CVE-2025-2783

Chromium CVE-2025-2783: Sandbox Escape & Full-Chain RCE Exploit This repository contains a full-chain exploit implementation for CVE-2025-2783. The vulnerability resides in Chromium's Ipcz communication layer, allowing an attacker to achieve sandbox escape and arbitrary code execution from a...

CVE-2026-87624

A flaw was found in Google Chrome on Android. A remote attacker, after compromising the renderer process, could exploit a user interface UI misrepresentation vulnerability. This vulnerability allows the attacker to spoof UI elements by using a specially crafted HTML page, potentially deceiving...

CVE-2026-87521

A flaw was found in WebMCP in Chromium. A remote attacker, after compromising the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive cross-origin data...

CVE-2026-87439

A flaw was found in chromium-browser's ServiceWorker. A remote attacker, who has already compromised the renderer process, could exploit this vulnerability by providing a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-87434

A flaw was found in Chromium, affecting Google Chrome. A remote attacker, having compromised the renderer process, could exploit missing authorization in Cross-Origin Resource Sharing CORS to bypass the web origin policy. This could be achieved by enticing a user to visit a crafted HTML page,...

CVE-2026-87505

A flaw was found in the FileSystem component of Chromium. A remote attacker, who has already compromised the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted PDF file. This could allow the attacker to bypass site isolation, potentially leading ...

CVE-2026-87429

A flaw was found in the ServiceWorker component of Chromium. A remote attacker, after compromising the renderer process, could exploit a missing authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...

CVE-2026-87604

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability could allow a remote attacker, who has already compromised the browser's renderer process, to potentially execute arbitrary code outside of the browser's security sandbox. This exploitation occurs when ...

CVE-2026-87506

A flaw was found in Google Chrome's WebUI. A remote attacker, after compromising the renderer process, could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to privilege elevation, allowing the attacker to execute arbitrary code outside o...

CVE-2026-87553

A flaw was found in SiteIsolation in Google Chrome. Improper input validation could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This exploitation occurs when the attacker provides a specially crafted HTML page, leadi...

CVE-2026-87453

A flaw was found in chromium-browser's BackgroundFetch component. A remote attacker, who has already compromised the renderer process, could exploit a confused deputy vulnerability by using a specially crafted HTML page. This could lead to the disclosure of sensitive information...

CVE-2026-87543

A flaw was found in Google Chrome. A remote attacker who has compromised the renderer process can exploit a missing authorization vulnerability by crafting a malicious HTML page. This allows them to bypass site isolation, which is a security mechanism designed to protect user data and prevent...

CVE-2026-87618

A flaw was found in Google Chrome. This vulnerability involves incorrect reference resolution within the browser's Storage component. A remote attacker, who has already compromised the browser's renderer process, could exploit this by enticing a user to visit a specially crafted HTML page...

CVE-2026-87502

A flaw was found in Google Chrome. This confused deputy vulnerability in the Fullscreen feature allows a remote attacker, who has compromised the renderer process and leveraged social engineering, to spoof user interface UI elements. This can be achieved by presenting a specially crafted HTML pag...

CVE-2026-87572

A flaw was found in the DevTools component of Chromium. A remote attacker, after compromising the renderer process, could exploit an injection vulnerability by crafting a malicious HTML page. This could potentially lead to the execution of arbitrary code outside the sandbox, allowing the attacker...

CVE-2026-87580

A flaw was found in Google Chrome. An incorrect authorization vulnerability in WebAppInstalls could allow a remote attacker to bypass site isolation. This exploitation requires the attacker to first compromise the renderer process and then leverage social engineering through a crafted HTML page...

CVE-2026-87568

A flaw was found in Chromium. This improper input validation vulnerability allows a remote attacker, who has compromised the renderer process, to spoof user interface UI elements. This can be achieved by sending crafted network traffic, potentially deceiving users or leading to further attacks...

CVE-2026-87557

A flaw was found in chromium-browser. A remote attacker, who has already compromised the renderer process, could exploit a missing authorization vulnerability in LocalNetworkAccess. This could allow the attacker to bypass system access restrictions by using a specially crafted HTML page...

CVE-2026-87576

A flaw was found in the GPU component of Google Chrome on Android. A remote attacker, who has already compromised the renderer process, could exploit an uninitialized resource vulnerability by crafting a malicious HTML page. This could allow the attacker to read memory outside of the sandbox,...

CVE-2026-87640

A flaw was found in WebView in Google Chrome on Android. A remote attacker who has compromised the renderer process could exploit an out-of-bounds read vulnerability by crafting a malicious HTML page. This could lead to the disclosure of memory outside of the sandbox, potentially exposing sensiti...