CVE-2026-43735

CVE-2026-43735 WebKit クロスオリジン情報漏洩。Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null 原理 親ページが を使用してクロスオリジン iframe のフラグメントナビゲーションをトリガーすると、iframe が受信する NavigateEvent.sourceElement は親ページの 要素であり、sourceElement.ownerDocument は親ページの Document 全体になります。その結果、クロスオリジン iframe...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_8607)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258607 advisory. firefox: thunderbird: Out-of-bounds access when resolving Promise objects CVE-2025-4918 firefox: thunderbird: Out-of-bounds access when optimizing linear...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

DEBIAN-CVE-2026-87516

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74436

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87516

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87642

Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-53728

Medplum , a healthcare developer platform, is vulnerable to authorization code leakage in its external identity provider callback (GET /auth/external). The root cause is that getClientRedirectUri() accepts any redirect URI that prefix-matches a registered value (startsWith), rather than requiring...

Linux Distros Unpatched Vulnerability : CVE-2026-78949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-install...

Linux Distros Unpatched Vulnerability : CVE-2026-79272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak...

CVE-2026-78894

A race condition in the Payments component of Google Chrome (prior to version 152.0.7977.65 ) allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The vulnerability is associated with Chromium and has been addressed in various distri...

firefox: thunderbird: Site isolation issue in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...

EUVD-2026-54136

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-19167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-17757

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17885

Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17959

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...