CVE-2026-87651

Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-87500

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-74503

Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-87554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-87542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

libaom:av1_enc_fuzzer: Heap-buffer-overflow in av1_calc_mb_wiener_var_row

Detailed Report: https://oss-fuzz.com/testcase?key=5683371750260736 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1encfuzzer Job Type: libfuzzerasanlibaom Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 2 Crash Address: 0x7e239e8618ea Crash State: av1calcmbwienervarrow...

PT-2026-88681

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue exists in the Payments component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

Android XR Bulletin—September 2026Stay organized with collectionsSave and categorize content based on your preferences.

The XR Security Bulletin contains details of security vulnerabilities affecting the XR platform. The full XR update comprises the security patch level of 2026-09-05 or later from the September 2026 Android Security Bulletin in addition to all issues in this bulletin. We encourage all customers to...

PT-2026-88600

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper validation of an array index in ANGLE allows a remote attacker to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. Recommendations Update...

Improper Authorization io.netty:netty-handler Dependency in Bitbucket Data Center

This High severity Improper Authorization vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

wasm3:fuzzer: Heap-buffer-overflow in m3_CallVL

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=6319953280827392 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerasanwasm3 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x77e5c33e00d0 Crash...

Linux Distros Unpatched Vulnerability : CVE-2026-85049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-84450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or heigh...

RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.12.1, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and...

CVE-2026-85043

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: High...

CVE-2026-85043

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: High...

EUVD-2026-70710

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85053

A high-severity Improper resource exposure vulnerability in the CacheStorage component of Google Chrome (prior to version 152.0.7977.82) allows a remote attacker to execute arbitrary code inside the sandbox using a crafted HTML page. This vulnerability also impacts Microsoft Edge (Chromium-based)...

CVE-2026-85048

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85043

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: High...