Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google on Tuesday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 CVSS score: N/A, has been described as an out-of-bounds bug in V8, Chrome's...

CVE-2026-87766 Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

CVE-2026-87766

CVE-2026-87766 is a symlink traversal vulnerability in bubblewrap , a sandboxing tool used by the containers project. During sandbox setup, creating files or directories under the new root can follow a parent symlink via /oldroot onto the host, allowing an attacker to write files at arbitrary pat...

EUVD-2026-74778

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

CVE-2026-87766

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

CVE-2026-87766 Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

CVE-2026-87766

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

CVE-2026-22686

Enclave VM Sandbox Escape CTF Challenge Challenge: "Breaking the Walls" Difficulty: Hard Category: Source Code Review / Sandbox Escape Points: 500 Scenario You've discovered a mysterious sandboxed JavaScript execution environment...

ROOT-APP-NPM-GHSA-M5W8-4GQ2-6F8X GHSA-m5w8-4gq2-6f8x in vm2 - Patched by Root

Root has patched GHSA-m5w8-4gq2-6f8x in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-47698 CVE-2026-47698 in vm2 - Patched by Root

Root has patched CVE-2026-47698 in the vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-57825

A flaw was found in the opam package manager for OCaml. This vulnerability allows a malicious package to bypass the sandbox protection mechanism. By mishandling symlinks during the processing of .install files, an attacker can write arbitrary files to unintended locations on the system, potential...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

Jenkins Pipeline: Groovy Plugin workflow-cps version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with...

CVE-2026-87630

A flaw was found in WebRTC in Chromium-browser. A remote attacker could exploit an integer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory within the browser's sandbox environment...

CVE-2026-87430

A flaw was found in WebRTC, a real-time communication component, within Google Chrome. A remote attacker could exploit this buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation may allow the attacker to execute arbitrary code within the...

CVE-2026-87604

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability could allow a remote attacker, who has already compromised the browser's renderer process, to potentially execute arbitrary code outside of the browser's security sandbox. This exploitation occurs when ...

CVE-2026-87506

A flaw was found in Google Chrome's WebUI. A remote attacker, after compromising the renderer process, could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to privilege elevation, allowing the attacker to execute arbitrary code outside o...

CVE-2026-87553

A flaw was found in SiteIsolation in Google Chrome. Improper input validation could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This exploitation occurs when the attacker provides a specially crafted HTML page, leadi...

CVE-2026-87618

A flaw was found in Google Chrome. This vulnerability involves incorrect reference resolution within the browser's Storage component. A remote attacker, who has already compromised the browser's renderer process, could exploit this by enticing a user to visit a specially crafted HTML page...

CVE-2026-87634

A flaw was found in Chromium. A use-after-free vulnerability exists in the WebPackaging component. A remote attacker could exploit this by enticing a user to open a specially crafted HTML page. This could potentially lead to arbitrary code execution outside of the sandbox...