brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

CVE-2026-87620

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Scalable Vector Graphics SVG rendering engine by enticing a user to open a specially crafted HTML page. This could lead to the disclosure of sensitive information...

CVE-2026-87614

A flaw was found in ServiceWorker in Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker who has already compromised the browser's rendering engine to bypass the web origin policy. Bypassing this policy could enable unauthorized access to data o...

CVE-2026-82805

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and...

CVE-2026-82805

Typora (versions up to 1.13.8/1.14.6) is affected by a cross-site scripting (XSS) vulnerability in its Mermaid Rendering Engine . The flaw is triggered by manipulation of the classDef/style argument, and the attack can be launched remotely, though it requires user interaction (e.g., opening a cra...

EUVD-2026-68614

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and...

Astra Linux – Vulnerability in WebKit2GTK

A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, and iPadOS 15.2, as well as watchOS 8.3. Processing maliciously crafted web content may...

CVE-2026-74969

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-19149 vulnerabilities

Vulnerabilities for packages: chromium...

[SECURITY] Fedora 43 Update: webkitgtk-2.52.5-1.fc43

WebKitGTK is the port of the WebKit web rendering engine to the GTK platform...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

[SECURITY] Fedora 43 Update: webkitgtk-2.52.4-1.fc43

WebKitGTK is the port of the WebKit web rendering engine to the GTK platform...

CVE-2026-25681

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

GHSA-RFH7-FXQC-Q52V @angular/platform-server: SSRF via Hostname Hijacking

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server. The issue stems from how the server-side rendering SSR engine processes the request URL provided to the rendering entry points. When an absolute-form URL e.g., http://evil.com is passed to the rendering...

[SECURITY] Fedora 43 Update: webkitgtk-2.52.1-1.fc43

WebKitGTK is the port of the WebKit web rendering engine to the GTK platform...

CVE-2026-21513

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-21513

CVE-2026-21513 is a security feature bypass vulnerability in the MSHTML Framework. Affected component: MSHTML/MSHTML Framework used by Windows’ browsing/rendering stack. Root cause details are described in vendor advisories and security blogs as a protection mechanism bypass that can be triggered...

CVE-2025-67843

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...

CVE-2025-67843

A Server-Side Template Injection SSTI vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file...