CVE-2026-13803

CVE-2026-13803 describes a Type Confusion in Chrome Tabs affecting Google Chrome prior to 150.0.7871.47. The root cause is a type-confusion vulnerability in the Chrome renderer that could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox by pre...

CVE-2026-13801

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-13797

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-13798

Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-13782

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-13780

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-13780

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-13782

CVE-2026-13782 affects Google Chrome browser prior to 150.0.7871.47, where a use-after-free in the browser renderer could allow a remote attacker to escape the sandbox via a crafted HTML page. Upgrade to Chrome 150.0.7871.47 or later (per Chrome security updates) to remediate.

CVE-2026-13776

Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

MAL-2026-6687 Malicious code in procwire (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011cf28d546459d946b1ed6d92c3beb4cb7c5322d6a9370d52fcd40e9a81ac2f On Windows, installing [email protected] automatically downloads and executes an attacker-controlled executable. The package.json preinstall script runs...

MAL-2026-6680 Malicious code in brock-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 699ebe0603c5d23f4f20b4c4b9a3f22ce480e2144d2ebe391d4a44618988fa63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6681 Malicious code in brock-react-alerts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5241549789e8a03d9ca593f6803199ed0d3328b6b2fe708c80f1c5f99c05338 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6685 Malicious code in quoting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15a7ad751ee7e0ff35c2b901b3f7954a4591644bb52d61136ef9a0b982b0c884 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6679 Malicious code in agent-starter-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6a3e60c2dc67c55d728aaefbc972de29f46bdbfe7f013b3b6cde05907c2397 Package [email protected] was scanned with no a static rule matches and no behavioral findings. No lifecycle scripts, network destinations,...

Malicious code in nbmolviz-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a233f99e766d901cd0bc65a98151969dcdbe3657a6d78f7b90ae31b958ed1045 No a static rule matches and no traced behavior of concern were identified in this package version. No evidence of credential access, exfiltration,...

MAL-2026-6682 Malicious code in confluent-kafka-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20f9433c5da4c3ee143c33ec2a876e07ff01aa1188d0efa783858bcd0903d3c Analysis of this package version produced no static indicator and no traced behavioral findings. The tarball does not exhibit lifecycle-script...

Malicious code in postcss-property-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acb8d62cdeb6a2c19937f3d02aa6214a23114e4dbc38373e6107c8345c3f1f9f [email protected] was scanned with no a static rule matches and no behavioral findings. No exfiltration, install-time fetch-and-execute,...

MAL-2026-6686 Malicious code in setup-cicd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b9d7d7f16320d5296fb3acf5cc61ae1cf55125c89fde6b702acd406e1516f92 Package [email protected] contains no observed behaviors matching supply-chain attack patterns. No lifecycle scripts, install-time network fetches,...

MAL-2026-6675 Malicious code in rs-biginteger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 796cb1ee4c8398963dcc192d2fc9b425866f40f7a99b467cba1d160234508617 Package presents itself as a big-integer arithmetic library and ships the verbatim big.js v7.0.1 source plus its README. Injected between the P.minus...

PT-2026-54208

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in the Media component on Windows allows a remote attacker who has already compromised the renderer process to perform UI spoofing. This is achieved by...