CVE-2026-17850

An inappropriate implementation flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519078527...

SUSE CVE-2026-55430

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost which prefers the X-Forwarded-Host header over the real Host header. No middleware...

CVE-2026-18005

An inappropriate implementation flaw was found in the WebXR component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522300211...

CVE-2026-17785

An uninitialized use flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513769898...

CVE-2026-17884

An object lifecycle issue flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523692228...

CVE-2026-17800

A side-channel information leakage flaw was found in the MediaRecording component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514480948...

CVE-2026-17829

An insufficient policy enforcement flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517705103...

CVE-2026-17852

An inappropriate implementation flaw was found in the Media Router component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519348818...

CVE-2026-17896

An use after free flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=525331547...

CVE-2026-17891

An use after free flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=524639223...

CVE-2026-17848

An insufficient validation of untrusted input flaw was found in the Codecs component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518284253...

CVE-2026-17772

An out of bounds read flaw was found in the WebGL component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513197846...

CVE-2026-17663

An insufficient validation of untrusted input flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500225310...

CVE-2026-17697

A type confusion flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517575864...

CVE-2026-17712

A race flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520535595...

CVE-2026-17673

An integer overflow flaw was found in the QUIC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513735177...

CVE-2026-17781

An inappropriate implementation flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513502990...

CVE-2026-17928

An inappropriate implementation flaw was found in the DataTransfer component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513762372...

undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...

undici: undici: HTTP header injection via unvalidated blob-like body type property

A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a type property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed CRLF sequences. This vulnerability enables the attacker to append arbitrary HTTP headers...