PT-2026-93126

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A race condition in the Network component allows a remote attacker who has already compromised the renderer process to obtain cross-origin data by using a specially crafted HTML page. A...

PT-2026-93148

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Incomplete cleanup in the GetUserMedia function allows a remote attacker to obtain cross-origin data. This occurs when an attacker has already compromised the renderer process and uses...

PT-2026-93164

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description An integer overflow in the Compositing component allows a remote attacker to obtain cross-origin data by inducing a user to visit a crafted HTML page. Cross-origin data access occurs wh...

PT-2026-93165

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A use after free issue in Skia allows a remote attacker who has compromised the renderer process to obtain cross-origin data through a crafted HTML page. Use after free is a memory...

PT-2026-93158

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description An uninitialized resource in Skia allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Skia is a 2D graphics library used for rendering text and images...

CVE-2026-91746: Integer Overflow or Wraparound

Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91740: Use of Uninitialized Resource

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91730: Incomplete Cleanup

Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-91708: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91747: Use After Free

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-81925: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-82438

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

EUVD-2026-77514

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438

This vulnerability exists in Apache Storm 's HTTP components, where three distinct mechanisms allowed web pages from unrelated origins to access authenticated user responses. Specifically, the Logviewer reflected the Origin header in Access-Control-Allow-Origin while sending Access-Control-Allow-...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

Astra Linux – Vulnerability in Firefox and Thunderbird

A race condition could allow a cross-origin container to obtain permissions from the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

Astra Linux – Vulnerability in Firefox and Thunderbird

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to perform certain UI gestures to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of the File Picker in Google Chrome prior to version 139.0.7258.127 allowed a remote attacker who convinced a user to perform certain UI gestures to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...