remote attacker who had compromised the renderer process could use a crafted HTML page to obtain cross-origin data , effectively bypassing the same-origin policy for data held in ...

CVE-2026-78949

Google Chrome on Android versions prior to 152.0.7977.65 contain a vulnerability in CustomTabs characterized by an observable discrepancy that allows a local attacker to obtain cross-origin data via a co-installed app. The Chromium project classifies the severity as Medium . Remediation is to upd...

CVE-2026-79146

An information leak in CustomTabs in Google Chrome on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app . Chromium assigned a Medium severity rating. The fix is available in version 152.0.7977.65 . No exploitation details are provided in th...

CVE-2026-79193

CVE-2026-79193 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this vulnerability by delivering a crafted HTML page that leaks cross-origin data . Chromium classified the severity as Medium . The fix is available in Chrome 152...

CVE-2026-79272

CVE-2026-79272 is an improper input validation flaw in the FindInPage component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can leak cross-origin data via a crafted HTML page. Chromium classifies the security severity as Medium . Th...

CVE-2026-78936

CVE-2026-78936 affects Google Chrome on Android prior to version 152.0.7977.65 . The vulnerability resides in the CustomTabs component, where an observable discrepancy could be leveraged by a local attacker to obtain cross-origin data through a co-installed app. The Chromium project classifies th...

CVE-2026-78955

CVE-2026-78955 is an observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 . The flaw allowed a remote attacker to potentially obtain cross-origin data by serving a crafted HTML page to the victim, enabling information leakage across origin boundaries. Chromium classif...

CVE-2026-79285

CVE-2026-79285 affects ANGLE in Google Chrome on Windows , prior to version 152.0.7977.65 . The root cause is an uninitialized resource , which allows a remote attacker to obtain cross-origin data by delivering a crafted HTML page. The Chromium project rated this as Medium severity. Users should ...