Google Chrome Microsoft Edge DoS

The vulnerability in the TabStrip component of Google Chrome and Microsoft Edge web browsers is related to use-after-free memory usage. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Google Chrome Microsoft Edge DoS

The vulnerability in the TabStrip component of Google Chrome and Microsoft Edge web browsers is related to improper use of memory after it has been freed. Exploiting this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Astra Linux – vulnerability in Chromium

In Google Chrome versions prior to 91.0.4472.77, out-of-bounds writes in TabStrip allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory write via a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.77, using TabStrip in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Chromium: CVE-2021-30614 Heap buffer overflow in TabStrip...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

A heap buffer overflow in TabStrip in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption via a specially crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

A heap buffer overflow in TabStrip within Google Chrome on Windows prior to version 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a specially crafted HTML page...

Astra Linux – Vulnerability in Chromium

The use of after-free in TabStrip in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in the TabStrip component in Google Chrome before version 149.0.7827.155 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

Prior to version 151.0.7922.72, using “After Free” in TabStrip within Google Chrome allowed a remote attacker to convince a user to perform certain UI gestures, thereby potentially exploiting heap corruption via a specially crafted HTML page. Chromium security severity: Medium...

CVE-2026-106148

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106148

The Kendo UI for jQuery components TabStrip , Menu , and PanelBar are vulnerable to Cross-Site Scripting (XSS) in versions prior to 2026.3.1015 . The root cause is the lack of proper escaping when inserting data source imageUrl values into single-quoted image src attributes. An attacker capable o...

EUVD-2026-102087

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106148

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

PT-2026-114933

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...