CVE-2026-79241: Out-of-bounds Read

Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79239: Out-of-bounds Read

Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Low...

PT-2026-81557

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue exists in Views, which could allow a remote attacker to potentially execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering ...

Remote Code Execution (RCE)

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions,...

Exploit for Improper Privilege Management in Mozilla Firefox

CVE-2026-74939 — Firefox content→parent privilege escalation...

GHSA-XM98-3VCF-FPH7 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...

Malicious code in secret-key-totp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6 [email protected] declares a postinstall hook node./index.js --setup that executes a credential stealer and dropper on install, and the same...

[SECURITY] [DSA 6463-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6463-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 24, 2026 https://www.debian.org/security/faq -...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to version 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

In canvas rendering, a compromised content process could cause a surface to change unexpectedly, leading to a memory leak in a privileged process. This memory leak could be exploited to perform a sandbox escape if the correct data was leaked. This vulnerability affects Firefox versions earlier th...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been addressed through improved enforcement of iframe sandboxing policies. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4, and iPadOS 14.4. Maliciously crafted web content may violate...

Astra Linux – Vulnerability in Chromium

Before version 100.0.4896.88, using free storage in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape through a crafted Chrome Extension...

Astra Linux – Vulnerability in Firefox, Thunderbird

It was possible to create specific XSLT markup that could bypass the iframe sandbox. This vulnerability affects Firefox ESR versions prior to 91.5, Firefox versions prior to 96, and Thunderbird versions prior to 91.5...

Astra Linux – Vulnerability in Chromium

Before version 99.0.4844.51, using the "After Free" feature in the Cast UI in Google Chrome allowed a remote attacker who convinced a user to engage in certain user interactions to potentially perform a sandbox escape through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

A process isolation vulnerability in Thunderbird stems from improper handling of JavaScript URIs. This issue could allow content to execute in the process of the top-level document, rather than in the intended frame, potentially enabling a sandbox escape. This vulnerability has been fixed in...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Mojo in Google Chrome prior to version 96.0.4664.110 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

Astra Linux – Vulnerability in WebKit2GTK

A vulnerability related to out-of-bounds writes operations has been addressed through improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4, and iPadOS 15.8.4; iOS 16.7.11 and iPadOS 16.7.11; iOS 18.3.2 and iPadOS 18.3.2; iPadOS 17.7.6; macOS Sequoia...

Astra Linux – Vulnerability in Chromium

The incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...