CVE-2026-19140: Use After Free

Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19146: Use of Uninitialized Variable

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-19155: Use After Free

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19163: Use After Free

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19153: Improper Input Validation

Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-19152: Protection Mechanism Failure

Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-68693

Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 151.0.7922.109 Description An out of bounds write occurs in the GPU component, which may allow a remote attacker who has already compromised the renderer process to perform a sandbox escape. This is...

PT-2026-68712

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description An integer overflow in the GPU component allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved by inducing the browser t...

PT-2026-68686

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.109 Description A use after free issue exists in Resources. This allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape by using a...

PT-2026-68692

Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 151.0.7922.109 Description A use after free issue exists in Aura, which can allow a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape by using a...

PT-2026-68697

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description Insufficient policy enforcement in Navigation allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. A sandb...

PT-2026-68698

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description Insufficient validation of untrusted input in Workers allows a remote attacker who has compromised the renderer process to bypass site isolation through the use of a crafted HTML page...

PT-2026-68700

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description A use after free issue exists in the Payments component. This flaw allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape by...

PT-2026-68722

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.109 Description Insufficient validation of untrusted input in the UI allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape. This is achieved...

Allocation of Resources Without Limits or Throttling

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An attacker can exhaust CPU resources and degrade or stall t...

CVE-2026-71321

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint "/nuxtisland/..." decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated "POST...

CVE-2026-71321

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

CVE-2026-70604

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...