EUVD-2026-82486

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93383

Google Chrome versions prior to 153.0.8010.52 are vulnerable to an information leak in the Permissions component. This flaw allows a remote attacker to leak cross-origin data by interacting with a crafted HTML page. The vulnerability has been addressed in version 153.0.8010.52 (boo#1281123). Whil...

CVE-2026-93383

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93383

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93383

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-82479

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-93387

A remote attacker can exploit improper state validation in the Skia component of Google Chrome (prior to version 153.0.8010.52) to obtain cross-origin data via a crafted HTML page. This vulnerability has been addressed in Chromium 153.0.8010.52 and corresponding distribution packages, such as 153...

CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

GHSA-F8M2-889X-VW4X AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm...

AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

UBUNTU-CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

CVE-2026-85717 affects the AsyncHttpClient (AHC) Java library, versions 2.14.5–2.16.0 and 3.0.9–3.0.11 . When a client is configured with a client-wide Realm and redirect following , the Interceptors authentication path falls back to the client configuration after redirect handling clears the per...