posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

GHunt

🌐 GHunt Online version : https://osint.industries 🐍 Now Python 3.13 compatible ! 😊 Description GHunt v2 is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible. Features : CLI usage and modules Python library...

ppfuzz

ppfuzz Prototype Pollution Fuzzer A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀 Installation Binary Source Dependencies Demonstration Usage Basic Options Usage Supporting Materials Contributing Attribution Acknowledments License Installation Binary Simply,...

scrying

NCC Group Scrying A new tool for collecting RDP, web and VNC screenshots all in one place This tool is still a work-in-progress and should be mostly usable but is not yet complete. Please file any bugs or feature requests as GitHub issues Motivation Since Eyewitness recently dropped support for R...

Sublist3r

About Sublist3r Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing,...

chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation

A flaw was found in Skia, a 2D graphics library, within Google Chrome. This vulnerability, stemming from improper state validation, allows a remote attacker to exploit it. By enticing a user to visit a specially crafted HTML page, the attacker can obtain sensitive cross-origin data...

chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia

A flaw was found in Skia, a 2D graphics library used in Google Chrome. This vulnerability, stemming from an uninitialized resource, allows a remote attacker to obtain sensitive cross-origin data. By crafting a malicious HTML page, an attacker can trick a user into visiting it, leading to the...

CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

CVE-2026-121257

Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-121255

Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121256

Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121254

Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121252

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121253

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121250

Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: High...

CVE-2026-121249

Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121251

Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121247

Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-121248

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-121246

Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...