{"Cloud":true,"Homeassistant":true,"Plex":true,"Proxmox1":true,"Proxmox2":true,"SecurityAlerts":[{"Title":"NCSC-2026-0402 [1.00] [M/H] Kwetsbaarheid verholpen in Atlassian Data Center producten","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0402","Description":"De kwetsbaarheid bevindt zich in meerdere producten binnen het Atlassian Data Center-platform, waaronder Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible en Fisheye. De kwetsbaarheid betreft een Arbitrary File Access-probleem waarmee ongeauthenticeerde aanvallers specifieke bestanden binnen de rootdirectory van de webapplicatie kunnen benaderen. Exploitatie vereist kennis van het exacte bestandspad en de bestandsnaam. Hierdoor kunnen mogelijk gevoelige bestanden worden uitgelezen. De kwetsbaarheid vormt daarmee een risico voor de vertrouwelijkheid van gegevens en configuratie-informatie die door de getroffen applicaties worden beheerd.","Guid":"NCSC-2026-0402 [1.00]","PubDate":"2026-10-06T18:47:26+02:00","AdvisoryID":"NCSC-2026-0402","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0401 [1.00] [M/H] Kwetsbaarheid verholpen in Microsoft Exchange Server","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0401","Description":"Microsoft heeft out-of-band, vooruitlopend op de maandelijkse update voor oktober, een kwetsbaarheid verholpen in Microsoft Exchange Server. De kwetsbaarheid betreft zwakke autorisatiecontroles binnen Microsoft Exchange Server. Een geauthenticeerde aanvaller kan hierdoor op afstand via het netwerk privileges escaleren. Dit betekent dat een aanvaller met geldige inloggegevens hogere rechten kan verkrijgen dan waarvoor deze geautoriseerd is, wat kan leiden tot ongeautoriseerde administratieve acties binnen de Exchange Server-omgeving.\n\nVoor Exchange Online zijn geen acties vereist. Microsoft heeft hiervoor centraal updates uitgerold. Deze kwetsbaarheid vereist wel actie voor organisaties die Exchange on premise hebben draaien.","Guid":"NCSC-2026-0401 [1.00]","PubDate":"2026-10-06T10:23:53+02:00","AdvisoryID":"NCSC-2026-0401","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0400 [1.00] [M/H] Dell heeft kwetsbaarheden verholpen in Container storage modules ","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0400","Description":"Dell heeft de kwetsbaarheden verholpen in Container Storage Modules versie 1.18.0 en hoger. De kwetsbaarheden bevinden zich in Dell Container Storage Modules (CSM), die worden gebruikt voor de integratie van Dell-opslagsystemen met containerplatformen zoals Kubernetes en OpenShift. De ge\u00EFdentificeerde kwetsbaarheden omvatten onder meer authenticatie- en autorisatiebypasses, privilege-escalatie, informatielekken en kwetsbaarheden in CSM-componenten en CSI-drivers.\n\nAfhankelijk van de specifieke kwetsbaarheid en de netwerkpositie en privileges van de aanvaller, kunnen aanvallers zonder authenticatie of met beperkte rechten onder andere administratieve toegang tot CSM verkrijgen, gevoelige informatie zoals Kubernetes Secrets uitlezen, RBAC-configuraties manipuleren en in het geval van bepaalde kwetsbaarheden root-level toegang tot Kubernetes-clusternodes verkrijgen. In de meest ernstige gevallen kan hierdoor de volledige CSM-omgeving en de gekoppelde storage-infrastructuur worden gecompromitteerd.\n\nMisbruik van de kwetsbaarheden kan daarmee leiden tot een aantasting van de vertrouwelijkheid, integriteit en beschikbaarheid van getroffen Kubernetes-/OpenShift-omgevingen en de daaraan gekoppelde Dell-opslaginfrastructuur.","Guid":"NCSC-2026-0400 [1.00]","PubDate":"2026-10-05T15:51:05+02:00","AdvisoryID":"NCSC-2026-0400","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0399 [1.00] [M/H] Kwetsbaarheid verholpen in Citrix NetScaler ADC en NetScaler Gateway","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0399","Description":"Citrix heeft een kwetsbaarheid verholpen in NetScaler ADC en NetScaler Gateway. De kwetsbaarheid betreft een geheugenoverflow in versies van NetScaler ADC en NetScaler Gateway die ouder zijn dan 14.1-73.41 en 13.1-64.28. Deze kwetsbaarheid kan leiden tot een Denial of Service (DoS) waarbij de normale beschikbaarheid van de dienst wordt verstoord.","Guid":"NCSC-2026-0399 [1.00]","PubDate":"2026-10-04T13:19:06+02:00","AdvisoryID":"NCSC-2026-0399","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0398 [1.00] [M/H] Kwetsbaarheid verholpen in Fortinet FortiMail","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0398","Description":"Fortinet heeft een kwetsbaarheid verholpen in FortiMail. FortiMail bevat een kritieke kwetsbaarheid (CVE-2026-104286) in de verwerking van bestandspaden, veroorzaakt door een combinatie van Path Traversal (CWE-22) en onvoldoende neutralisatie van NULL-bytes (CWE-158). Een niet-geauthenticeerde aanvaller kan via speciaal vervaardigde HTTP- of HTTPS-verzoeken willekeurige bestanden op het onderliggende systeem schrijven. De kwetsbaarheid wordt actief ge\u00EBxploiteerd. Getroffen zijn FortiMail 7.2.0\u20137.2.9, 7.4.0\u20137.4.8, 7.6.0\u20137.6.6 en 8.0.0\u20138.0.1 waarbij de functionaliteit IBE (Identity Based Encryption) is aangezet. Deze functionaliteit maakt versleuteling naar derden mogelijk zonder dat zij over bekende certificaten beschikken.\n\nFortinet heeft Indicators of Compromise (IoC\u0027s) beschikbaar gesteld waarmee organisaties kunnen onderzoeken of er mogelijk misbruik van de kwetsbaarheid heeft plaatsgevonden. Gezien de actieve exploitatie van FortiMail is het raadzaam om naast het installeren van de beveiligingsupdate ook onderzoek uit te voeren naar mogelijke compromittering. Hierbij kunnen de door Fortinet gepubliceerde IoC\u0027s worden gebruikt als onderdeel van de forensische controle.","Guid":"NCSC-2026-0398 [1.00]","PubDate":"2026-10-02T09:21:47+02:00","AdvisoryID":"NCSC-2026-0398","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0397 [1.00] [M/H] Kwetsbaarheid verholpen in Apple CoreGraphics","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0397","Description":"Apple heeft een kwetsbaarheid verholpen in CoreGraphics op iOS, iPadOS en macOS. De kwetsbaarheid betreft een out-of-bounds write in de CoreGraphics component. Een aanvaller kan deze kwetsbaarheid misbruiken door speciaal vervaardigde bestanden te verwerken, wat kan leiden tot het uitvoeren van willekeurige code. Deze kwetsbaarheid is gebruikt in gerichte aanvallen op iOS-versies v\u00F3\u00F3r iOS 27. De kwetsbaarheid komt voor in meerdere Apple besturingssystemen.","Guid":"NCSC-2026-0397 [1.00]","PubDate":"2026-10-01T12:35:52+02:00","AdvisoryID":"NCSC-2026-0397","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in Zammad","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0396","Description":"Er zijn twee zeroday-kwetsbaarheden aangetroffen in Zammad. De eerste kwetsbaarheid heeft het kenmerk CVE-2026-102489 toegekend gekregen. De kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende op afstand in staat om willekeurige code uit te voeren. De kwetsbaarheid is aanwezig in Zammad versies 6.3.0 tot en met 6.5.4.\n\nDe tweede kwetsbaarheid heeft het kenmerk CVE-2026-102490 toegekend gekregen. Deze kwetsbaarheid stelt een kwaadwillende die over lage rechten beschikt in staat om rootrechten te verkrijgen op het kwetsbare systeem. Deze kwetsbaarheid is aanwezig in alle gangbare versies van Zammad.\n\nDe kwetsbaarheden worden in ieder geval sinds 21 september 2026 actief misbruikt voor het op afstand verkrijgen van rootrechten op het systeem waar Zammad op draait.","Guid":"NCSC-2026-0396 [1.00]","PubDate":"2026-09-30T19:31:14+02:00","AdvisoryID":"NCSC-2026-0396","Versie":"1.00","Kans":"H","Schade":"H"},{"Title":"NCSC-2026-0395 [1.00] [M/H] Kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0395","Description":"Cisco heeft een kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager. De kwetsbaarheid bevindt zich in een API van Cisco Catalyst SD-WAN Manager. Door onjuiste verwerking van URI-encoding kunnen ongeauthenticeerde kwaadwillenden authenticatiemechanismen omzeilen. Hierdoor kan de kwaadwillende administratieve toegang tot het systeem verkrijgen en de controle over het systeem overnemen.","Guid":"NCSC-2026-0395 [1.00]","PubDate":"2026-09-30T16:43:36+02:00","AdvisoryID":"NCSC-2026-0395","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0394 [1.01] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394","Description":"Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00F3\u00F3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00F3\u00F3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00F3\u00F3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00F3\u00F3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201CNetScaler ADC\u201D) en Citrix NetScaler Gateway-systemen (\u201CNetScaler Gateway\u201D). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando\u0027s uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.\n\n","Guid":"NCSC-2026-0394 [1.01]","PubDate":"2026-09-30T10:38:43+02:00","AdvisoryID":"NCSC-2026-0394","Versie":"1.01","Kans":"H","Schade":"H"},{"Title":"NCSC-2026-0389 [1.01] [M/H]  Kwetsbaarheid verholpen in WordPress","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0389","Description":"De ontwikkelaars van WordPress hebben een kwetsbaarheid verholpen in WordPress.\n\n Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-87902 misbruiken, om zonder authenticatie een lokaal PHP-bestand buiten de actieve themamappen door WordPress te laten inladen. Onder bepaalde voorwaarden met betrekking tot het actieve thema en de serverconfiguratie kan de kwetsbaarheid leiden tot het uitvoeren van willekeurige code op de server. Hierdoor kan een kwaadwillende mogelijk toegang krijgen tot gevoelige gegevens, wijzigingen aanbrengen of verdere controle verkrijgen over de getroffen WordPress-installatie.