CVE-2026-43735

CVE-2026-43735 WebKit クロスオリジン情報漏洩。Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null 原理 親ページが を使用してクロスオリジン iframe のフラグメントナビゲーションをトリガーすると、iframe が受信する NavigateEvent.sourceElement は親ページの 要素であり、 は親ページの Document 全体になります。その結果、クロスオリジン iframe は読み取り（）、変更（DOM の変更 / フォーム action の変更）、さらには...

DEBIAN-CVE-2026-87516

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74436

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-87516

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87642

Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture 跨域信息泄露。Safari 红/绿/蓝/白 修复版本 = 26.5.2: PATCHED importExternalTexture blocked: SecurityError 原理 GPUDevice.importExternalTexturesource: HTMLVideoElement 把视频导入成 GPU 可采样的 GPUExternalTexture。修复前没有对视频做 taintsOrigin 跨域检查，跨域且无 CORS 的 tainted 视频也能被导入，再用 WGS...

CVE-2026-53728

Medplum , a healthcare developer platform, is vulnerable to authorization code leakage in its external identity provider callback (GET /auth/external). The root cause is that getClientRedirectUri() accepts any redirect URI that prefix-matches a registered value (startsWith), rather than requiring...

Linux Distros Unpatched Vulnerability : CVE-2026-78949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-install...

Linux Distros Unpatched Vulnerability : CVE-2026-79272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak...

CVE-2026-78894

A race condition in the Payments component of Google Chrome prior to version 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to leak cross-origin data by rendering a crafted HTML page. The Chromium security team rated this as Medium severity; the assigned C...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

firefox: thunderbird: Site isolation issue in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...

EUVD-2026-54136

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-19167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-19167

Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-17757

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17885

Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17959

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...