CVE-2026-91740

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91708

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91708

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91740

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91740

A vulnerability in Skia within Google Chrome (prior to version 153.0.8010.47 ) allows a remote attacker to obtain cross-origin data by leveraging an uninitialized resource via a crafted HTML page. This issue is categorized as High security severity by Chromium. Microsoft Edge, being Chromium-base...

CVE-2026-91708

A race condition in the Network component of Google Chrome (prior to version 153.0.8010.47) allows a remote attacker who has compromised the renderer process to obtain cross-origin data via a crafted HTML page. This vulnerability impacts Microsoft Edge as well, as it ingests Chromium. Remediation...

CVE-2026-91747

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-79967

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91747

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91747

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-91747

A use after free vulnerability in Skia within Google Chrome (prior to version 153.0.8010.47 ) allows a remote attacker who has compromised the renderer process to obtain cross-origin data via a crafted HTML page. The Chromium security severity is rated as High . Remediation is available in update...

CVE-2026-81925

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

GHSA-GRH8-3P95-F9RR Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

CVE-2026-69215

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , its CookieJar client middleware uses unanchored substring checks instead of proper RFC 6265 domain and path matching when deciding whether to attach a stored cookie. As a result, a cookie intended for example.com can be...

CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an...

CVE-2026-69215 Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an...

PT-2026-93126

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A race condition in the Network component allows a remote attacker who has already compromised the renderer process to obtain cross-origin data by using a specially crafted HTML page. A...

PT-2026-93148

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description Incomplete cleanup in the GetUserMedia function allows a remote attacker to obtain cross-origin data. This occurs when an attacker has already compromised the renderer process and uses...

PT-2026-93164

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description An integer overflow in the Compositing component allows a remote attacker to obtain cross-origin data by inducing a user to visit a crafted HTML page. Cross-origin data access occurs wh...