\n\n\n**Update: **Openbare bronnen melden dat er misbruik van de kwetsbaarheid is waargenomen.","Guid":"NCSC-2026-0389 [1.01]","PubDate":"2026-09-24T11:14:33+02:00","AdvisoryID":"NCSC-2026-0389","Versie":"1.01","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0393 [1.00] [M/H] Kwetsbaarheden verholpen in  Adobe Campaign Classic","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0393","Description":"Adobe heeft 18 kritieke kwetsbaarheden verholpen in Adobe Campaign Classic. De kwetsbaarheden betreffen onder meer code- en OS-command-injectie, SQL-injectie, onvoldoende autorisatie, onvoldoende invoervalidatie en Server-Side Request Forgery (SSRF). Alle 18 kwetsbaarheden zijn als kritiek aangemerkt en tien kunnen zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het uitvoeren van willekeurige code, privilege-escalatie, het omzeilen van beveiligingsmaatregelen, het uitlezen van bestanden en Denial-of-Service.\n\nDe kwetsbaarheden met kenmerk CVE-2026-82004, CVE-2026-73369, CVE-2026-84412, CVE-2026-89275, CVE-2026-75723, CVE-2026-75699, CVE-2026-75703 en CVE-2026-75721 hebben een CVSS-score van 10,0 en kunnen zonder authenticatie en gebruikersinteractie op afstand worden misbruikt. Voor zeven hiervan noemt Adobe willekeurige code-uitvoering als mogelijke impact. Voor CVE-2026-75703 noemt Adobe Denial-of-Service als impact.","Guid":"NCSC-2026-0393 [1.00]","PubDate":"2026-09-24T08:43:17+02:00","AdvisoryID":"NCSC-2026-0393","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0392 [1.00] [M/H] Kwetsbaarheden verholpen in IBM Langflow OSS en IBM MQ Appliance","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0392","Description":"IBM heeft 12 kwetsbaarheden verholpen in IBM MQ, IBM MQ Appliance en Langflow OSS. De kwetsbaarheden kunnen leiden tot het uitvoeren van willekeurige code of commando\u0027s. Vier kwetsbaarheden zijn als kritiek aangemerkt en kunnen zonder authenticatie en gebruikersinteractie op afstand worden misbruikt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-10747 heeft een CVSS-score van 10,0 en betreft een heap-based buffer overflow in IBM MQ. De kwetsbaarheden met kenmerk CVE-2026-79724, CVE-2026-85025 en CVE-2026-81204 hebben een CVSS-score van 9,8 en bevinden zich in Langflow OSS. Een niet-geauthenticeerde kwaadwillende kan deze kwetsbaarheden misbruiken om willekeurige code of OS-commando\u0027s uit te voeren. De overige kwetsbaarheden in Langflow hebben een CVSS-score van 8,8 en vereisen geauthenticeerde toegang.","Guid":"NCSC-2026-0392 [1.00]","PubDate":"2026-09-23T16:33:27+02:00","AdvisoryID":"NCSC-2026-0392","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0386 [1.01] [H/H] Kwetsbaarheid verholpen in F5 Networks BIG-IP Access Policy Manager","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0386","Description":"F5 Networks heeft een kwetsbaarheid verholpen in BIG-IP Access Policy Manager (APM). De kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende in staat om malafide code uit te voeren. Hiertoe dient de kwaadwillende malafide netwerkverkeer naar het kwetsbare systeem te versturen. BIG-IP APM-systemen zijn alleen kwetsbaar wanneer een access policy is geconfigureerd en het systeem dienstdoet als OAuth Authorisation Server.\n\nF5 Networks geeft aan dat het een zeroday-kwetsbaarheid is die actief wordt misbruikt.","Guid":"NCSC-2026-0386 [1.01]","PubDate":"2026-09-23T15:41:38+02:00","AdvisoryID":"NCSC-2026-0386","Versie":"1.01","Kans":"H","Schade":"H"},{"Title":"NCSC-2026-0391 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Connect en Adobe Connect Android Mobile App","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0391","Description":"Adobe heeft 9 kwetsbaarheden verholpen in Adobe Connect en de Adobe Connect Android Mobile App. De kwetsbaarheden zijn verholpen in Adobe Connect 12.12 en Adobe Connect Android Mobile App 4.5. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Adobe Connect, waaronder SQL-injectie, Cross-Site Scripting (XSS), onvoldoende invoervalidatie, path traversal en onvoldoende certificaatvalidatie. De kwetsbaarheden hebben CVSS-scores vari\u00EBrend van middel tot kritiek. Van de in totaal 9 kwetsbaarheden zijn zeven door Adobe als kritiek aangemerkt. Succesvol misbruik kan onder meer leiden tot het uitvoeren van willekeurige code, privilege-escalatie, het uitlezen van bestanden en het omzeilen van beveiligingsmaatregelen.\n\nVan de zeven kwetsbaarheden die als kritiek zijn aangemerkt, hebben zes een CVSS-score van 9,3 of hoger. De kwetsbaarheid met kenmerk CVE-2026-75682 heeft met een CVSS-score van 9,9 de hoogste score en betreft een SQL-injectiekwetsbaarheid waarmee een laaggeprivilegieerde kwaadwillende willekeurige code kan uitvoeren. \n\nDe kwetsbaarheden met kenmerk CVE-2026-75684, CVE-2026-75689 en CVE-2026-75697 betreffen opgeslagen XSS-kwetsbaarheden die kunnen leiden tot privilege-escalatie. CVE-2026-75686 betreft onvoldoende invoervalidatie en CVE-2026-75698 een reflected XSS-kwetsbaarheid en succesvol misbruik kan leiden tot het uitvoeren van willekeurige code. Voor deze vijf kwetsbaarheden is geen authenticatie vereist, maar wel gebruikersinteractie. \n\nCVE-2026-34689 betreft een path-traversalkwetsbaarheid met een CVSS-score van 8,6 waarmee een niet-geauthenticeerde kwaadwillende zonder gebruikersinteractie bestanden kan uitlezen.\n\nAdobe meldt niet op de hoogte te zijn van actief misbruik van de kwetsbaarheden.","Guid":"NCSC-2026-0391 [1.00]","PubDate":"2026-09-23T15:32:29+02:00","AdvisoryID":"NCSC-2026-0391","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0390 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Experience Manager Forms JEE","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0390","Description":"Adobe heeft 6 kwetsbaarheden verholpen in Adobe Experience Manager (AEM) Forms op Java Enterprise Edition (JEE), waaronder AEM 6.5 Forms en AEM 6.5 LTS Forms. De kwetsbaarheden betreffen verschillende beveiligingsproblemen, waaronder onjuiste autorisatie, onvoldoende invoervalidatie, Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS) en Cross-Site Request Forgery (CSRF). Alle zes kwetsbaarheden zijn als kritiek aangemerkt en twee kunnen zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het uitvoeren van willekeurige code, privilege-escalatie en het omzeilen van beveiligingsmaatregelen.\n\nCVE-2026-75745 heeft met een CVSS-score van 9,8 de hoogste score en kan zonder authenticatie en gebruikersinteractie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Adobe meldt niet op de hoogte te zijn van actief misbruik.","Guid":"NCSC-2026-0390 [1.00]","PubDate":"2026-09-23T15:28:14+02:00","AdvisoryID":"NCSC-2026-0390","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0388 [1.00] [M/H] Kwetsbaarheden verholpen in SolarWinds Observability Self-Hosted","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0388","Description":"SolarWinds heeft kwetsbaarheden verholpen in SolarWinds Observability Self-Hosted. De kwetsbaarheden maken ongeauthenticeerde remote code execution mogelijk. E\u00E9n kwetsbaarheid ontstaat door deserialisatie van onbetrouwbare data tijdens het gebruik van een specifieke communicatiemodus binnen de software. De andere kwetsbaarheid wordt veroorzaakt door onvoldoende integriteitscontroles, met name bij installaties die afwijken van de standaardconfiguraties en niet-beveiligde instellingen gebruiken. Aanvallers kunnen deze kwetsbaarheden misbruiken om op afstand willekeurige code uit te voeren zonder authenticatie.","Guid":"NCSC-2026-0388 [1.00]","PubDate":"2026-09-23T11:09:24+02:00","AdvisoryID":"NCSC-2026-0388","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0365 [1.01] [H/H] Kwetsbaarheden verholpen in Check Point VPN-producten","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0365","Description":"Check Point heeft twee kritieke kwetsbaarheden verholpen in Quantum Security Gateway en Security Management. De kwetsbaarheid met kenmerk CVE-2026-85102 heeft een CVSS-score van 9,8. De kwetsbaarheid bevindt zich in het VPN-onderhandelingsproces van de Quantum Security Gateway en wordt veroorzaakt door onjuiste validatie van certificaatvertrouwen. Hierdoor kan een niet-geauthenticeerde externe aanvaller authenticatiecontroles omzeilen en willekeurige code uitvoeren op de Security Gateway. Exploitatie vindt plaats tijdens de VPN-onderhandeling, waarbij certificaatgegevens onvoldoende worden gevalideerd. De kwetsbaarheid geldt voor Security Gateway en Check Point Spark Firewall wanneer Site-to-Site VPN of Remote Access VPN wordt gebruikt.  \nVoor Site-to-Site VPN adviseert Check Point om implied rules for VPN uit te schakelen en VPN-toegang voor UDP/500 en UDP/4500 alleen expliciet toe te staan voor de specifieke peer-IP-adressen. Deze mitigatie is niet van toepassing op lokaal beheerde Spark Firewalls.\n\nDe kwetsbaarheid met kenmerk CVE-2026-85103 heeft een CVSS-score van 9,8. Het betreft een heap-based buffer overflow in de ASN.1-decoding van VPN-certificaten, veroorzaakt door onjuiste verwerking van ASN.1-datastructuren tijdens de certificaatverwerking. Een niet-geauthenticeerde externe aanvaller kan deze kwetsbaarheid misbruiken om willekeurige code uit te voeren op het getroffen systeem. De kwetsbaarheid bevindt zich in een component die onderdeel is van de VPN-infrastructuur en kan bij succesvolle exploitatie de vertrouwelijkheid, integriteit en beschikbaarheid van het getroffen systeem be\u00EFnvloeden.\n\nHet NCSC verwacht dat op korte termijn pogingen tot grootschalig misbruik zullen plaatsvinden en roept organisaties op de advisory van Check Point met spoed op te volgen.\n\n**Update:**\nCheck Point meldt dat misbruik van de kwetsbaarheid met kenmerk CVE-2026-85102 is waargenomen. Het NCSC adviseert de advisory van Check Point met spoed op te volgen. Raadpleeg de blog van Check Point voor aanvullende informatie. De inschaling van deze advisory blijft ongewijzigd.\n","Guid":"NCSC-2026-0365 [1.01]","PubDate":"2026-09-23T10:28:31+02:00","AdvisoryID":"NCSC-2026-0365","Versie":"1.01","Kans":"H","Schade":"H"},{"Title":"NCSC-2026-0387 [1.00] [M/H] Kwetsbaarheid verholpen in Check Point Security Management en Log Servers","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0387","Description":"Check Point heeft een kwetsbaarheid verholpen in Security Management en Log Servers.