CVE-2026-17999

CVE-2026-17999: A race condition in Chrome’s PictureInPicture on Android (before 151.0.7922.72) enables a remote attacker to perform domain spoofing via a crafted HTML page. Affected software is Google Chrome on Android; root cause is a race in PictureInPicture logic. The Chromium advisory assign...

EUVD-2026-50925

Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17999

Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17995

Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17940

CVE-2026-17940 details (mode C): Insufficient validation of untrusted input in Chromium-based Google Chrome’s Picture-in-Picture on Android allows a remote attacker who compromises the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software: Google Chrome on ...

EUVD-2026-50866

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17925

Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17862

Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Medium...

CVE-2026-17769

Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17752

CVE-2026-17752 affects Google Chrome on macOS prior to 151.0.7922.72. The issue is a use-after-free in the Views component that can lead to heap corruption via a crafted HTML page, enabling remote exploitation. The public descriptions consistently state heap-related impact with high severity; the...

CVE-2026-17704

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-17699

Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

PT-2026-66259

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

PT-2026-66018

Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-17999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromi...

RockyLinux 9 : openssh (RLSA-2026:47756)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47756 advisory. openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux OpenSSH client versions CVE-2026-55655 openssh: Double free in...

PT-2026-66542

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.3 Description Banks parses Tool JSON objects from the rendered body of % completion % blocks and resolves the import path field using importlib.import module... and getattr... to identify the callable for tool calls...