Astra Linux – Vulnerability in Chromium

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to leverage social engineering to bypass web origin policy through crafted network traffic. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

A protection mechanism failure in HttpsUpgrades in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through crafted network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Improper input validation in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

An externally controlled reference in QUIC in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass web origin policies through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In Google Chrome, policy bypass in CSS before version 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The race condition in Workers in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

In the version of Receiver in Google Chrome prior to 151.0.7922.72, policy bypass allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in the Network section of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass web origin policy through a crafted Chrome extension. Chromium security severity: High...

CVE-2026-100593

OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...

CVE-2026-100583

OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata fr...

CVE-2026-100573

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100561

OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...

CVE-2026-100552

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...