CVE-2026-79267

CVE-2026-79267 is a race condition in Workers affecting Google Chrome prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could bypass the web origin policy by serving a crafted HTML page. Chromium rated the severity as Medium . The vulnerability is fixed i...

CVE-2026-79010

CVE-2026-79010 is a use-after-free type vulnerability (operation on a resource after expiration or release) in the Network component of Google Chrome prior to 152.0.7977.65 . An attacker who had already compromised the renderer process could exploit this to bypass the web origin policy via a craf...

CVE-2026-79262

CVE-2026-79262 is an incorrect authorization vulnerability in the Network component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit this by serving a crafted HTML page to bypass the web origin policy , potentially allowing unauthorized cross-origin access to sens...

CVE-2026-79106

Improper input validation in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79106

Google Chrome prior to 152.0.7977.65 is affected by an improper input validation flaw in the Input component. A remote attacker who had already compromised the renderer process and leveraged social engineering could bypass the web origin policy using a crafted HTML page. The Chromium security tea...

CVE-2026-78961

CVE-2026-78961 is an incorrect authorization vulnerability in the Core component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who has already compromised the renderer process and leverages social engineering can craft an HTML page that bypasses the web origin policy . The C...

EUVD-2026-65837

Improper input validation in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79106

Improper input validation in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79222

CVE-2026-79222 is an incorrect authorization flaw in CustomTabs in Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A local attacker can leverage a co-installed app to bypass the web origin policy , potentially gaining unauthorized access to web content or data within Chrome...

CVE-2026-78954

Google Chrome versions prior to 152.0.7977.65 contain an incorrect authorization flaw in the Extensions component. An attacker who has already compromised the renderer process can exploit this to bypass web origin policy by serving a crafted HTML page. The Chromium project rates this as High seve...

CVE-2026-79014

A race condition in the Autofill component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had already compromised the renderer process to bypass the web origin policy via a crafted HTML page. The Chromium security team rated this High severity. The primary impact is a secur...

CVE-2026-79174

Incorrect authorization in the Extensions component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had already compromised the renderer process to bypass the web origin policy into a privileged page via a crafted HTML page. Chromium rated the severity as High . The fix is a...

CVE-2026-78895

CVE-2026-78895 is an information leak in the Paint component of Google Chrome prior to 152.0.7977.65 , classified as High severity by Chromium. A remote attacker could exploit this via a crafted HTML page to bypass the web origin policy , potentially exposing data across origin boundaries. The fi...

CVE-2026-78908

CVE-2026-78908 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker could exploit this vulnerability by delivering a crafted HTML page , enabling a bypass of the web origin policy to leak information. Chromium rates the security severity as Hi...

CVE-2026-79082

CVE-2026-79082 is an incorrect authorization vulnerability in the Transactions Platform component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to bypass the web origi...

CVE-2026-79117

CVE-2026-79117 is a race condition in the WebAppInstalls component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . The flaw allows a remote attacker leveraging social engineering to bypass the web origin policy by exploiting a co-installed app. Chromium rated the severit...

CVE-2026-79093

CVE-2026-79093 is an incorrect authorization flaw in the Paint component of Google Chrome prior to 152.0.7977.65 . A remote attacker could potentially bypass the web origin policy by luring a user into opening a crafted HTML page . Chromium rated the severity High . The fix is available in the st...

CVE-2026-79212

Google Chrome prior to 152.0.7977.65 is affected by a missing authorization flaw in its Passwords component. A remote attacker who had already compromised the renderer process and leveraged social engineering could bypass the web origin policy using a crafted HTML page. Chromium classifies the se...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Questa PoC dimostra come un attaccante può concatenare di Orange Tsai CVE-2024-4577 con il DNS rebinding per ottenere l'esecuzione remota di codice sull'infrastruttura di rete interna direttamente tramite il browser della vittima. Bypassando la Same-Origin Policy SOP e...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...