CVE-2026-121253

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121175

Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121063

Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121029

Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-116357

Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-116355

Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121029

Google Chrome versions prior to 157.0.8103.38 are susceptible to an incorrect authorization vulnerability in the ORB component. This flaw allows a remote attacker to bypass site isolation by hosting a crafted HTML page. The Chromium security severity is classified as Low . Remediation is availabl...

EUVD-2026-116337

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121253

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-121253

Google Chrome versions prior to 157.0.8103.38 are vulnerable to a missing authorization flaw in DevTools . This vulnerability allows a remote attacker to leverage social engineering and a crafted Chrome extension to bypass site isolation . No specific exploit details or scanner source code are pr...

CVE-2026-121063

Google Chrome versions prior to 157.0.8103.38 are vulnerable to an incorrect authorization issue in CacheStorage . A remote attacker who has already compromised the renderer process can exploit this flaw by using a crafted HTML page to bypass site isolation . No specific exploit or scanner source...

EUVD-2026-116449

Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121029: Google Chrome: Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site…

Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121063: Google Chrome: Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had…

Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121175: Google Chrome: Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site…

Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages. A privileged local host c...

Trespasser

CVE-2026-74970 · Firefox Fission site-isolation bypass via missing PipelineId namespace check This directory holds an honest reproduction scaffold for a Fission site-isolation authorization bypass in Firefox WebRender. Under Fission each content process owns a distinct PipelineId namespace, but t...

CVE-2021-2173

CVE-2021-2173 CVE-2021-2173 PoC is explained here: https://databasesecurityninja.wordpress.com/2021/06/04/cve-2021-2173-pdb-isolation-is-broken-through-metadata-exposure/ Oracle Critical Patch Update Advisory - April 2021: https://www.oracle.com/security-alerts/cpuapr2021.html...

CVE-2026-100707

A flaw was found in Kyverno. Inconsistent path validation allows an authenticated user with low privileges to bypass namespace isolation boundaries by using percent-encoded directory traversal sequences in policy API requests. An attacker can exploit this issue to access and read sensitive...

An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure

This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud provider about the vulnerabilities in line with our responsible disclosure polic...