\n\n\n\n\n De kwetsbaarheid betreft een pre-authentication directory-traversal-kwetsbaarheid in de Check Point Management Web Service, waarmee ongeauthenticeerde aanvallers scripts vanaf een willekeurig pad kunnen uitvoeren. De kwetsbaarheid kan leiden tot remote code execution en treft meerdere Check Point Management- en Logging-componenten. Check Point meldt dat de kwetsbaarheid actief wordt ge\u00EBxploiteerd en heeft deze als zero-day aangemerkt. Volgens Check Point is sinds 23 juli 2026 actief misbruik waargenomen. Omdat de kwetsbaarheid v\u00F3\u00F3r authenticatie kan worden uitgebuit, is het belangrijk dat de managementinterface niet rechtstreeks vanaf het internet toegankelijk is. Check Point adviseert specifiek om toegang tot TCP/19009 uitsluitend vanaf vertrouwde IP-adressen toe te staan.","Guid":"NCSC-2026-0387 [1.00]","PubDate":"2026-09-23T09:06:02+02:00","AdvisoryID":"NCSC-2026-0387","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0385 [1.00] [M/H] Kwetsbaarheid verholpen in VeloCloud Orchestrator (VCO) on-premises","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0385","Description":"VeloCloud heeft een kwetsbaarheid verholpen in VeloCloud Orchestrator (VCO) on-premises. De kwetsbaarheid in VCO stelt externe aanvallers in staat om toegang te krijgen tot geprivilegieerde interne functionaliteit, wat de vertrouwelijkheid, integriteit en beschikbaarheid kan aantasten.\nDe kwetsbaarheid wordt actief uitgebuit en is in hosted VCO-omgevingen reeds verholpen.\nBeperk de toegang tot de VCO-webinterface tot vertrouwde administratieve netwerken om de blootstelling aan de kwetsbaarheid te verminderen en monitor de omgeving op mogelijke compromittering.\n","Guid":"NCSC-2026-0385 [1.00]","PubDate":"2026-09-22T16:34:34+02:00","AdvisoryID":"NCSC-2026-0385","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0384 [1.00] [M/H] Kwetsbaarheid verholpen in Check Point\u0027s Security Management and Log Servers","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0384","Description":"Check Point heeft een kwetsbaarheid verholpen in Check Point\u0027s Security Management and Log Servers. De kwetsbaarheid betreft een stack overflow die optreedt tijdens het ongeauthenticeerde inlogproces. Een aanvaller kan deze kwetsbaarheid op afstand misbruiken om willekeurige code uit te voeren met rootrechten. Hierdoor kan de aanvaller authenticatie omzeilen en volledige controle over het systeem verkrijgen. Voor exploitatie is geen voorafgaande authenticatie vereist.","Guid":"NCSC-2026-0384 [1.00]","PubDate":"2026-09-18T10:38:34+02:00","AdvisoryID":"NCSC-2026-0384","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0383 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle VM VirtualBox","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0383","Description":"Oracle heeft 19 kwetsbaarheden verholpen in Oracle VM VirtualBox. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle VM VirtualBox, waaronder mogelijkheden voor lokale en geauthenticeerde kwaadwillenden om ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00EBrend van laag tot hoog. Van de in totaal 19 kwetsbaarheden kan volgens Oracle \u00E9\u00E9n kwetsbaarheid zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Voor het merendeel van de kwetsbaarheden is lokale toegang, gebruikersinteractie of voorafgaande toegangsrechten vereist.\n\nGeen van de kwetsbaarheden is als kritiek aangemerkt. CVE-2026-87273 heeft met een CVSS-score van 8,6 de hoogste score en kan lokaal worden misbruikt waarbij gebruikersinteractie vereist is. Succesvolle exploitatie kan een hoge impact hebben op de vertrouwelijkheid, integriteit en beschikbaarheid van het getroffen systeem. CVE-2026-87277 heeft een CVSS-score van 7,5 en kan zonder authenticatie op afstand via RDP worden misbruikt. Succesvolle exploitatie kan leiden tot verstoring van de beschikbaarheid van het getroffen systeem.","Guid":"NCSC-2026-0383 [1.00]","PubDate":"2026-09-17T13:11:45+02:00","AdvisoryID":"NCSC-2026-0383","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0382 [1.00] [H/H] Kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE)","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0382","Description":"Cisco heeft 21 kwetsbaarheden verholpen in Cisco Identity Services Engine (ISE) en Cisco ISE Passive Identity Connector (ISE-PIC). De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Cisco ISE en ISE-PIC, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00EBrend van middel tot kritiek. Van de in totaal 21 kwetsbaarheden zijn 13 als kritiek aangemerkt. Op basis van de door Cisco gepubliceerde CVSS-scores kunnen vier kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het omzeilen van authenticatie- en autorisatiecontroles, het verkrijgen en wijzigen van gevoelige configuratie- en identiteitsgegevens, het uitvoeren van willekeurige code of commando\u0027s met rootrechten, SQL-injectie, het uitlezen van bestanden en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen voorafgaande administratieve toegangsrechten of een specifieke configuratie, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nVan de 13 kwetsbaarheden die als kritiek zijn aangemerkt, hebben meerdere een CVSS-score van 9,8 of hoger. Vier kwetsbaarheden, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 en CVE-2026-76460, hebben een CVSS-score van 10,0. \n\nDe kwetsbaarheid met kenmerk CVE-2026-76423 betreft een kwetsbaarheid in de REST API waarmee een niet-geauthenticeerde kwaadwillende administratieve toegang kan verkrijgen tot Cisco ISE en ISE-PIC. \n\nDe kwetsbaarheid met kenmerk CVE-2026-76460 betreft een authenticatieomzeiling in een API van Cisco ISE en ISE-PIC waarmee een niet-geauthenticeerde kwaadwillende toegang tot het getroffen systeem kan verkrijgen. Cisco meldt dat deze kwetsbaarheid actief wordt misbruikt. Na succesvolle exploitatie kunnen kwaadwillenden volgens Cisco commando\u0027s met rootrechten uitvoeren. \n\nDe kwetsbaarheden met kenmerk CVE-2026-20130 en CVE-2026-20192 betreffen door Cisco gegroepeerde kwetsbaarheden op het gebied van respectievelijk onvoldoende neutralisatie van invoer en onjuiste toegangscontrole. Cisco heeft voor deze hardening-release meerdere onderliggende kwetsbaarheden per CWE-klasse onder \u00E9\u00E9n CVE-ID samengebracht. De CVSS-score vertegenwoordigt daarbij de hoogst scorende onderliggende kwetsbaarheid.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.","Guid":"NCSC-2026-0382 [1.00]","PubDate":"2026-09-17T11:24:38+02:00","AdvisoryID":"NCSC-2026-0382","Versie":"1.00","Kans":"H","Schade":"H"},{"Title":"NCSC-2026-0381 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0381","Description":"Oracle heeft 16 kwetsbaarheden verholpen in diverse Oracle PeopleSoft-producten, waaronder PeopleSoft Enterprise PeopleTools, PeopleSoft Enterprise PRTL Interaction Hub en PeopleSoft Enterprise CC Common Application Objects. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle PeopleSoft-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores in de categorie hoog. Van de in totaal 16 kwetsbaarheden kunnen volgens Oracle vier kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens, volledige overname van getroffen componenten en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nGeen van de kwetsbaarheden is als kritiek aangemerkt. CVE-2026-83017 heeft met een CVSS-score van 8,8 de hoogste score en bevindt zich in de Report Distribution-component van PeopleSoft Enterprise PeopleTools. Voor misbruik is een laaggeprivilegieerd account vereist. CVE-2026-73954 heeft een CVSS-score van 8,1 en bevindt zich in de Business Interlink-component van PeopleSoft Enterprise PeopleTools. Deze kwetsbaarheid kan zonder authenticatie op afstand via HTTP worden misbruikt en kan volgens Oracle leiden tot volledige overname van PeopleSoft Enterprise PeopleTools. Oracle kwalificeert de kwetsbaarheid echter als moeilijk te misbruiken.","Guid":"NCSC-2026-0381 [1.00]","PubDate":"2026-09-16T16:00:37+02:00","AdvisoryID":"NCSC-2026-0381","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0380 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Java SE","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0380","Description":"Oracle heeft 3 kwetsbaarheden verholpen in Oracle Java SE, waaronder Oracle GraalVM for JDK en Oracle GraalVM Enterprise Edition. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Java SE-producten, waarbij niet-geauthenticeerde kwaadwillenden via netwerktoegang kwetsbaarheden in de Compiler-component kunnen misbruiken. De kwetsbaarheden hebben CVSS-scores in de categorie hoog. Alle drie de kwetsbaarheden kunnen volgens Oracle zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen.\n\nGeen van de kwetsbaarheden is als kritiek aangemerkt. CVE-2026-83357 en CVE-2026-83408 hebben met een CVSS-score van 8,1 de hoogste score en bevinden zich in de Compiler-component van Oracle GraalVM for JDK. Voor beide kwetsbaarheden is geen authenticatie of gebruikersinteractie vereist. Oracle geeft aan dat de kwetsbaarheden moeilijk te misbruiken zijn, maar dat succesvolle exploitatie kan leiden tot volledige overname van het getroffen product.","Guid":"NCSC-2026-0380 [1.00]","PubDate":"2026-09-16T16:00:06+02:00","AdvisoryID":"NCSC-2026-0380","Versie":"1.00","Kans":"M","Schade":"H"},{"Title":"NCSC-2026-0379 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Analytics","Link":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0379","Description":"Oracle heeft 50 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Analytics-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00EBrend van hoog tot kritiek. Van de in totaal 50 kwetsbaarheden zijn vier als kritiek aangemerkt en volgens Oracle kunnen acht kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen of verwijderen van gegevens, volledige overname van getroffen componenten en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nVan de vier kwetsbaarheden die als kritiek zijn aangemerkt, hebben drie een CVSS-score van 9,8 of hoger. CVE-2026-83282 heeft een CVSS-score van 9,9 en bevindt zich in Platform Security van Oracle Business Intelligence Enterprise Edition. Voor misbruik is een laaggeprivilegieerd account vereist. CVE-2026-83269 en CVE-2026-83283 hebben een CVSS-score van 9,8 en bevinden zich respectievelijk in BI Platform Security van Oracle BI Publisher en Platform Security van Oracle Business Intelligence Enterprise Edition. Deze twee kwetsbaarheden kunnen volgens Oracle zonder authenticatie op afstand via HTTP worden misbruikt en kunnen volgens Oracle leiden tot volledige overname van het getroffen product. CVE-2026-83268 heeft een CVSS-score van 9,1 en vereist een hooggeprivilegieerd account.