CVE-2026-106280: Incorrect Authorization

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106970

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the Scheduling component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loade...

PT-2026-106994

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An open redirect exists in the AppManifest, which allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one...

CVE-2026-106198: Missing Authorization

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106264: Missing Authorization

Missing authorization in Web Authentication Passkeys & Security Keys in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106266: Unintended Proxy or Intermediary

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106331: Improper Input Validation

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. Chromium security severity: Low...

PT-2026-106873

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to bypass the web origin policy, which is a security mechanism that...

PT-2026-107038

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

PT-2026-107077

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

PT-2026-107198

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary...

CVE-2026-39724: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

PT-2026-107197

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...

PT-2026-106310

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...

PT-2026-106398

Name of the Vulnerable Software and Affected Versions Progressify - Progressive Web App PWA versions prior to 1.6.1 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior...

PT-2026-106871

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107025

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. Chromium security severity: Low...

CVE-2026-106189: Improper Control of Generation of Code

Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106361: Incorrect Provision of Specified Functionality

Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106289: Missing Authorization

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...