CVE-2026-79016

CVE-2026-79016 is an observable discrepancy in the SVG component of Google Chrome prior to version 152.0.7977.65 , allowing a remote attacker to obtain cross-origin data by persuading a user to visit a crafted HTML page . The CVSS 3.1 score is 4.3 (Medium) , with user interaction required and low...

CVE-2026-79016

Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78958

Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78958

CVE-2026-78958 is an uninitialized resource vulnerability in Skia , the 2D graphics library used by Google Chrome (prior to 152.0.7977.65 ) and Microsoft Edge (prior to 152.0.4191.53 ). A remote attacker who had already compromised the renderer process could use a crafted HTML page to obtain cros...

CVE-2026-78958

Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79274

Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-79274

Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-79274

CVE-2026-79274 is an information leak in the GPU component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit it by serving a crafted HTML page that triggers cross-origin data exposure, allowing the attacker to obtain sensitive data from other origins. The vulnerabili...

CVE-2026-79118

CVE-2026-79118 is an uninitialized resource vulnerability in the ANGLE component of Google Chrome (prior to 152.0.7977.65 ) and Microsoft Edge (prior to 152.0.4191.53 ). A remote attacker can exploit it by enticing a user to visit a crafted HTML page, leading to the disclosure of cross-origin dat...

CVE-2026-79118

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-79118

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-78965

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-78965

CVE-2026-78965 is an uninitialized resource flaw in ANGLE , Chromium's graphics rendering layer, present in Google Chrome prior to 152.0.7977.65 and Microsoft Edge (Chromium) prior to 152.0.4191.53 . A remote attacker can exploit it via a crafted HTML page to obtain cross-origin data . Chromium r...

CVE-2026-78965

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-78986

CVE-2026-78986 is an uninitialized resource in the GPU subsystem of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially obtain cross-origin data via a crafted HTML page. Chromium rates it High severity, while the CNA-...

CVE-2026-78986

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-65773

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-78986

Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-55553

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, requestInternal recursively calls...

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

Summary urllib supports redirect-following through followRedirect, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a different origin, urllib preserves the caller-supplied request headers verbatim, including credential-bearing headers such as...