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.","Guid":"NCSC-2026-0379 [1.00]","PubDate":"2026-09-16T15:55:28+02:00","AdvisoryID":"NCSC-2026-0379","Versie":"1.00","Kans":"M","Schade":"H"}],"CveAlerts":[{"CvssScore":"CRITICAL 9.8","CveId":"CVE-2026-94293","Description":"Affected products:\nSoftware AAS Edge Client all versions\n\nDescription:\nAn unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.","Link":"https://www.certvde.com/en/advisories/VDE-2026-108/","Title":"CVE-2026-94293 [CRITICAL 9.8] An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints."},{"CvssScore":"0.0","CveId":"CVE-2026-106427","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106427 [0.0] Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HT"},{"CvssScore":"0.0","CveId":"CVE-2026-106426","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106426 [0.0] Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chro"},{"CvssScore":"0.0","CveId":"CVE-2026-106425","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106425 [0.0] Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to"},{"CvssScore":"0.0","CveId":"CVE-2026-106424","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106424 [0.0] Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a craf"},{"CvssScore":"0.0","CveId":"CVE-2026-106423","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106423 [0.0] Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106422","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106422 [0.0] Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity:"},{"CvssScore":"0.0","CveId":"CVE-2026-106421","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106421 [0.0] Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s"},{"CvssScore":"0.0","CveId":"CVE-2026-106420","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106420 [0.0] Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chro"},{"CvssScore":"0.0","CveId":"CVE-2026-106419","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106419 [0.0] Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Ch"},{"CvssScore":"0.0","CveId":"CVE-2026-106418","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106418 [0.0] Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network t"},{"CvssScore":"0.0","CveId":"CVE-2026-106417","Description":"Affected products:\nChrome\n\nDescription:\nInteger overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106417 [0.0] Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Ch"},{"CvssScore":"0.0","CveId":"CVE-2026-106416","Description":"Affected products:\nChrome\n\nDescription:\nCode injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106416 [0.0] Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. "},{"CvssScore":"0.0","CveId":"CVE-2026-106415","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106415 [0.0] Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severit"},{"CvssScore":"0.0","CveId":"CVE-2026-106414","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106414 [0.0] Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary cod"},{"CvssScore":"0.0","CveId":"CVE-2026-106413","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106413 [0.0] Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page."},{"CvssScore":"0.0","CveId":"CVE-2026-106412","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106412 [0.0] Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to po"},{"CvssScore":"0.0","CveId":"CVE-2026-106411","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106411 [0.0] Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit"},{"CvssScore":"0.0","CveId":"CVE-2026-106410","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106410 [0.0] Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted"},{"CvssScore":"0.0","CveId":"CVE-2026-106409","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106409 [0.0] Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute a"},{"CvssScore":"0.0","CveId":"CVE-2026-106408","Description":"Affected products:\nChrome\n\nDescription:\nProtection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106408 [0.0] Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium "},{"CvssScore":"0.0","CveId":"CVE-2026-106407","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106407 [0.0] Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restric"},{"CvssScore":"0.0","CveId":"CVE-2026-106406","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106406 [0.0] Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML "},{"CvssScore":"0.0","CveId":"CVE-2026-106405","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106405 [0.0] Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106404","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106404 [0.0] Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restricti"},{"CvssScore":"0.0","CveId":"CVE-2026-106403","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106403 [0.0] Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a"},{"CvssScore":"0.0","CveId":"CVE-2026-106402","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106402 [0.0] Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome ex"},{"CvssScore":"0.0","CveId":"CVE-2026-106401","Description":"Affected products:\nChrome\n\nDescription:\nOut of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106401 [0.0] Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. "},{"CvssScore":"0.0","CveId":"CVE-2026-106400","Description":"Affected products:\nChrome\n\nDescription:\nClickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106400 [0.0] Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML pag"},{"CvssScore":"0.0","CveId":"CVE-2026-106399","Description":"Affected products:\nChrome\n\nDescription:\nOut of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106399 [0.0] Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium"},{"CvssScore":"0.0","CveId":"CVE-2026-106398","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106398 [0.0] Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity:"},{"CvssScore":"0.0","CveId":"CVE-2026-106397","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106397 [0.0] Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions v"},{"CvssScore":"0.0","CveId":"CVE-2026-106396","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106396 [0.0] Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via"},{"CvssScore":"0.0","CveId":"CVE-2026-106395","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106395 [0.0] Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromi"},{"CvssScore":"0.0","CveId":"CVE-2026-106394","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106394 [0.0] Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chr"},{"CvssScore":"0.0","CveId":"CVE-2026-106393","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106393 [0.0] Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox"},{"CvssScore":"0.0","CveId":"CVE-2026-106392","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106392 [0.0] Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security s"},{"CvssScore":"0.0","CveId":"CVE-2026-106391","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106391 [0.0] Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements "},{"CvssScore":"0.0","CveId":"CVE-2026-106390","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106390 [0.0] Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML "},{"CvssScore":"0.0","CveId":"CVE-2026-106389","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106389 [0.0] Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106388","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106388 [0.0] Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information v"},{"CvssScore":"0.0","CveId":"CVE-2026-106387","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106387 [0.0] Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a cr"},{"CvssScore":"0.0","CveId":"CVE-2026-106386","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106386 [0.0] Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106385","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106385 [0.0] Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via "},{"CvssScore":"0.0","CveId":"CVE-2026-106384","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106384 [0.0] Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a c"},{"CvssScore":"0.0","CveId":"CVE-2026-106383","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106383 [0.0] Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106382","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106382 [0.0] Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se"},{"CvssScore":"0.0","CveId":"CVE-2026-106381","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106381 [0.0] Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium se"},{"CvssScore":"0.0","CveId":"CVE-2026-106380","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106380 [0.0] UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium"},{"CvssScore":"0.0","CveId":"CVE-2026-106379","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106379 [0.0] Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity:"},{"CvssScore":"0.0","CveId":"CVE-2026-106378","Description":"Affected products:\nChrome\n\nDescription:\nPrivilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106378 [0.0] Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outs"},{"CvssScore":"0.0","CveId":"CVE-2026-106377","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106377 [0.0] Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox v"},{"CvssScore":"0.0","CveId":"CVE-2026-106376","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106376 [0.0] Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chrom"},{"CvssScore":"0.0","CveId":"CVE-2026-106375","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106375 [0.0] Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (C"},{"CvssScore":"0.0","CveId":"CVE-2026-106374","Description":"Affected products:\nChrome\n\nDescription:\nType confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106374 [0.0] Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106373","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106373 [0.0] Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chr"},{"CvssScore":"0.0","CveId":"CVE-2026-106372","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106372 [0.0] Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page."