PT-2026-103986

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...

PT-2026-103982

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-102671: Improper Certificate Validation

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...

PT-2026-103954

Name of the Vulnerable Software and Affected Versions Capacitor versions prior to 6.2.2 Capacitor versions prior to 7.6.9 Capacitor versions prior to 8.3.5 Capacitor versions prior to 8.4.3 Capacitor versions prior to 8.5.1 Description The Android and iOS WebView navigation guard validates the ho...

Microsoft Edge (Chromium) < 154.0.4258.48 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 154.0.4258.48. It is, therefore, affected by multiple vulnerabilities as referenced in the September 30, 2026 advisory. - Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a...

CVE-2026-101883

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883

The OpenClaw Windows Node versions through 2026.9.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the canvas.present capability. The root cause is that canvas.present allows for the bypass of URL risk evaluations normally enforced by canvas.navigate . An attacker possessing g...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

EUVD-2026-90256

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

SUSE CVE-2026-102327

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-102327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to...

CVE-2026-101883: Server-Side Request Forgery (SSRF)

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-102327

An incorrect authorization flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=496212975 https://code.google.com/p/chromium/issues/detail?id=102327...

CVE-2026-102327

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-102327

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102327

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-89401

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102327

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...