CVE-2026-95303

Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-89117

Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95337

Google Chrome on Android versions prior to 154.0.8037.57 is vulnerable to a UI misrepresentation flaw in Messages . A remote attacker can leverage social engineering to spoof UI elements through a crafted HTML page. Remediation is available in version 154.0.8037.57 ; for example, Debian provides ...

CVE-2026-95337

UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95369

Google Chrome versions prior to 154.0.8037.57 are vulnerable to a vulnerability involving an inappropriate implementation in XML . A remote attacker could exploit this via a crafted HTML page to potentially execute arbitrary code inside the sandbox . Remediation is available in version 154.0.8037...

CVE-2026-95369

Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95369

Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95369

Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95366

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-89243

Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95343

A use-after-free memory vulnerability exists in the WebAudio component of Google Chrome (and other Chromium -based browsers) prior to version 154.0.8037.57 . A remote attacker can exploit this flaw by convincing a user to view a crafted HTML page , potentially leading to arbitrary code execution ...

CVE-2026-95318

Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-89230

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95293

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95283

Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95283

A buffer overflow vulnerability exists in the Tint component of Google Chrome on Android (prior to version 154.0.8037.57) and in the chromium-browser package. A remote attacker can exploit this flaw by tricking a user into viewing a specially crafted HTML page , potentially leading to the executi...

CVE-2026-95357

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Cross-site Scripting (XSS)

Overview org.webjars.npm:serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a regex flaw in SCRIPTCLOSEREGEXP that allows a live tag to...

CVE-2026-92232

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...

CVE-2026-92232

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...