CVE-2026-17741: Improper Input Validation

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17915: User Interface (UI) Misrepresentation of Critical Information

Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PT-2026-66041

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description An object lifecycle issue in the WebView component allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape. This is...

PT-2026-66055

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description Insufficient validation of untrusted input in the WebView component allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox...

PT-2026-66234

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description An inappropriate implementation in the WebView component allows a remote attacker to perform UI spoofing by using a crafted HTML page. UI spoofing is a technique where an...

PT-2026-66272

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-17953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a...

Linux Distros Unpatched Vulnerability : CVE-2026-17722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to...

CVE-2026-17722: Use After Free

Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Chromium: CVE-2026-13037 Use after free in WebView

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-13870

An use after free flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497634837...

CVE-2026-13924

An insufficient validation of untrusted input flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511784747...

CVE-2026-13964

An insufficient policy enforcement flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513735096...

Malicious code in virtualization-compression-collapse (npm)

The npm package virtualization-compression-collapse published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it...

Malicious code in designsystem-vector (npm)

The npm package designsystem-vector published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in jest-macos (npm)

The npm package jest-macos published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in font-picker-responsive (npm)

The npm package font-picker-responsive published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in datapersistence-steppers-ai (npm)

The npm package datapersistence-steppers-ai published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registe...

Malicious code in onesignal-hooks (npm)

The npm package onesignal-hooks published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in personal-custom-button (npm)

The npm package personal-custom-button published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...