FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95336): chromium -- security fixes

Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95340): chromium -- security fixes

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95336: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95294: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95296: Missing Authorization

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95311: Free of Memory not on the Heap

Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95307: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95317: Incorrect Authorization

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Medium...

CVE-2026-95352: Incorrect Authorization

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-95385: Improper Enforcement of Behavioral Workflow

Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95361: Unintended Proxy or Intermediary

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95363: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95368: Incorrect Authorization

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-95289: Incorrect Authorization

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95360: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-95337: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library

Summary Multiple vulnerabilities related to Jackson Databind library were addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar...

Astra Linux – Vulnerability in Chromium

UI misrepresentation in URL formatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to spoof the address bar via a crafted domain name. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In WebXR in Google Chrome prior to version 152.0.7977.65, an uninitialized resource allowed a remote attacker to potentially leak cross-origin data through a crafted HTML page using social engineering. Chromium security severity: Medium...