CVE-2026-15432

The CVE concerns Tink-Java and Tink-Android’s ChunkedMacVerification: during tag verification, the implementation uses a non-constant-time comparison, enabling a timing side-channel that could reveal how many bytes of a given tag match the correct tag. This is described as a potential pathway for...

CVE-2026-16404

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153...

CVE-2026-16397

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153...

CVE-2026-16373

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153...

EUVD-2026-46242

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153...

CVE-2026-16404

Firefox for Android contains a spoofing vulnerability (CVE-2026-16404) that was fixed in Firefox 153. The available documents identify the issue and its remediation but do not provide details on the underlying root cause, exploit vectors, affected components beyond the Android Firefox client, or ...

EUVD-2026-46235

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153...

CVE-2026-16397 Clickjacking issue in the WebExtensions component in Firefox for Android

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153...

CVE-2026-16397

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153...

EUVD-2026-46209

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153...

CVE-2026-16373

Firefox for Android Privacy component information disclosure (CVE-2026-16373) with fix in Firefox 153. Documents provide minimal details beyond this: affected product is Firefox for Android and the vulnerability was addressed in the 153 release. No deeper root-cause, exploitability, or affected s...

EUVD-2026-46126

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15900

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15900

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15900

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-15900

CVE-2026-15900 affects Google Chrome/Chromium components on Android (GPU use-after-free) prior to version 150.0.7871.128. The issue could allow a remote attacker to possibly perform a sandbox escape via a crafted HTML page. Public documents confirm a fix in Chromium/Chrome update to 150.0.7871.12...

PT-2026-61058

Name of the Vulnerable Software and Affected Versions SJCAM AllWinner Tech SJ4000-Air versions prior to 1.4C Whitelabel based versions prior to 1.4C Description An issue allows an attacker to execute arbitrary code by using a specially crafted FEX file. Recommendations At the moment, there is no...

CVE-2026-57848

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

CVE-2026-57848

CVE-2026-57848 concerns Stoat for Android where the exported ShareTargetActivity does not validate the incoming android.intent.extra.STREAM URI before using it as the outgoing attachment. An attacker able to invoke intents can supply a file:// URI pointing to the app’s internal storage (e.g., dat...