43800 matches found
CVE-2026-78961
A flaw was found in Google Chrome's core functionality. A remote attacker, who has already compromised a part of the browser responsible for rendering web content the renderer process and used social engineering tactics, could bypass the security mechanism that isolates content from different...
CVE-2026-78939
An use after free flaw was found in the Chromecast component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513261751...
CVE-2026-78943
A flaw was found in Google Chrome. This improper input validation vulnerability in the Editing component could allow a remote attacker, who has already compromised the renderer process and used social engineering, to bypass the web origin policy. This bypass is achieved by tricking a user into...
CVE-2026-79228
A flaw was found in Google Chrome. An incorrect authorization vulnerability within the Site Isolation feature allows a remote attacker, who has compromised the renderer process, to bypass site isolation. This can be achieved by a crafted HTML page, leading to unauthorized access to privileged pag...
CVE-2026-79224
A flaw was found in Chromecast within the Chromium browser. This use-after-free vulnerability allows a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This can be achieved by enticing the victim to visit a specially crafted HTML...
CVE-2026-79218
An incorrect authorization flaw was found in the Sandbox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500311587...
CVE-2026-79191
An incorrect authorization flaw was found in the SiteIsolation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517606780...
CVE-2026-79175
A flaw was found in Google Chrome's Accessibility component. A remote attacker, who has already compromised the renderer process, could exploit a type confusion vulnerability by crafting a malicious HTML page. This could lead to arbitrary code execution outside of the browser's security sandbox...
CVE-2026-79174
A flaw was found in Extensions in Google Chrome. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. By crafting a malicious HTML page, the attacker can gain unauthorized access to privileged pages...
CVE-2026-79155
A race condition flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522294538...
CVE-2026-79121
A flaw was found in Chromecast in Google Chrome. Improper input validation could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This exploitation occurs when a user visits a crafted HTML page, leading to a critical...
CVE-2026-79103
A flaw was found in Google Chrome's Speech component. This vulnerability involves incorrect reference resolution, which a remote attacker can exploit to bypass site isolation. The attacker needs to have compromised the renderer process and then trick a user into visiting a specially crafted HTML...
CVE-2026-78894
A race condition flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=505991181...
CVE-2026-76019
A flaw was found in chromium-browser. Incorrect authorization in the Workers component allows a remote attacker, who has compromised the renderer process and leveraged social engineering, to bypass the web origin policy. This bypass is achieved by tricking a user into interacting with a specially...
CVE-2026-19401
Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...
CVE-2026-78236
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...
CVE-2026-78236 Insecure PIN derivation mechanism in Admin By Request (ABR)
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...
CVE-2026-78236
CVE-2026-78236 affects Admin By Request (ABR) , a macOS privilege-escalation utility. The root cause is an insecure PIN derivation mechanism that allows a low-privileged user to escalate to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed...
CVE-2026-58089
When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...
