PT-2026-88714

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the ServiceWorker allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin...

PT-2026-88716

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper initialization in Views on Windows allows a remote attacker to potentially execute arbitrary code outside the sandbox. This requires the attacker to have already compromised th...

PT-2026-88533

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A race condition exists in the FileAPI. This allows a remote attacker who has already compromised the renderer process to bypass site isolation, which is a security mechanism used to...

PT-2026-88535

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the ControlledFrame component. A remote attacker who has already compromised the renderer process can obtain sensitive information by using a specially...

PT-2026-88718

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An incorrect reference resolution in Storage on Windows allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by...

PT-2026-88551

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Downloads component. A remote attacker who has compromised the renderer process can obtain cross-origin data by using a crafted HTML page...

PT-2026-88606

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A privilege elevation issue exists in the WebUI. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox by using a...

PT-2026-88643

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Core allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is a security featu...

PT-2026-88657

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the LocalNetworkAccess component allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML...

PT-2026-88748

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue exists in ANGLE on Windows. This occurs when a remote attacker, having already compromised the renderer process, uses a specially crafted HTML page to potentially...

PT-2026-88668

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in Chromium allows a remote attacker who has compromised the renderer process to spoof UI elements through the use of crafted network traffic. Recommendations...

PT-2026-88694

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in DataTransfer allows a remote attacker who has compromised the renderer process to obtain sensitive information through a crafted HTML page. Recommendations...

PT-2026-88542

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in the Prerender component allows a remote attacker who has compromised the renderer process to potentially bypass the web origin policy using a crafted HTML pag...

PT-2026-88565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Downloads component allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations...

PT-2026-88580

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue exists in the Printing component. This occurs when a program continues to use a pointer after the memory it points to has been freed, which can lead to crashes or...

PT-2026-88595

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Scroll component. A remote attacker who has compromised the renderer process can leak cross-origin data by using a crafted HTML page. Recommendations...

PT-2026-88598

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the WebUI allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin policy is ...

PT-2026-88602

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in the Fullscreen feature allows a remote attacker to spoof UI elements using a crafted HTML page. This requires the attacker to have already compromised the...

r2frida v6.2.2

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

SUSE CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...