CVE-2026-43735

CVE-2026-43735 WebKit 跨域信息泄露。Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null 原理 父页用 触发跨域 iframe 的片段导航时，iframe 收到的 NavigateEvent.sourceElement 是父页那个 元素，sourceElement.ownerDocument 就是父页的整个 Document。于是跨域 iframe 能读（querySelector....textContent）、能改（改 DOM / 改表单 action）、甚至注入 在父域执行...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture 跨域信息泄露。Safari 红/绿/蓝/白 修复版本 = 26.5.2: PATCHED importExternalTexture blocked: SecurityError 原理 GPUDevice.importExternalTexturesource: HTMLVideoElement 把视频导入成 GPU 可采样的 GPUExternalTexture。修复前没有对视频做 taintsOrigin 跨域检查，跨域且无 CORS 的 tainted 视频也能被导入，再用 WGS...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

DEBIAN-CVE-2026-87516

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74436

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87516

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87642

Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-53728

Medplum , a healthcare developer platform, is vulnerable to authorization code leakage in its external identity provider callback (GET /auth/external). The root cause is that getClientRedirectUri() accepts any redirect URI that prefix-matches a registered value (startsWith), rather than requiring...

Linux Distros Unpatched Vulnerability : CVE-2026-78949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-install...

Linux Distros Unpatched Vulnerability : CVE-2026-79272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak...

CVE-2026-78894

Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

firefox: thunderbird: Site isolation issue in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...

EUVD-2026-54136

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-19167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-17757

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17885

Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17959

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...