CVE-2026-79017

A flaw was found in Chromium. A race condition in the Extensions component allows a remote attacker to bypass system access restrictions by using a specially crafted Chrome extension. This could lead to unauthorized access to system resources...

CVE-2026-79099

A flaw was found in Google Chrome's Network component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, leading to unauthorized access or actions within the affected...

CVE-2026-97417

A flaw was found in the Linux kernel's netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options throu...

CVE-2026-79108

A flaw was found in Google Chrome's Web Authentication Passkeys & Security Keys feature. A remote attacker could leverage social engineering techniques by presenting a crafted HTML page to a user. This misrepresentation in the user interface could allow the attacker to bypass system access...

CVE-2026-79125

A flaw was found in Google Chrome. This information leak vulnerability, specifically within the XR component, allows a remote attacker to obtain sensitive information. The attacker can achieve this by enticing a user to visit a specially crafted HTML page. This could lead to the unauthorized...

CVE-2026-79129

A flaw was found in Google Chrome on Android. A remote attacker, leveraging social engineering, could exploit a use-after-free vulnerability in the Sessions component. This flaw allows the attacker to execute arbitrary code outside the sandbox through user interface interaction, potentially leadi...

CVE-2026-78947

A flaw was found in Chromium, a component of Google Chrome. This vulnerability, caused by incomplete cleanup, allows a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could gain unauthorized access to sensitiv...

CVE-2026-79001

A flaw was found in Bluetooth in Google Chrome. A remote attacker, who has compromised the renderer process and leveraged social engineering, could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to the disclosure of sensitive information...

CVE-2026-93353

A flaw was found in copyparty. The Secure File Transfer Protocol SFTP service fails to enforce access restrictions during directory creation, removal, and file attribute modification operations. An authenticated remote attacker can exploit this issue by traversing symbolic links that lead outside...

CVE-2026-79148

A flaw was found in DevTools in Google Chrome. An off-by-one error exists that a remote attacker could exploit by leveraging social engineering to persuade a user to install a malicious Chrome extension. This vulnerability could potentially allow the attacker to read sensitive memory within the...

CVE-2026-79233

A flaw was found in CustomTabs in Google Chrome on Android. A remote attacker could exploit a user interface UI misrepresentation vulnerability by crafting a malicious HTML page. This could allow the attacker to spoof the address bar, potentially deceiving users about the authenticity of a websit...

CVE-2026-78974

A flaw was found in chromium-browser. This user interface UI misrepresentation vulnerability allows a remote attacker, through social engineering, to bypass system access restrictions by tricking a user into interacting with a specially crafted HTML page. This could lead to unauthorized access to...

CVE-2026-79152

A flaw was found in Google Chrome CustomTabs. A local attacker could exploit incorrect authorization to bypass the web origin policy through a co-installed application. This bypass could allow unauthorized access to web content...

CVE-2026-93541

A flaw was found in libXi. An out-of-bounds read vulnerability in the XQueryDeviceState function allows a malicious X server to trigger an application crash. By returning a specially crafted response to a device state query, the server causes the client application to read memory beyond allocated...

CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-93477

A flaw was found in Ash. During bulk update and bulk destroy operations, the framework fails to restrict private action arguments that should only be configured by trusted server-side code. An attacker who can supply parameters to these bulk actions can set arbitrary private arguments. This...

CVE-2026-79143

A flaw was found in Google Chrome's FileSystem component. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By leveraging social engineering techniques with a specially crafted HTML page, an attacker can exploit this flaw, leading to...

CVE-2026-79006

A flaw was found in Google Chrome. This vulnerability, located in the HttpsUpgrades component, allows a remote attacker to bypass the web origin policy. By sending specially crafted network traffic, an attacker could circumvent security restrictions designed to isolate content from different...

CVE-2026-79122

A flaw was found in Google Chrome. A remote attacker could exploit an information leak vulnerability in the SignIn component by sending crafted network traffic. This could allow the attacker to obtain sensitive information...

CVE-2026-79195

A flaw was found in Chromium. A remote attacker could exploit a use-after-free vulnerability within the Script component. By enticing a user to visit a specially crafted HTML page, the attacker could execute arbitrary code inside the sandbox...

CVE-2026-78909

A flaw was found in Google Chrome. This use-after-free vulnerability in the Views component allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by leveraging social engineering tactics to entice a user to visit a specially crafted HTM...

CVE-2026-84333

A flaw was found in Dawn, a component of Google Chrome on Android. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution outside of the browser's sandbox, allowing the attacker to gain...

CVE-2026-79026

A flaw was found in Google Chrome Extensions. This use-after-free vulnerability allows a remote attacker, leveraging social engineering, to potentially execute arbitrary code outside the sandbox. This occurs when a user is convinced to install a specially crafted Chrome extension, leading to...

