CVE-2026-10908

A use after free vulnerability exists in the FullScreen component of Google Chrome on Windows for versions prior to 149.0.7827.53 . A remote attacker who has successfully compromised the renderer process can exploit this issue to potentially perform a sandbox escape by using a crafted HTML page. ...

CVE-2026-10905

A use after free vulnerability exists in the Network component of Google Chrome and Microsoft Edge in versions prior to 149.0.7827.53 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to potentially perform a sandbox escape . While ...

CVE-2026-10905

Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-10905

Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-10898

Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-10894

Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-10894

A use after free vulnerability exists in the Printing component of the Google Chrome browser on Linux versions prior to 149.0.7827.53 . The flaw allows a remote attacker who has already compromised the renderer process to perform a sandbox escape by navigating to a specially crafted HTML page. Th...

CVE-2026-10884

Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

Supply chain compromise via malicious @cap-js/openapi

Impact On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine npm tokens, cloud provider credentials, SSH keys,...

Malicious Package

Overview @cap-js/openapi is a malicious package. through the installation of a compromised package version. An attacker can exfiltrate sensitive credentials and propagate malicious code by leveraging the malicious code executed during the package installation. Remediation Avoid using all maliciou...

MAL-2026-5187 Malicious code in supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa2bdcc065a6d4c2b1512f8b68fed22618050c0435c12890c74a2f1405c62093 Withdrawn Advisory This advisory has been withdrawn because the malware detection was a false positive. This link is maintained to preserve external...

MAL-2026-5186 Malicious code in autotel-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49899c545b0d4535885123c5d0bd0ba8804da194fc196e950fbf813518ff08a8 The package ships a bundled CLI dist/cli.cjs and dist/cli.js in which base64 decoding primitives Buffer.from..., 'base64'.toString... co-occur with...

Malicious code in autotel-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49899c545b0d4535885123c5d0bd0ba8804da194fc196e950fbf813518ff08a8 The package ships a bundled CLI dist/cli.cjs and dist/cli.js in which base64 decoding primitives Buffer.from..., 'base64'.toString... co-occur with...

PT-2026-49155

Impact On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine npm tokens, cloud provider credentials, SSH keys,...

PT-2026-46449

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 149.0.7827.53 Description Insufficient validation of untrusted input in WebShare allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTM...

PT-2026-46454

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An out of bounds write occurs in Skia, a graphics library, which allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape. This ...

PT-2026-46790

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description Insufficient policy enforcement in WebAuthentication allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page...

PT-2026-46592

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description A race condition in the GPU component allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved by using a special...

PT-2026-46482

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.53 Description A use after free issue in Core allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape by using a crafted HTML page. Use aft...

PT-2026-46641

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 149.0.7827.53 Description A use after free issue exists in Device Trust. A remote attacker who has compromised the renderer process can potentially perform a sandbox escape by using a crafted HTML page. U...