},{"CvssScore":"0.0","CveId":"CVE-2026-106371","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106371 [0.0] Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTM"},{"CvssScore":"0.0","CveId":"CVE-2026-106370","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106370 [0.0] Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the "},{"CvssScore":"0.0","CveId":"CVE-2026-106369","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106369 [0.0] Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a craft"},{"CvssScore":"0.0","CveId":"CVE-2026-106368","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106368 [0.0] UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severi"},{"CvssScore":"0.0","CveId":"CVE-2026-106367","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106367 [0.0] Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code"},{"CvssScore":"0.0","CveId":"CVE-2026-106366","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106366 [0.0] Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium se"},{"CvssScore":"0.0","CveId":"CVE-2026-106365","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106365 [0.0] Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security sever"},{"CvssScore":"0.0","CveId":"CVE-2026-106364","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106364 [0.0] Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via "},{"CvssScore":"0.0","CveId":"CVE-2026-106363","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106363 [0.0] Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to"},{"CvssScore":"0.0","CveId":"CVE-2026-106362","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106362 [0.0] Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome"},{"CvssScore":"0.0","CveId":"CVE-2026-106361","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106361 [0.0] Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web o"},{"CvssScore":"0.0","CveId":"CVE-2026-106360","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106360 [0.0] Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: M"},{"CvssScore":"0.0","CveId":"CVE-2026-106359","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106359 [0.0] Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium "},{"CvssScore":"0.0","CveId":"CVE-2026-106358","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106358 [0.0] Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se"},{"CvssScore":"0.0","CveId":"CVE-2026-106357","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106357 [0.0] Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit"},{"CvssScore":"0.0","CveId":"CVE-2026-106356","Description":"Affected products:\nChrome\n\nDescription:\nClickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106356 [0.0] Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium securi"},{"CvssScore":"0.0","CveId":"CVE-2026-106355","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106355 [0.0] Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive inform"},{"CvssScore":"0.0","CveId":"CVE-2026-106354","Description":"Affected products:\nChrome\n\nDescription:\nImproper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106354 [0.0] Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106353","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106353 [0.0] Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co"},{"CvssScore":"0.0","CveId":"CVE-2026-106352","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106352 [0.0] Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafte"},{"CvssScore":"0.0","CveId":"CVE-2026-106351","Description":"Affected products:\nChrome\n\nDescription:\nObservable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106351 [0.0] Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive in"},{"CvssScore":"0.0","CveId":"CVE-2026-106350","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106350 [0.0] Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security s"},{"CvssScore":"0.0","CveId":"CVE-2026-106349","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106349 [0.0] Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106348","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106348 [0.0] Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity"},{"CvssScore":"0.0","CveId":"CVE-2026-106347","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106347 [0.0] Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106346","Description":"Affected products:\nChrome\n\nDescription:\nImproper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106346 [0.0] Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTM"},{"CvssScore":"0.0","CveId":"CVE-2026-106345","Description":"Affected products:\nChrome\n\nDescription:\nUse of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106345 [0.0] Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106344","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106344 [0.0] Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering t"},{"CvssScore":"0.0","CveId":"CVE-2026-106343","Description":"Affected products:\nChrome\n\nDescription:\nImproper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106343 [0.0] Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium s"},{"CvssScore":"0.0","CveId":"CVE-2026-106342","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106342 [0.0] Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severit"},{"CvssScore":"0.0","CveId":"CVE-2026-106341","Description":"Affected products:\nChrome\n\nDescription:\nType confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106341 [0.0] Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium"},{"CvssScore":"0.0","CveId":"CVE-2026-106340","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106340 [0.0] Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (C"},{"CvssScore":"0.0","CveId":"CVE-2026-106339","Description":"Affected products:\nChrome\n\nDescription:\nUse of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106339 [0.0] Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin dat"},{"CvssScore":"0.0","CveId":"CVE-2026-106338","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106338 [0.0] UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium s"},{"CvssScore":"0.0","CveId":"CVE-2026-106337","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106337 [0.0] UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severi"},{"CvssScore":"0.0","CveId":"CVE-2026-106336","Description":"Affected products:\nChrome\n\nDescription:\nObservable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106336 [0.0] Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: "},{"CvssScore":"0.0","CveId":"CVE-2026-106335","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106335 [0.0] Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106334","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106334 [0.0] Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML pa"},{"CvssScore":"0.0","CveId":"CVE-2026-106333","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106333 [0.0] Incorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Ch"},{"CvssScore":"0.0","CveId":"CVE-2026-106332","Description":"Affected products:\nChrome\n\nDescription:\nInteger overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106332 [0.0] Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity"},{"CvssScore":"0.0","CveId":"CVE-2026-106331","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106331 [0.0] Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privile"},{"CvssScore":"0.0","CveId":"CVE-2026-106330","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106330 [0.0] Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Me"},{"CvssScore":"0.0","CveId":"CVE-2026-106329","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106329 [0.0] Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outsid"},{"CvssScore":"0.0","CveId":"CVE-2026-106328","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106328 [0.0] Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a "},{"CvssScore":"0.0","CveId":"CVE-2026-106327","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106327 [0.0] Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions vi"},{"CvssScore":"0.0","CveId":"CVE-2026-106326","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106326 [0.0] Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installe"},{"CvssScore":"0.0","CveId":"CVE-2026-106325","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106325 [0.0] Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTM"},{"CvssScore":"0.0","CveId":"CVE-2026-106324","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106324 [0.0] Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML "},{"CvssScore":"0.0","CveId":"CVE-2026-106323","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106323 [0.0] Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary"},{"CvssScore":"0.0","CveId":"CVE-2026-106322","Description":"Affected products:\nChrome\n\nDescription:\nOpen redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106322 [0.0] Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. "},{"CvssScore":"0.0","CveId":"CVE-2026-106321","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106321 [0.0] Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page."