CVE-2026-85048

A use-after-free vulnerability in the Compositing component of Google Chrome prior to 152.0.7977.82 allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium team rates this High severity. The CVSS...

EUVD-2026-70707

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85048

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85053

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70705

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85050

CVE-2026-85050 is an out-of-bounds write in the WebGL component of Google Chrome on Android , affecting versions prior to 152.0.7977.82 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , yielding a CVSS 3.1 score of 9.6 (CRITICAL) with scope...

CVE-2026-85042

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85052

CVE-2026-85052 is an out-of-bounds read in the CrashReporting component of Google Chrome prior to 152.0.7977.82 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read memory outside the browser's security sandbox, resulting in information dis...

CVE-2026-85046

A type confusion in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page. The vulnerability was reported by Salvatore Gulizia (Serotav) on 2026-08-04 and is ra...

EUVD-2026-70703

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70702

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85052

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85169

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...

CVE-2026-85165

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

EUVD-2026-70404

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...

CVE-2026-85169 n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...

CVE-2026-85169 n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...

CVE-2026-85169

n8n versions before 1.123.73 , 2.35.4 , and 2.36.2 contain an expression sandbox escape in the $fromAI handler. The handler resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-pr...

CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression...

CVE-2026-85165

n8n versions before 2.36.2 are affected by an expression sandbox bypass. The root cause is that free identifiers appearing in spread , computed-key , switch-case , or class-extension positions resolve against process globals rather than staying within the sandbox. Authenticated users with workflo...