PT-2026-88561

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Core component that allows a remote attacker to leak cross-origin data through the use of a crafted Chrome extension. Cross-origin data refers to...

PT-2026-88674

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ServiceWorker, which allows a remote attacker to obtain cross-origin data by using a crafted HTML page. ServiceWorker is a script that the browser runs...

PT-2026-88631

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Cross-Origin Resource Sharing CORS implementation. A remote attacker who has already compromised the renderer process can use a crafted HTML page to...

PT-2026-88611

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in DevTools allows a remote attacker to obtain cross-origin data through the use of a crafted Chrome extension. Recommendations Update Google Chrome to version...

PT-2026-86963

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-75156: Origin Validation Error

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

PT-2026-88671

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper certificate validation in the Loader component allows a remote attacker to bypass the web origin policy through crafted network traffic, provided they can leverage social...

PT-2026-88752

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the PushAPI allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin policy...

PT-2026-88726

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in DeviceBoundSessionCredentials allows a remote attacker to bypass the web origin policy through the use of crafted network traffic. Recommendations Update Goog...

PT-2026-88677

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Isolated component allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one...

PT-2026-88722

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in FedCM Federated Credential Management, an API that allows users to sign into websites using their existing accounts from other providers allows a remote attacke...

PT-2026-88621

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in WebMCP. A remote attacker who has compromised the renderer process can obtain cross-origin data by using a crafted HTML page. Recommendations Update Google...

PT-2026-88549

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A cross-site request forgery issue exists in DeviceBoundSessionCredentials. This allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts h...

PT-2026-88742

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An uninitialized resource in WebGL allows a remote attacker to leak cross-origin data through the use of a crafted HTML page. Recommendations Update Google Chrome to version 153.0.8010....

PT-2026-87651

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description An origin validation error allows an unauthorized attacker to perform spoofing over a network, which can be used to affect the system. Recommendations At the moment, there is no informati...

PT-2026-87565

Name of the Vulnerable Software and Affected Versions Microsoft Teams for Android affected versions not specified Description An origin validation error allows an authorized attacker to disclose information over a network. Origin validation is a security mechanism used to verify that a request...

CVE-2026-69559: Origin Validation Error

Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network...

CVE-2026-69680: Origin Validation Error

Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

PT-2026-88152

Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's ow...