CVE-2026-113244

A flaw was found in chromium-browser. Due to improper input validation in the user interface UI, a remote attacker could execute arbitrary code within the restricted browser sandbox by convincing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to run...

CVE-2026-113213

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser sandbox by tricking a user into loading a specially crafted HTML page. This vulnerability is caused by memory corruption within the DevTools component when processing untrusted web content...

CVE-2026-113162

A flaw was found in chromium-browser. Due to improper input validation in the Actor component, a remote attacker can potentially execute arbitrary code within the browser's restricted sandbox environment by convincing a user to view a specially crafted HTML page...

CVE-2026-113145

A flaw was found in Google Chrome's Messages component on Android. A remote attacker could exploit this memory corruption vulnerability by convincing a user to open a crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code within the browser's restricted...

CVE-2026-113093

A flaw was found in the DisplayLocking component of chromium-browser. This memory corruption vulnerability allows a remote attacker to potentially achieve arbitrary code execution within the browser's restricted security sandbox. Exploitation requires convincing a user to open a specially crafted...

CVE-2026-113086

A flaw was found in Google Chrome's Input component. This vulnerability allows a remote attacker to execute arbitrary code within the restricted browser sandbox by convincing a user to visit a specially crafted HTML page. The issue stems from improper validation of input during processing...

CVE-2026-113094

A flaw was found in chromium-browser. A remote attacker can trigger memory corruption in the application programming interface API by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code within the browser's sandbox...

CVE-2026-113063

A flaw was found in the Chromoting component of chromium-browser. Due to improper input validation, a remote attacker can achieve arbitrary code execution inside the browser sandbox by tricking a user into visiting a crafted HTML page. Successful exploitation allows unauthorized code to run withi...

CVE-2026-113062

A flaw was found in chromium-browser. Due to improper input validation in an application programming interface API, a remote attacker can potentially execute arbitrary code within the browser's sandbox environment by convincing a user to visit a specially crafted HTML page...

CVE-2026-113036

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code inside the application's restricted security environment sandbox. By convincing a user to visit a specially crafted HTML page, an attacker can trigger memory corruption within the browser's...

CVE-2026-113032

A flaw was found in the Omnibox address bar component of Google Chrome on Android. A remote attacker can exploit this memory corruption issue by convincing a user to open a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code within the browser's...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-112999

A flaw was found in chromium-browser. A remote attacker can achieve arbitrary code execution inside the browser's sandbox environment by convincing a user to open a specially crafted HTML page. This issue stems from a use-after-free vulnerability in an application programming interface API, where...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

DRUPAL-CONTRIB-2026-224

The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the...