PT-2026-81727

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-81546

Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-81660

Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-81585

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An out-of-bounds read in ANGLE Almost Native Graphics Layer Engine, a compatibility layer that allows OpenGL ES to run on Windows, could allow a remote attacker to potentially execute...

PT-2026-81547

Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

UBUNTU-CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

PT-2026-81911

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

Browser-Pwning-

Browser-Pwning Una documentazione adeguata e ben strutturata per iniziare con il chrome pwning & il v8 pwning Struttura del documento Come è organizzato questo documento 1. Motivazione 2. Materiale di Studio Reale Motivazione I browser sono una delle tecnologie più utilizzate oggi. Su ogni comput...

CVE-2026-43655-AppleM2ScalerCSCDriver-UAF

CVE-2026-43655: use-after-free dello scheduler condiviso di AppleM2ScalerCSCDriver Divulgazione tecnica pubblica per CVE-2026-43655 , un use-after-free di AppleM2ScalerCSCDriver / IOSurfaceAccelerator raggiungibile dal sandbox predefinito delle app iOS senza autorizzazioni speciali. Apple ha...

Exploit for Improper Privilege Management in Mozilla Firefox

CVE-2026-74939 — Firefox content→parent privilege escalation...

CVE-2026-53753-Crawl4AI-RCE

CVE-2026-53753 — Esecuzione Remota di Codice non autenticata in Crawl4AI Evasione del Sandbox AST RCE pre-autenticazione in Crawl4AI.read — restituendo l'output del comando in-band nella risposta JSON...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — Fuga dalla Wasm Box Ricerca sullo sfruttamento di Firefox a catena completa: una type confusion in WebAssembly per l'esecuzione di codice nel renderer , concatenata a un bug del processo padre per una fuga dalla sandbox. Entrambi i bug sono stati corretti in Firefo...

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — SpiderMonkey WebAssembly सैंडबॉक्स एस्केप CVE-2026-2796 के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट चेन, जो Mozilla SpiderMonkey के WebAssembly इम्पोर्ट ऑप्टिमाइज़ेशन "JavaScript: WebAssembly" कंपोनेंट में JIT गलत-संकलन / टाइप-कन्फ्यूज़न है। एक क्राफ्टेड wasm मॉड्यूल संपूर्ण होस्ट प्रोसे...

Malicious code in secret-key-totp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6 [email protected] declares a postinstall hook node./index.js --setup that executes a credential stealer and dropper on install, and the same...

[SECURITY] [DSA 6463-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6463-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 24, 2026 https://www.debian.org/security/faq -...

vpod

Vpod البدء • التوثيق • المشكلات • المساهمة ما هو vpod؟ vpod هو صندوق رمل sandbox خفيف الوزن وقابل للنقل يمنح عملية غير موثوقة بيئة لينكس فورية. يستخدم بنية RISC‑V ويعمل بالكامل داخل WebAssembly. إقلاع سريع : الإقلاع في أقل من ثانية. قابل للنقل : يعمل في أي مكان دون الحاجة إلى أي إعداد. معزول : تب...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

amla-sandbox

amla-sandbox هذا المستودع هو مصدر الإصدار لحزمة بايثون amla-sandbox. يتم التطوير في مستودع amlalabs الأحادي؛ يتم تحديث هذا المستودع عند الإصدار. وقت تشغيل Rust الذي يتم ترجمته إلى amlasandbox.wasm موجود في amla-sandbox-core؛ يتم تسجيل علامة الإصدار الدقيقة التي تم بناء حزمة بايثون هذه عليها في...

Astra Linux – Vulnerability in Thunderbird, Firefox

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages. This bug only affects Thunderbird for Linux. Other operating systems are unaffected.. This vulnerability affects Firefox 108, Firefox ESR 102.6, and...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...