CVE-2026-121243: Google Chrome: Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121121: Google Chrome: UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements…

UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121187: Google Chrome: Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…

Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121218: Google Chrome: Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136617

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description UI misrepresentation in the Bluetooth component allows a remote attacker to spoof UI elements by using a crafted HTML page. Recommendations Update Google Chrome to version 157.0.8103.38...

PT-2026-136460

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136546

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description An observable discrepancy in Forms allows a remote attacker to obtain sensitive information by using a crafted HTML page. Recommendations Update Google Chrome to version 157.0.8103.38 o...

PT-2026-136622

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136633

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136637

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description An information leak exists in the Paint component, which allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update...

PT-2026-136656

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 157.0.8103.38 Description An information leak exists in the Select component that allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update...

CVE-2026-121209: Google Chrome: UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar…

UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121047: Google Chrome: Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121177: Google Chrome: UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof…

UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136745

Name of the Vulnerable Software and Affected Versions CGI versions prior to 5.00 Description An open redirect issue exists where the redirect function decodes HTML entities in the URL after the application has already performed validation. This process allows a validated URL to change its meaning...

CVE-2026-121074: Google Chrome: Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially…

Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121196: Google Chrome: Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass…

Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121170: Google Chrome: Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…

Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136755

Name of the Vulnerable Software and Affected Versions CGI versions prior to 5.00 Description Perl CGI allows HTML injection when processing text containing the sequence -- within a comment. This occurs because arguments are placed between without proper escaping, allowing the sequence to close th...

TraPtitech traQ cross-site scripting vulnerability

TraPtitech TraQ versions prior to 3.28.3 contain a cross-site scripting vulnerability. This occurs because instances configured with local storage can retrieve user-uploaded SVG or HTML content via the /files/fileId endpoint and render it directly in the browser. As a result, attackers capable of...