3049 matches found
MAL-2026-3966 Malicious code in @antv/g-webgl-compute (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3965 Malicious code in @antv/g-webgl (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3956 Malicious code in @antv/g-plugin-webgl-renderer (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-webgl-compute (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...
PT-2026-44589
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description Insufficient validation of untrusted input in WebGL allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. A...
PT-2026-114634
Уязвимость компонента WebGL веб-браузеров Google Chrome и Microsoft Edge связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданной HTML-страницы...
PT-2026-121222
Уязвимость интерфейса WebGL браузеров Google Chrome и Microsoft Edge связана с чтением за допустимыми границами буфера защищаемой информации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации с помощью специально созданной...
Google Chrome WebGL DoS
The vulnerability of Google Chrome’s WebGL interface relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
CVE-2026-22166 GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the...
PT-2026-44678
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description A use after free issue exists in WebGL. This allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape by using a crafted HTML...
Fedora 44 : cef (2026-83fdfd7e0e)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-83fdfd7e0e advisory. Update to 146.0.7680.177 + cef-146.0.11+g8e1262b High CVE-2026-5273: Use after free in CSS High CVE-2026-5272: Heap buffer overflow in GPU High...
Fedora 42 : cef (2026-e0c31e9e7e)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e0c31e9e7e advisory. Update to 146.0.7680.177 + cef-146.0.11+g8e1262b High CVE-2026-5273: Use after free in CSS High CVE-2026-5272: Heap buffer overflow in GPU High...
PT-2026-121224
Уязвимость интерфейса WebGL браузеров Google Chrome и Microsoft Edge связана с использованием неинициализированного ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить доступ к защищаемой информации с помощью специально созданной HTML-страницы...
Fedora 42 : cef (2026-6188cc51be)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6188cc51be advisory. Update to cef-146.0.9+g3ca6a87 + chromium 146.0.7680.164 High CVE-2026-4673: Heap buffer overflow in WebAudio High CVE-2026-4674: Out of bounds read...
Fedora 43 : cef (2026-a67eba175f)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a67eba175f advisory. Update to cef-146.0.9+g3ca6a87 + chromium 146.0.7680.164 High CVE-2026-4673: Heap buffer overflow in WebAudio High CVE-2026-4674: Out of bounds read...
