CVE-2026-95366

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-89243

Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95343

A use-after-free memory vulnerability exists in the WebAudio component of Google Chrome (and other Chromium -based browsers) prior to version 154.0.8037.57 . A remote attacker can exploit this flaw by convincing a user to view a crafted HTML page , potentially leading to arbitrary code execution ...

CVE-2026-95318

Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-89230

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95293

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95283

Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-95283

A buffer overflow vulnerability exists in the Tint component of Google Chrome on Android (prior to version 154.0.8037.57) and in the chromium-browser package. A remote attacker can exploit this flaw by tricking a user into viewing a specially crafted HTML page , potentially leading to the executi...

CVE-2026-95357

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-92232

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...

CVE-2026-92232

Joomla! Core - 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector...

CVE-2026-90918

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-90918

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-102674 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a...

CVE-2026-90918 Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-90918

The Joomla! Core software is vulnerable to a Cross-Site Scripting (XSS) flaw in its HTML Mail Templates feature. The root cause is a lack of an escaping mechanism , which allows for XSS vectors across multiple extensions. This issue affects Joomla versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . No specifi...

EUVD-2026-89080

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-90918 Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-102673

The Electron framework (prior to versions 41.10.4 , 42.5.2 , and 43.0.0 ) contains a vulnerability where popups opened via the OpenURLFromTab navigation path do not inherit HTML sandbox restrictions from the parent sandboxed iframe. This occurs when using target="_blank" or a middle-click. An unt...

CVE-2026-102673 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="blank" or a middle-click, did not...