CVE-2026-87651

CVE-2026-87651 is an incorrect authorization vulnerability in the Paint component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker could obtain cross-origin data by persuading a user to open a crafted HTML page. The CVSS 3.1 score is 4.3 (Medium) with a vector of A...

CVE-2026-87498

Google Chrome versions prior to 153.0.8010.36 contain a missing authorization flaw in the WebUI component. A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to bypass the web origin policy . Chromium rates the severity as High , while the CNA-ass...

CVE-2026-87552

CVE-2026-87552 is a missing authorization vulnerability in TrustedWebActivities within Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A local attacker with a co-installed app can exploit this to obtain sensitive information. Chromium rates the severity as High ; the NVD-as...

CVE-2026-87587

A use-after-free flaw in the V8 JavaScript engine of Google Chrome (versions prior to 153.0.8010.36 ) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by luring a user into visiting a crafted HTML page. The vulnerability was rated High by Chromium and assigned a CVSS 3...

CVE-2026-87639

A use after free vulnerability in WebPackaging in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium security team rated this High severity. ...

CVE-2026-87564

CVE-2026-87564 is a type confusion vulnerability in the V8 JavaScript engine within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to read memory inside the sandbox . Google classifies the Chromium security severity as High , w...

CVE-2026-87499

CVE-2026-87499 is an incorrect authorization flaw in the Network component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could use a crafted HTML page to bypass site isolation , escalating their access beyond the intended sandbox boun...

CVE-2026-87572

CVE-2026-87572 is an injection vulnerability in DevTools within Google Chrome versions prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 base score is 8.3 (Hi...

CVE-2026-87460

A use-after-free vulnerability in the Platform component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to execute arbitrary code inside the sandbox by convincing a user to open a crafted HTML page. The vulnerability is rated High severity by Chromium and scored 8.8 on C...

CVE-2026-87542

CVE-2026-87542 is a use-after-free vulnerability in the Input component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page . The vulnerability is rated High severity by Chro...

CVE-2026-87500

CVE-2026-87500 is an improper validation of array index in ANGLE , the cross-platform 2D/3D graphics library used by Google Chrome , in versions prior to 153.0.8010.36 . A remote attacker can exploit this via a crafted HTML page to potentially execute arbitrary code outside the Chrome sandbox . T...

CVE-2026-87646

CVE-2026-87646 is a use-after-free vulnerability in Web Authentication in Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS v3.1 score is 9.6 (CRITICAL) with a changed scope (AV:N/AC:L/PR:N/UI:R/S:C/C:...

CVE-2026-87647

CVE-2026-87647 is an uninitialized resource vulnerability in the GPU component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could read memory outside the sandbox by serving a crafted HTML page. Chromium assigned a security severity o...

CVE-2026-87596

CVE-2026-87596 is an out-of-bounds read in ANGLE (the ANGLE rendering library) within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit this vulnerability by serving a crafted HTML page to a user, enabling memory reads outside the Chrome sandbox boundary. T...

CVE-2026-87514

Use after free in the Views component of Google Chrome prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the sandbox via a local program. The vulnerability is rated CVSS 8.1 (High) with a local attack vector, high complexity, and changed scope. CISA's SSVC assessmen...

CVE-2026-87650

CVE-2026-87650 is an out-of-bounds read in the WebGL component of Google Chrome versions prior to 153.0.8010.36 , rated CVSS 9.6 (Critical) . A remote attacker can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page that requires user interaction to load. CISA...

CVE-2026-87621

CVE-2026-87621 is an out-of-bounds write in the ANGLE component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by luring a user into visiting a crafted HTML page. The flaw was rated High by t...

CVE-2026-87654

CVE-2026-87654 is a buffer overflow in ANGLE , the graphics translation layer within Google Chrome on Windows . A remote attacker can execute arbitrary code outside the Chrome sandbox by luring a user to a crafted HTML page. The vulnerability affects Chrome versions prior to 153.0.8010.36 and car...

CVE-2026-87604

CVE-2026-87604 is an out-of-bounds read in ANGLE , the graphics library used by Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to potentially execute arbitrary code outside the sandbox , escalating from ...

CVE-2026-87524

CVE-2026-87524 is a use-after-free in the Core component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can exploit this via a crafted HTML page to execute arbitrary code outside the sandbox . The vulner...

CVE-2026-87569

CVE-2026-87569 is a missing authorization vulnerability in the Views component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can bypass system access restrictions by delivering a crafted HTML page to a victim. The Chromium project c...

CVE-2026-87467

A race condition in the Updater component of Google Chrome on Windows prior to version 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox via a local program. The vulnerability is rated High severity by Chromium (CVSS 3.1: 8.1, with Changed scope and High ...

CVE-2026-87520

CVE-2026-87520 is a use-after-free vulnerability in Dawn (Chromium's WebGPU implementation) affecting Google Chrome on Android prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . Chromium rates the security severity as ...

CVE-2026-87554

CVE-2026-87554 is a race condition in Chromoting (Chrome's remote desktop component) affecting Google Chrome on Windows prior to 153.0.8010.36 . A local attacker can exploit the flaw via a local program to execute arbitrary code outside the sandbox , rated High severity by Chromium and 8.1 (HIGH)...

CVE-2026-87492

CVE-2026-87492 affects the DevTools component of Google Chrome prior to 153.0.8010.36 . An incorrect authorization flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CNA-assigned CVSS 3.1 score is 9.6 (Critical) , with a network at...

CVE-2026-87517

A race condition in the Mobile component of Google Chrome on iOS prior to version 153.0.8010.36 allowed a remote attacker, leveraging social engineering, to bypass the web origin policy via a crafted HTML page. The CNA-assigned CVSS 3.1 score is 3.1 (Low) , reflecting high attack complexity and r...

