CVE-2026-93381

Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. Chromium security severity: High...

CVE-2026-93375

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-93375

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

EUVD-2026-82475

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-65219

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashedpassword and 2FA secrets via offsetGet...

GHSA-3JHR-MXMX-38CX Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Summary system/config/security.yaml's Twig sandbox policy allow-lists offsetget and offsetexists for Grav\Common\User\Interfaces\UserInterface. The concrete Grav\Common\User\DataUser\User class does not filter which fields offsetGet returns, so any sandboxed template with access to a User object...

GHSA-XJW5-Q542-3VMR Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Summary system/config/security.yaml's default twigsandbox.configdeniedpaths list plugins, streams, security, backups, scheduler omits the system prefix. When an operator enables the documented, non-default twigcontent.configaccess: true setting intended to safely expose low-sensitivity values lik...

GHSA-P597-CRQC-M349 Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Summary Grav\Common\Twig\Twig::init unconditionally puts the raw system, site, and theme config arrays into $this-twigvars. Twig::processPage builds the variables for the sandboxed, editor-authored page-content render by copying that same base array $sandboxvars = $twigvars; and replacing only th...

CVE-2026-92963

A flaw was found in vm2. An attacker can exploit this vulnerability by improperly accessing the VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL global variable through globalThis. This allows the attacker to retrieve sensitive internal information from the sandbox environment, leading to information...

EUVD-2026-80780

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution...

GHSA-HP3V-5VW7-FX9W RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code. string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live...

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code. string.Formatter field resolution methods such as getfield can perform attribute and item traversal internally and return live...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.3.0 ESRi MFSA 2026-93, bsc1280371 CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component. CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the...

SUSE-SU-2026:4247-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.3.0 ESRi MFSA 2026-93, bsc1280371 - CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component. - CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the...

CVE-2026-92949

A flaw was found in vm2, a JavaScript sandbox. This vulnerability allows sandboxed scripts to bypass security protections, specifically vm.freeze and vm.readonly, which are designed to prevent unauthorized modifications to objects. An attacker can exploit this by directly accessing and invoking...

CVE-2026-92958

A flaw was found in vm2, a sandbox for Node.js. When the NodeVM embedder uses a builtin wildcard with negative entries to deny specific modules, such as 'fs' for file system access, the denylist mechanism fails to block subpaths like 'fs/promises'. This allows sandboxed code to bypass the intende...