CVE-2026-87608

A flaw was found in Chromium's Federated Credential Management FedCM component. A remote attacker, leveraging social engineering, could exploit improper certificate validation by sending crafted network traffic. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-79197

A flaw was found in V8 in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-87551

A flaw was found in chromium-browser. This vulnerability involves improper certificate validation within the Cross-Origin Resource Sharing CORS mechanism. A remote attacker, by leveraging social engineering tactics and crafted network traffic, could bypass the web origin policy. This could lead t...

CVE-2026-87437

A flaw was found in Google Chrome's Frames component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to the leakage of sensitive information...

CVE-2026-87602

A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to read memory outside of the browser's security sandbox, leading to information...

CVE-2026-87544

A flaw was found in Chromium. A remote attacker could exploit incorrect authorization in Extensions by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions and gain access to a privileged page...

CVE-2026-87601

A flaw was found in V8, the JavaScript engine used in Google Chrome. This race condition vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user visits a specially crafted HTML page...

CVE-2026-87571

A flaw was found in Google Chrome. Improper certificate validation in the Loader component allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. This bypass could enable an attacker to circumvent security restrictions designed to isolat...

CVE-2026-87469

A flaw was found in Extensions in Google Chrome. Improper input validation allows a remote attacker to bypass the web origin policy. This can lead to unauthorized access to privileged pages through specially crafted network traffic...

CVE-2026-87605

A flaw was found in Google Chrome's Contacts feature. A remote attacker, after compromising the renderer process and employing social engineering tactics, could potentially exploit this missing authorization. This could allow the attacker to obtain sensitive user information by tricking a user in...

CVE-2026-87463

A flaw was found in chromium-browser. This incorrect authorization in the Certificate component allows a remote attacker to potentially spoof the address bar. This could lead to users being misled about the authenticity of a website...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-87656

A flaw was found in Chromium's Safebrowsing component. Improper state validation allows a remote attacker to bypass system access restrictions by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to system resources...

CVE-2026-87627

A flaw was found in chromium-browser. A remote attacker, leveraging social engineering, could exploit an interpretation conflict in Safebrowsing by using a crafted file. This could allow the attacker to bypass system access restrictions...

CVE-2026-87631

A flaw was found in Google Chrome. Missing authorization in the Document Object Model DOM could allow a remote attacker to potentially leak sensitive information. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page...

CVE-2026-87575

A flaw was found in Google Chrome. This incorrect authorization vulnerability in the Loader component allows a remote attacker, through social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page, leading to unauthorized...

CVE-2026-87522

A flaw was found in WebView in Google Chrome on Android. Missing authorization allows a remote attacker, by leveraging social engineering and crafted network traffic, to potentially bypass system access restrictions. This could lead to unauthorized access to sensitive system functions...

CVE-2026-87546

A flaw was found in the Safebrowsing component of Chromium. An incorrect type conversion or cast vulnerability allows a remote attacker to bypass system access restrictions by providing a specially crafted file. This could lead to unauthorized access to system resources...

CVE-2026-87477

A flaw was found in Core in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation would result in the leakage of sensitive information...

CVE-2026-87617

A flaw was found in DevTools in Google Chrome. This vulnerability, a 'use after free' error, occurs when a program attempts to use memory after it has been freed, which can lead to unpredictable behavior. A remote attacker could exploit this by leveraging social engineering to entice a user to...

CVE-2026-87459

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Select component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-87473

A flaw was found in the FileHandling component of Google Chrome. A remote attacker could exploit this vulnerability by leveraging social engineering techniques with a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, potentially leading to unauthoriz...

CVE-2026-87509

A flaw was found in the Google Chrome Updater. This incorrect authorization vulnerability allows a local attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by exploiting the flaw through a local program, leading to unauthorized code execution on the...

CVE-2026-87489

A flaw was found in V8, the JavaScript engine used in Google Chrome. This memory corruption vulnerability allows a remote attacker to potentially execute arbitrary code within the browser's sandbox by tricking a user into installing a specially crafted Chrome extension. This could lead to...

CVE-2026-87448

A flaw was found in DevTools in Google Chrome. This vulnerability, a use-after-free, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation occurs when a user visits a specially crafted HTML page...

CVE-2026-87433

A flaw was found in Google Chrome. A race condition in the FileAPI component allows a remote attacker, who has already compromised the renderer process, to bypass site isolation. This bypass can be achieved by providing a specially crafted HTML page...

CVE-2026-87641

A flaw was found in the Chromium Browser. A remote attacker could exploit a race condition by enticing a user to visit a specially crafted HTML page. This vulnerability could allow the attacker to bypass system access restrictions...