CVE-2026-79184

A flaw was found in Google Chrome. Missing authorization in the Preload feature allows a remote attacker, who has compromised the renderer process, to bypass the web origin policy. This can be achieved by crafting a malicious HTML page, leading to unauthorized access or actions across different w...

CVE-2026-78968

A flaw was found in Google Chrome's Core component. This missing authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to potentially spoof the address bar by using a specially crafted HTML page. This could mislead users about the authenticity of ...

CVE-2026-79112

A flaw was found in Skia, a 2D graphics library, within Google Chrome. This out-of-bounds read vulnerability could be exploited by a remote attacker who has already compromised the browser's renderer process. By presenting a specially crafted HTML page, the attacker could read sensitive memory...

CVE-2026-79177

A flaw was found in the Media component of Google Chrome on Windows. Incorrect authorization allows a remote attacker, who has already compromised the renderer process, to bypass system access restrictions. This can be achieved by crafting a malicious HTML page, leading to unauthorized access...

CVE-2026-79089

A flaw was found in Google Chrome's Transactions Platform on Android. A race condition vulnerability allows a remote attacker, through social engineering and a specially crafted HTML page, to bypass system access restrictions. This could lead to unauthorized access to sensitive system functions...

CVE-2026-79237

A flaw was found in Google Chrome's Navigation component. This incorrect authorization vulnerability allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions acros...

CVE-2026-79220

A flaw was found in Google Chrome. A remote attacker, who has already compromised the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak within the network component, allowing the attacker to obtain sensitive information...

CVE-2026-79188

A flaw was found in the ANGLE component of Google Chrome. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...

CVE-2026-79091

A flaw was found in Google Chrome's Bluetooth component. This vulnerability, a 'use-after-free' error, could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This exploitation requires social engineering to trick a user into visiting a specially crafted...

CVE-2026-79022

A flaw was found in Google Chrome. A remote attacker, leveraging social engineering, could exploit a user interface UI misrepresentation vulnerability. By crafting a malicious HTML page, the attacker could potentially spoof UI elements, which might mislead users...

CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

EUVD-2026-66632

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...

CVE-2026-32257

Winter CMS is an open-source content management system based on the Laravel PHP framework. Prior to 1.2.13 , custom CSS supplied through the Brand Settings Styles field by a user with the backend.manage_branding permission was compiled by the LESS CSS parser and rendered without sanitization on e...

CVE-2026-79004

A flaw was found in Media in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an out-of-bounds read vulnerability by using a specially crafted HTML page. This could allow the attacker to read sensitive memory outside of the browser's security sandbox, leadi...

CVE-2026-79033

A flaw was found in Chromium's DevTools. A remote attacker, leveraging social engineering, could exploit insufficient control flow management by enticing a user to open a crafted HTML page. This could potentially lead to the execution of arbitrary code within the browser's sandbox...

CVE-2026-78958

A flaw was found in Skia, a 2D graphics library used in Chromium-based browsers. A remote attacker, after compromising the renderer process, could exploit an uninitialized resource vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to obtain sensitive...

CVE-2026-78896

A flaw was found in Google Chrome. This vulnerability, located in the StorageAccessAPI, allows a remote attacker to exploit it by crafting a malicious HTML page. Successful exploitation could lead to an information leak, enabling the attacker to obtain sensitive cross-origin data...

CVE-2026-79227

A flaw was found in the DevTools component of Google Chrome. This vulnerability, caused by type confusion, allows a remote attacker to execute arbitrary code within the browser's security sandbox. This exploitation occurs when a user is tricked, via social engineering, into visiting a specially...