CVE-2026-95296: Missing Authorization

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95289): chromium -- security fixes

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95312): chromium -- security fixes

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95317: Incorrect Authorization

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Medium...

PT-2026-102836

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-43735

CVE-2026-43735 Fuite d'informations inter-origines dans WebKit. Safari = 26.5.2 : PATCHED NavigateEvent.sourceElement is null Principe Lorsque la page parent utilise pour déclencher une navigation par fragment dans un iframe inter-origine, le NavigateEvent.sourceElement reçu par l'iframe est...

CVE-2023-43804

CVE-2023-43804: Воспроизведение утечки Cookie в urllib3 и лаборатория по устранению Репозиторий включает полностью контейнеризованную трёхуровневую лабораторную среду, предназначенную для демонстрации, эксплуатации и проверки исправлений для CVE-2023-43804 утечка Cookie в urllib3, возникающая при...

live-server-evil-crawler

Live Server Evil Crawler Сайт на GitHub Pages для демонстрации уязвимости расширения Live Server для VSCode CVE-2025-65717. Обзор Этот инструмент демонстрирует уязвимость, при которой Live Server разрешает запросы с любого источника, позволяя вредоносным веб-страницам получать доступ к Live Serve...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture fuite d'informations cross-origin. Safari rouge/vert/bleu/blanc Version corrigée = 26.5.2 : PATCHED importExternalTexture blocked: SecurityError Principe GPUDevice.importExternalTexturesource: HTMLVideoElement importe la vidéo en tant que...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

In WebXR in Google Chrome prior to version 152.0.7977.65, an uninitialized resource allowed a remote attacker to potentially leak cross-origin data through a crafted HTML page using social engineering. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Uninitialized use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

An observable discrepancy in SVG in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of uninitialized variables in Skia in Google Chrome prior to version 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Uninitialized use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-99613

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.57 Description Incorrect authorization in WebAPKs allows a local attacker to obtain cross-origin data through a co-installed application. Cross-origin data refers to information belonging t...

CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...