},{"CvssScore":"0.0","CveId":"CVE-2026-106320","Description":"Affected products:\nChrome\n\nDescription:\nUse of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106320 [0.0] Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML "},{"CvssScore":"0.0","CveId":"CVE-2026-106318","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106318 [0.0] Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106317","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106317 [0.0] UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium securit"},{"CvssScore":"0.0","CveId":"CVE-2026-106316","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106316 [0.0] UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted netw"},{"CvssScore":"0.0","CveId":"CVE-2026-106315","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106315 [0.0] Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium"},{"CvssScore":"0.0","CveId":"CVE-2026-106314","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106314 [0.0] Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106313","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106313 [0.0] Incorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information vi"},{"CvssScore":"0.0","CveId":"CVE-2026-106312","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106312 [0.0] Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chro"},{"CvssScore":"0.0","CveId":"CVE-2026-106311","Description":"Affected products:\nChrome\n\nDescription:\nClickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106311 [0.0] Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (C"},{"CvssScore":"0.0","CveId":"CVE-2026-106310","Description":"Affected products:\nChrome\n\nDescription:\nUse of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106310 [0.0] Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via "},{"CvssScore":"0.0","CveId":"CVE-2026-106309","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106309 [0.0] Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromiu"},{"CvssScore":"0.0","CveId":"CVE-2026-106308","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106308 [0.0] Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive infor"},{"CvssScore":"0.0","CveId":"CVE-2026-106307","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106307 [0.0] Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions"},{"CvssScore":"0.0","CveId":"CVE-2026-106306","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106306 [0.0] Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium secur"},{"CvssScore":"0.0","CveId":"CVE-2026-106305","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106305 [0.0] UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106304","Description":"Affected products:\nChrome\n\nDescription:\nOut of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106304 [0.0] Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security sever"},{"CvssScore":"0.0","CveId":"CVE-2026-106303","Description":"Affected products:\nChrome\n\nDescription:\nObservable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106303 [0.0] Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering "},{"CvssScore":"0.0","CveId":"CVE-2026-106302","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106302 [0.0] UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML "},{"CvssScore":"0.0","CveId":"CVE-2026-106301","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106301 [0.0] Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restriction"},{"CvssScore":"0.0","CveId":"CVE-2026-106300","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106300 [0.0] Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a"},{"CvssScore":"0.0","CveId":"CVE-2026-106299","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106299 [0.0] Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restricti"},{"CvssScore":"0.0","CveId":"CVE-2026-106298","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106298 [0.0] Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106297","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106297 [0.0] Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106296","Description":"Affected products:\nChrome\n\nDescription:\nImproper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106296 [0.0] Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions"},{"CvssScore":"0.0","CveId":"CVE-2026-106295","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106295 [0.0] Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a"},{"CvssScore":"0.0","CveId":"CVE-2026-106294","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106294 [0.0] Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Ch"},{"CvssScore":"0.0","CveId":"CVE-2026-106293","Description":"Affected products:\nChrome\n\nDescription:\nType confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106293 [0.0] Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside t"},{"CvssScore":"0.0","CveId":"CVE-2026-106292","Description":"Affected products:\nChrome\n\nDescription:\nBuffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106292 [0.0] Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside "},{"CvssScore":"0.0","CveId":"CVE-2026-106291","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106291 [0.0] Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chrom"},{"CvssScore":"0.0","CveId":"CVE-2026-106290","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106290 [0.0] Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the "},{"CvssScore":"0.0","CveId":"CVE-2026-106289","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106289 [0.0] Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity:"},{"CvssScore":"0.0","CveId":"CVE-2026-106288","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106288 [0.0] Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafte"},{"CvssScore":"0.0","CveId":"CVE-2026-106287","Description":"Affected products:\nChrome\n\nDescription:\nInformation loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106287 [0.0] Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: L"},{"CvssScore":"0.0","CveId":"CVE-2026-106286","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106286 [0.0] Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity:"},{"CvssScore":"0.0","CveId":"CVE-2026-106285","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106285 [0.0] UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a "},{"CvssScore":"0.0","CveId":"CVE-2026-106284","Description":"Affected products:\nChrome\n\nDescription:\nOut of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106284 [0.0] Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engin"},{"CvssScore":"0.0","CveId":"CVE-2026-106283","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106283 [0.0] Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandb"},{"CvssScore":"0.0","CveId":"CVE-2026-106282","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106282 [0.0] UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium"},{"CvssScore":"0.0","CveId":"CVE-2026-106281","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106281 [0.0] Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chrom"},{"CvssScore":"0.0","CveId":"CVE-2026-106280","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106280 [0.0] Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (C"},{"CvssScore":"0.0","CveId":"CVE-2026-106279","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106279 [0.0] Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially exe"},{"CvssScore":"0.0","CveId":"CVE-2026-106278","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106278 [0.0] Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafte"},{"CvssScore":"0.0","CveId":"CVE-2026-106277","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106277 [0.0] Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Me"},{"CvssScore":"0.0","CveId":"CVE-2026-106276","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106276 [0.0] UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Ch"},{"CvssScore":"0.0","CveId":"CVE-2026-106275","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106275 [0.0] Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromiu"},{"CvssScore":"0.0","CveId":"CVE-2026-106274","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106274 [0.0] Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive informatio"},{"CvssScore":"0.0","CveId":"CVE-2026-106273","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106273 [0.0] Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via "},{"CvssScore":"0.0","CveId":"CVE-2026-106272","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106272 [0.0] UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements "},{"CvssScore":"0.0","CveId":"CVE-2026-106271","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106271 [0.0] Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted"},{"CvssScore":"0.0","CveId":"CVE-2026-106270","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106270 [0.0] Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security sever"},{"CvssScore":"0.0","CveId":"CVE-2026-106269","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106269 [0.0] Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s"},{"CvssScore":"0.0","CveId":"CVE-2026-106268","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106268 [0.0] Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit"},{"CvssScore":"0.0","CveId":"CVE-2026-106267","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106267 [0.0] Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted"},{"CvssScore":"0.0","CveId":"CVE-2026-106266","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106266 [0.0] Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a "},{"CvssScore":"0.0","CveId":"CVE-2026-106265","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106265 [0.0] UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromi"},{"CvssScore":"0.0","CveId":"CVE-2026-106264","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Web Authentication (Passkeys \u0026 Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106264 [0.0] Missing authorization in Web Authentication (Passkeys \u0026 Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML p"},{"CvssScore":"0.0","CveId":"CVE-2026-106263","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106263 [0.0] Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a cra"},{"CvssScore":"0.0","CveId":"CVE-2026-106262","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106262 [0.0] Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to "},{"CvssScore":"0.0","CveId":"CVE-2026-106261","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106261 [0.0] Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106260","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106260 [0.0] Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML p"},{"CvssScore":"0.0","CveId":"CVE-2026-106259","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106259 [0.0] Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chro"},{"CvssScore":"0.0","CveId":"CVE-2026-106258","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106258 [0.0] Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chrom"},{"CvssScore":"0.0","CveId":"CVE-2026-106257","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106257 [0.0] Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security "},{"CvssScore":"0.0","CveId":"CVE-2026-106256","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106256 [0.0] Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a "},{"CvssScore":"0.0","CveId":"CVE-2026-106255","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106255 [0.0] Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium"},{"CvssScore":"0.0","CveId":"CVE-2026-106254","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106254 [0.0] Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium securi"},{"CvssScore":"0.0","CveId":"CVE-2026-106253","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106253 [0.0] Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium secu"},{"CvssScore":"0.0","CveId":"CVE-2026-106252","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106252 [0.0] Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. "},{"CvssScore":"0.0","CveId":"CVE-2026-106251","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106251 [0.0] UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted netw"},{"CvssScore":"0.0","CveId":"CVE-2026-106250","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106250 [0.0] Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106249","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106249 [0.0] Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro"},{"CvssScore":"0.0","CveId":"CVE-2026-106248","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106248 [0.0] Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium secur"},{"CvssScore":"0.0","CveId":"CVE-2026-106247","Description":"Affected products:\nChrome\n\nDescription:\nBuffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106247 [0.0] Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside "},{"CvssScore":"0.0","CveId":"CVE-2026-106246","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106246 [0.0] Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Me"},{"CvssScore":"0.0","CveId":"CVE-2026-106245","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106245 [0.0] Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity"},{"CvssScore":"0.0","CveId":"CVE-2026-106244","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106244 [0.0] Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromi"},{"CvssScore":"0.0","CveId":"CVE-2026-106243","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106243 [0.0] Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium secur"},{"CvssScore":"0.0","CveId":"CVE-2026-106242","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106242 [0.0] Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via crafte"},{"CvssScore":"0.0","CveId":"CVE-2026-106241","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106241 [0.0] Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary c"},{"CvssScore":"0.0","CveId":"CVE-2026-106240","Description":"Affected products:\nChrome\n\nDescription:\nType confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106240 [0.0] Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106239","Description":"Affected products:\nChrome\n\nDescription:\nInteger overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106239 [0.0] Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106238","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106238 [0.0] Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside t"},{"CvssScore":"0.0","CveId":"CVE-2026-106237","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106237 [0.0] Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: L"},{"CvssScore":"0.0","CveId":"CVE-2026-106236","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106236 [0.0] UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106235","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106235 [0.0] Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium secur"},{"CvssScore":"0.0","CveId":"CVE-2026-106234","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106234 [0.0] Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbo"},{"CvssScore":"0.0","CveId":"CVE-2026-106233","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106233 [0.0] Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox"},{"CvssScore":"0.0","CveId":"CVE-2026-106232","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106232 [0.0] UI misrepresentation in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chr"},{"CvssScore":"0.0","CveId":"CVE-2026-106231","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106231 [0.0] Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium s"},{"CvssScore":"0.0","CveId":"CVE-2026-106230","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106230 [0.0] Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensi"},{"CvssScore":"0.0","CveId":"CVE-2026-106229","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106229 [0.0] UI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a craf"},{"CvssScore":"0.0","CveId":"CVE-2026-106228","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106228 [0.0] Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code ou"},{"CvssScore":"0.0","CveId":"CVE-2026-106227","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106227 [0.0] Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106226","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106226 [0.0] Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a cra"},{"CvssScore":"0.0","CveId":"CVE-2026-106225","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106225 [0.0] Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HT"},{"CvssScore":"0.0","CveId":"CVE-2026-106224","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106224 [0.0] Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a "},{"CvssScore":"0.0","CveId":"CVE-2026-106223","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106223 [0.0] Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromiu"},{"CvssScore":"0.0","CveId":"CVE-2026-106222","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106222 [0.0] Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security "},{"CvssScore":"0.0","CveId":"CVE-2026-106221","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106221 [0.0] Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted"},{"CvssScore":"0.0","CveId":"CVE-2026-106220","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106220 [0.0] Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severi"},{"CvssScore":"0.0","CveId":"CVE-2026-106217","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106217 [0.0] Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a cr"},{"CvssScore":"0.0","CveId":"CVE-2026-106216","Description":"Affected products:\nChrome\n\nDescription:\nCross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106216 [0.0] Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin polic"},{"CvssScore":"0.0","CveId":"CVE-2026-106215","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106215 [0.0] Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chrom"},{"CvssScore":"0.0","CveId":"CVE-2026-106214","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106214 [0.0] Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromiu"},{"CvssScore":"0.0","CveId":"CVE-2026-106213","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106213 [0.0] Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security sev"},{"CvssScore":"0.0","CveId":"CVE-2026-106212","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106212 [0.0] Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted "},{"CvssScore":"0.0","CveId":"CVE-2026-106211","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106211 [0.0] Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandb"},{"CvssScore":"0.0","CveId":"CVE-2026-106210","Description":"Affected products:\nChrome\n\nDescription:\nObservable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106210 [0.0] Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security "},{"CvssScore":"0.0","CveId":"CVE-2026-106209","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106209 [0.0] UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML p"},{"CvssScore":"0.0","CveId":"CVE-2026-106208","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106208 [0.0] Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome ex"},{"CvssScore":"0.0","CveId":"CVE-2026-106207","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106207 [0.0] Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106206","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106206 [0.0] Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chro"},{"CvssScore":"0.0","CveId":"CVE-2026-106205","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106205 [0.0] Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolati"},{"CvssScore":"0.0","CveId":"CVE-2026-106204","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106204 [0.0] Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106203","Description":"Affected products:\nChrome\n\nDescription:\nIncomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106203 [0.0] Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a cra"},{"CvssScore":"0.0","CveId":"CVE-2026-106202","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106202 [0.0] Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chrom"},{"CvssScore":"0.0","CveId":"CVE-2026-106201","Description":"Affected products:\nChrome\n\nDescription:\nRace condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106201 [0.0] Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se"},{"CvssScore":"0.0","CveId":"CVE-2026-106200","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106200 [0.0] Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106199","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106199 [0.0] Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass si"},{"CvssScore":"0.0","CveId":"CVE-2026-106198","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106198 [0.0] Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a c"},{"CvssScore":"0.0","CveId":"CVE-2026-106197","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106197 [0.0] Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secur"},{"CvssScore":"0.0","CveId":"CVE-2026-106196","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106196 [0.0] Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted H"},{"CvssScore":"0.0","CveId":"CVE-2026-106195","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106195 [0.0] Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic"},{"CvssScore":"0.0","CveId":"CVE-2026-106194","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106194 [0.0] Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineerin"},{"CvssScore":"0.0","CveId":"CVE-2026-106193","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106193 [0.0] Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit"},{"CvssScore":"0.0","CveId":"CVE-2026-106192","Description":"Affected products:\nChrome\n\nDescription:\nInformation leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106192 [0.0] Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security seve"},{"CvssScore":"0.0","CveId":"CVE-2026-106191","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106191 [0.0] Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code ou"},{"CvssScore":"0.0","CveId":"CVE-2026-106190","Description":"Affected products:\nChrome\n\nDescription:\nUse after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106190 [0.0] Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security"},{"CvssScore":"0.0","CveId":"CVE-2026-106189","Description":"Affected products:\nChrome\n\nDescription:\nCode injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106189 [0.0] Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted H"},{"CvssScore":"0.0","CveId":"CVE-2026-106188","Description":"Affected products:\nChrome\n\nDescription:\nConfused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106188 [0.0] Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafte"},{"CvssScore":"0.0","CveId":"CVE-2026-106187","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106187 [0.0] Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted"},{"CvssScore":"0.0","CveId":"CVE-2026-106186","Description":"Affected products:\nChrome\n\nDescription:\nUncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106186 [0.0] Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outsid"},{"CvssScore":"0.0","CveId":"CVE-2026-106185","Description":"Affected products:\nChrome\n\nDescription:\nImproper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106185 [0.0] Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions v"},{"CvssScore":"0.0","CveId":"CVE-2026-106184","Description":"Affected products:\nChrome\n\nDescription:\nUninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106184 [0.0] Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity"},{"CvssScore":"0.0","CveId":"CVE-2026-106183","Description":"Affected products:\nChrome\n\nDescription:\nMissing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106183 [0.0] Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. ("},{"CvssScore":"0.0","CveId":"CVE-2026-106182","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106182 [0.0] UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"},{"CvssScore":"0.0","CveId":"CVE-2026-106181","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106181 [0.0] Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive informat"},{"CvssScore":"0.0","CveId":"CVE-2026-106180","Description":"Affected products:\nChrome\n\nDescription:\nObservable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106180 [0.0] Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium s"},{"CvssScore":"0.0","CveId":"CVE-2026-106179","Description":"Affected products:\nChrome\n\nDescription:\nUI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-106179 [0.0] UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity"},{"CvssScore":"MEDIUM 5.4","CveId":"CVE-2026-106033","Description":"Affected products:\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Ansible Automation Platform 2\nRed Hat Hardened Images\n\nDescription:\nA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application\u0027s redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser\u0027s location.href without verifying its format or scheme. The platform includes built-in URL validation functions designed to block malicious URI schemes (such as javascript: and data:) as well as off-site or protocol-relative redirects, this specific route bypasses those controls. Consequently, an attacker can craft a malicious link that, when accessed by an authenticated user, causes arbitrary JavaScript to execute within the context of the user\u0027s session.","Link":"https://access.redhat.com/security/cve/CVE-2026-106033","Title":"CVE-2026-106033 [MEDIUM 5.4] A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application\u0027s redirect route. Specifica"},{"CvssScore":"0.0","CveId":"CVE-2026-106016","Description":"Affected products:\nFirefox\n\nDescription:\nMitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.","Link":"https://bugzilla.mozilla.org/show_bug.cgi?id=2067465","Title":"CVE-2026-106016 [0.0] Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1."},{"CvssScore":"HIGH 7.5","CveId":"CVE-2026-105071","Description":"Affected products:\nSiteVault \u2013 Backup, Restore, Migration \u0026amp; Cloning\n\nDescription:\nUnauthenticated Sensitive Data Exposure in SiteVault \u2013 Backup, Restore, Migration \u0026amp; Cloning \u003C= 1.5.17 versions.","Link":"https://patchstack.com/database/wordpress/plugin/sitevault-backup-restore-migration/vulnerability/wordpress-sitevault-backup-restore-migration-cloning-plugin-1-5-17-sensitive-data-exposure-vulnerability?_s_id=cve","Title":"CVE-2026-105071 [HIGH 7.5] Unauthenticated Sensitive Data Exposure in SiteVault \u2013 Backup, Restore, Migration \u0026amp; Cloning \u003C= 1.5.17 versions."},{"CvssScore":"HIGH 7.6","CveId":"CVE-2026-104073","Description":"Affected products:\nnetbox\n\nDescription:\nNetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the \u0022Can add custom links\u0022 permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES[\u0027sessionid\u0027] or a user\u0027s API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim\u0027s credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.","Link":"https://github.com/netbox-community/netbox/releases#release-v4.7.0","Title":"CVE-2026-104073 [HIGH 7.6] NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the \u0022Can add custom links\u0022 permission to ste"},{"CvssScore":"0.0","CveId":"CVE-2026-102322","Description":"Affected products:\nChrome\n\nDescription:\nIncorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","Link":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","Title":"CVE-2026-102322 [0.0] Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security s"},{"CvssScore":" 0.0","CveId":"CVE-2026-0482","Description":"Affected products:\nAlveo\u2122 Accelerator Cards\nVersal\u2122 Prime Series Adaptive SoCs\nVersal\u2122 Premium Series Adaptive SoCs\nVersal\u2122 AI Edge Series Adaptive SoCs\nVersal\u2122 AI Core Series Adaptive SoCs\nVersal\u2122 HBM Series Adaptive SoCs\nVersal\u2122 RF Series Adaptive SoCs\nVersal Premium Series Gen 2 Adaptive SOCs (2VP3402, 2VP3502, 2VP3602)\n\nDescription:\nIn AMD Versal\u2122 Adaptive SoC devices, insufficient boundary checks in USB boot mode\u2014when enabled through board modifications\u2014could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.","Link":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8028.html","Title":"CVE-2026-0482 [ 0.0] In AMD Versal\u2122 Adaptive SoC devices, insufficient boundary checks in USB boot mode\u2014when enabled through board modifications\u2014could allow crafted images to trigger a buffer overflow"}],"Timestamp":"2026-10-06T21:54:20.059852+02:00","Youless":true,"Zabbix":true}