CVE-2026-78943

A flaw was found in Google Chrome. This improper input validation vulnerability in the Editing component could allow a remote attacker, who has already compromised the renderer process and used social engineering, to bypass the web origin policy. This bypass is achieved by tricking a user into...

CVE-2026-79228

A flaw was found in Google Chrome. An incorrect authorization vulnerability within the Site Isolation feature allows a remote attacker, who has compromised the renderer process, to bypass site isolation. This can be achieved by a crafted HTML page, leading to unauthorized access to privileged pag...

CVE-2026-79224

A flaw was found in Chromecast within the Chromium browser. This use-after-free vulnerability allows a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This can be achieved by enticing the victim to visit a specially crafted HTML...

CVE-2026-79218

An incorrect authorization flaw was found in the Sandbox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500311587...

CVE-2026-79191

An incorrect authorization flaw was found in the SiteIsolation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517606780...

CVE-2026-79175

A flaw was found in Google Chrome's Accessibility component. A remote attacker, who has already compromised the renderer process, could exploit a type confusion vulnerability by crafting a malicious HTML page. This could lead to arbitrary code execution outside of the browser's security sandbox...

CVE-2026-79174

A flaw was found in Extensions in Google Chrome. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy. By crafting a malicious HTML page, the attacker can gain unauthorized access to privileged pages...

CVE-2026-79155

A race condition flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522294538...

CVE-2026-79121

A flaw was found in Chromecast in Google Chrome. Improper input validation could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This exploitation occurs when a user visits a crafted HTML page, leading to a critical...

CVE-2026-79103

A flaw was found in Google Chrome's Speech component. This vulnerability involves incorrect reference resolution, which a remote attacker can exploit to bypass site isolation. The attacker needs to have compromised the renderer process and then trick a user into visiting a specially crafted HTML...

CVE-2026-78894

A race condition flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=505991181...

CVE-2026-76019

A flaw was found in chromium-browser. Incorrect authorization in the Workers component allows a remote attacker, who has compromised the renderer process and leveraged social engineering, to bypass the web origin policy. This bypass is achieved by tricking a user into interacting with a specially...

CVE-2026-19401

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

CVE-2026-78236

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-78236

CVE-2026-78236 affects Admin By Request (ABR) , a macOS privilege-escalation utility. The root cause is an insecure PIN derivation mechanism that allows a low-privileged user to escalate to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed...

CVE-2026-78236 Insecure PIN derivation mechanism in Admin By Request (ABR)

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-58089

When a process calls execve2 to execute a setuid or setgid image, hwpmc4 is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after...

Linux Distros Unpatched Vulnerability : CVE-2026-79001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged...

CVE-2026-26448

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client or a later connection sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a...

Linux Distros Unpatched Vulnerability : CVE-2026-79132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to...