CVE-2026-87633

A use-after-free vulnerability in the Views component of Google Chrome prior to version 153.0.8010.36 allows a local attacker with no prior privileges to execute arbitrary code outside the browser sandbox by inducing UI interaction. The Chromium security team rates the severity as High , with a C...

CVE-2026-87440

An out-of-bounds read in the Media component of Google Chrome (prior to 153.0.8010.36 ) allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium rates the severity as High , and the assigned CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H...

CVE-2026-87447

CVE-2026-87447 is an incorrect authorization flaw in the Network component of Google Chrome prior to 153.0.8010.36 . A remote attacker can leverage social engineering to install a crafted Chrome extension that bypasses the web origin policy , potentially gaining unauthorized access to data or fun...

CVE-2026-87525

CVE-2026-87525 is an out-of-bounds read in Chromoting , the remote desktop component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker with a local program can read memory outside the sandbox, resulting in a limited confidentiality impact with no integrity...

CVE-2026-87444

CVE-2026-87444 is a memory corruption vulnerability in the Codecs component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can execute arbitrary code inside the browser sandbox by luring a user into visiting a crafted HTML page. The vulnerability carries a CVSS 3.1 score of 8...

CVE-2026-87578

CVE-2026-87578 is a use-after-free vulnerability in the Receiver component of Google Chrome prior to version 153.0.8010.36 . An adjacent network attacker can exploit it via crafted network traffic to achieve arbitrary code execution outside the Chrome sandbox , with a CVSS 3.1 score of 8.3 (HIGH)...

CVE-2026-87438

CVE-2026-87438 is an out-of-bounds write in WebGL within Google Chrome for Android prior to 153.0.8010.36 . A remote attacker can leverage a crafted HTML page to execute arbitrary code outside the browser sandbox , rated CVSS 9.6 (Critical) with network vector, low complexity, no privileges requi...

CVE-2026-87527

CVE-2026-87527 is a buffer overflow in the WebGL component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage a crafted HTML page to execute arbitrary code outside the sandbox , achieving high impact on confidentiality, integrity, and availability with a...

CVE-2026-87585

CVE-2026-87585 is a double free vulnerability in PDFium within Google Chrome on Windows prior to version 153.0.8010.36 . A remote attacker can potentially execute arbitrary code inside the browser sandbox by delivering a crafted PDF file. The Chromium security severity is rated High with a CVSS 3...

CVE-2026-87512

A use after free vulnerability in ANGLE (the Android Native Graphics Library for EGL) in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The Chromium security team rated the ...

CVE-2026-87628

A use-after-free vulnerability in the Cast component of Google Chrome prior to version 153.0.8010.36 allows an adjacent-network attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. The Chromium project rates the severity as Critical , and the CVSS 3.1 ba...

CVE-2026-87464

A use-after-free vulnerability in WebGL in Google Chrome prior to 153.0.8010.36 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium team rated this Critical with a CVSS v3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting cha...

CVE-2026-87488

A use-after-free vulnerability in the WebGL component of Google Chrome for Android (versions prior to 153.0.8010.36 ) allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The Chromium project rates this Critical severity; the CV...

CVE-2026-36433

Actions Semiconductor Media Player Utilities v.4.46 contains an arbitrary code execution vulnerability in the firmware update toolkit components Production.dll and RdiskUpgrade.exe . According to PT Security, the toolkit performs no signature verification, no checksum, and no authentication , all...

CVE-2026-71803

money-pos 1.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, concatenating it directly into the order log description, which the frontend renders using v-html . An attacker with product crea...

CVE-2026-79513

A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows an attacker to trigger a Denial of Service by supplying a crafted MPD SegmentTimeline. The CVSS 3.1 score is 6.5 (Medium) with a network attack vector, low complexi...

CVE-2026-57825

In opam (OCaml package manager) versions before 2.5.2 , the sandbox protection mechanism can be bypassed due to mishandled symlinks during .install file processing. Specifically, installing files through .install files did not check symlink resolution on the target path, allowing a package to ins...

CVE-2026-79514

CVE-2026-79514 is an out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 . An attacker can trigger a Denial of Service by sending a crafted HTTP request. The CVSS 3.1 score is 6.5 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating a network-rea...

CVE-2026-61915

Cyrus IMAP before 3.12.4 contains a VPATCH BYPARAM double-free vulnerability. An authenticated calendar user can crash a Cyrus CalDAV worker by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource that has two or more properties of the matched kind. The root cause is that th...

CVE-2026-71616

CVE-2026-71616 is a denial of service vulnerability in the GPAC multimedia framework. The flaw resides in the gf_route_media_complete_object() function, as of commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3. An attacker can trigger a DoS by calling this function. The issue is fixed in commit 3c4e...

CVE-2026-87939

CVE-2026-87939 affects the Drupal Feed Block module, which provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability. Drupal ...

CVE-2026-61907

This vulnerability affects Cyrus IMAP prior to version 3.12.4 , where the JMAP snooze operation bypasses the destination-mailbox ACL . An authenticated user who holds insert permissions on another user's snoozed mailbox can force mail insertion into that user's inbox or any other mailbox whose ID...

CVE-2026-87953

The affected software is the SAML SSO – Service Provider Drupal module, which allows a Drupal site to act as a SAML 2.0 Service Provider for authentication via an external identity provider. The vulnerability is a Server-Side Request Forgery (SSRF) resulting from insufficient validation of URLs o...

CVE-2026-61908

Cyrus IMAP before 3.12.4 (also patched in 3.8.8 and 3.10.4) is affected by an out-of-bounds read in its JMAP email-header blob ID handling. An authenticated user can craft a JMAP blob ID of the form H- referencing an index beyond the bounds of the internal blob_headers array , causing a read past...