chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability

A flaw was found in Skia, a 2D graphics library used in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could allow the attacker to obtain sensitive cross-origin data...

chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia

A flaw was found in Skia, a 2D graphics library used in Google Chrome. This vulnerability, stemming from an uninitialized resource, allows a remote attacker to obtain sensitive cross-origin data. By crafting a malicious HTML page, an attacker can trick a user into visiting it, leading to the...

chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Skia

A flaw was found in Skia, a 2D graphics library used in Chromium. A remote attacker, after compromising the renderer process, could exploit an uninitialized use vulnerability by crafting a malicious HTML page. This could lead to the leakage of sensitive cross-origin data, potentially exposing...

chromium-browser: angle: Chromium: Web origin policy bypass via uninitialized resource in ANGLE

A flaw was found in ANGLE, a component of Chromium. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to bypass the web origin policy, leading to unauthorized access to...

chromium-browser: angle: ANGLE in Google Chrome: Cross-origin data disclosure via uninitialized resource

A flaw was found in ANGLE in Google Chrome. An uninitialized resource vulnerability exists that allows a remote attacker to potentially obtain cross-origin data by enticing a user to visit a crafted HTML page...

PT-2026-96298

Name of the Vulnerable Software and Affected Versions Gladys Assistant versions prior to 5.1.0 Description An issue exists where unauthenticated remote attackers can obtain valid password reset tokens for any account. This occurs due to a lack of server-side validation of the client-supplied orig...

CVE-2026-59814: Improper Neutralization of Input During Web Page Generation

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A...

uBlock v1.75.1b0

!Badge CommitsCommit Rate !Badge IssuesIssues !Badge LocalizationCrowdin !Badge LicenseLicense !Badge NPMNPM !Badge MozillaMozilla !Badge ChromeChrome !Badge EdgeEdge uBlock Origin uBO Browser| Install from ...| Status ---|---|--- | Firefox Add-ons| uBO works best on Firefox | Edge Add-ons| "Movi...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass in the local daemon WebSocket origin validation . The flawed logic accepts any chrome-extension origin whose identifier is 32 characters long and falls within the range a-p , allowing an attacker to register a malicious browser ...

EUVD-2026-83733

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111: Origin Validation Error

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

PT-2026-95967

Name of the Vulnerable Software and Affected Versions Tencent BrowserSkill versions prior to 0.3.1 Description An authentication bypass exists in the local daemon WebSocket origin validation. The system incorrectly accepts any chrome-extension origin consisting of 32 characters within the range...

SUSE CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the varyMatches function, which fails to properly handle Vary: wildcard headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached...

SUSE CVE-2026-93383

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...