CVE-2026-13931

CVE-2026-13931 affects Google Chrome on Windows prior to 150.0.7871.47. The root cause is an inappropriate implementation in Media that allows a renderer-capable attacker to perform UI spoofing via a crafted HTML page. Impact is UI spoofing with no data exfiltration stated; upgrade to 150.0.7871....

CVE-2026-13892

CVE-2026-13892 concerns Chrome for iOS before version 150.0.7871.47, where an inappropriate implementation allowed a remote attacker who lured a user into specific UI gestures to leak cross-origin data via a crafted HTML page. The issue affects Chrome on iOS (Chromium-based) and has a Medium seve...

CVE-2026-13887

The CVE-2026-13887 entry relates to Google Chrome for Android, where an inappropriate NFC implementation before version 150.0.7871.47 allowed a remote attacker who had already compromised the renderer process to leak cross-origin data via a crafted HTML page. This is triggered by a renderer compr...

CVE-2026-13876

Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass content security policy via malicious network traffic. Chromium security severity: Medium...

CVE-2026-13868

Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13859

The CVE-2026-13859 entry describes an issue in ANGLE used by Google Chrome, where an inappropriate ANGLE implementation prior to Chrome 150.0.7871.47 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected product/component: ANGLE in Chromium-based ...

CVE-2026-13859

Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13837

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2026-13835

Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-13800

Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...

PT-2026-54277

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in the Network component allows a remote attacker to perform Universal Cross-Site Scripting UXSS, which involves injecting arbitrary scripts or HTML into...

PT-2026-54136

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on non-native platforms, could allow a remote attacker to perform a sandbox escape. Thi...

PT-2026-54112

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in XML allows a remote attacker to potentially cause heap corruption, which occurs when memory in the heap area is corrupted, by inducing the user to vis...

PT-2026-54209

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.47 Description An inappropriate implementation in the Sharing feature allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved b...

PT-2026-54428

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in Glic allows a remote attacker to perform UI spoofing via a crafted HTML page if a user is convinced to perform specific UI gestures. Recommendations...

PT-2026-54337

Name of the Vulnerable Software and Affected Versions Google Chrome on ChromeOS versions prior to 150.0.7871.47 Description An inappropriate implementation in Views allows an attacker to obtain potentially sensitive information from process memory. This occurs if a user is convinced to install a...

PT-2026-54352

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 150.0.7871.47 Description An inappropriate implementation in the Select element allows a remote attacker to spoof the contents of the Omnibox URL bar using a crafted HTML page. This occurs when a tall...

PT-2026-54285

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in the passwords component allows a remote attacker to potentially cause heap corruption, which occurs when memory in the heap area is corrupted, by...

PYSEC-2026-326 dcap-qvl has Missing Verification for QE Identity

Impact This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity, qeidentitysignature, and qeidentityissuerchain from the PCCS. However, it skips to verify the QE Identity signature...

CVE-2026-13528 YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/service/file/FileServiceImpl.java of the component AppFileController File...