CVE-2026-113295

Google Chrome on Windows versions prior to 156.0.8078.47 is vulnerable to an out-of-bounds read within the Almost Native Graphics Layer Engine (ANGLE) component. A remote attacker can exploit this flaw by tricking a user into viewing a specially crafted HTML page , which allows the attacker to re...

CVE-2026-113309

A flaw in the Media component of Google Chrome (specifically the chromium-browser ) allows a remote attacker to perform an out-of-bounds read . By persuading a user to load a specially crafted HTML page , an attacker can trigger this vulnerability to access sensitive memory contents within the br...

CVE-2026-113295

Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113309

Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113310

An out-of-bounds read vulnerability exists in the Bluetooth component of Google Chrome (specifically within chromium-browser ) prior to version 156.0.8078.47 . A remote attacker can exploit this flaw by enticing a user to view a crafted HTML page , which allows the attacker to read memory inside ...

CVE-2026-113310

Use after free in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113310

Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113310

Use after free in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113193

Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113098

Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113341

Google Chrome on Android is vulnerable to a memory corruption issue in the Skia component in versions prior to 156.0.8078.47 . A remote attacker could exploit this by using a crafted HTML page to potentially read memory inside the sandbox . The Chromium security severity for this flaw is rated as...

CVE-2026-113341

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-113341

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-113341

Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: xfrm: espintcp: do not reuse an in-progress partial send

A flaw was found in the Linux kernel. The espintcp component, responsible for handling encrypted network traffic, incorrectly reuses a partial data transmission state. This can lead to an out-of-bounds read, which may allow an attacker to access sensitive information or cause other memory...

kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

EUVD-2026-104658

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read...

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

GHSA-PCHR-8J38-3X4P Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...