Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-118332 | 9.6 critical | 0.00% | no CPE yet | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118316 | 9.6 critical | 0.00% | no CPE yet | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118342 | 9.6 critical | 0.00% | no CPE yet | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118310 | 9.6 critical | 0.00% | no CPE yet | Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118308 | 9.6 critical | 0.00% | no CPE yet | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118309 | 9.6 critical | 0.00% | no CPE yet | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118312 | 9.6 critical | 0.00% | no CPE yet | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Wed 28 Oct |
| CVE-2026-5288 | 9.6 critical | 0.00% | google, chrome | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5289 | 9.6 critical | 0.00% | google, chrome | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5290 | 9.6 critical | 0.00% | google, chrome | Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6919 | 9.6 critical | 0.00% | google, chrome | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6920 | 9.6 critical | 0.00% | google, chrome | Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7908 | 9.6 critical | 0.00% | google, chrome | Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7910 | 9.6 critical | 0.00% | google, chrome | Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-113078 | 9.6 critical | 0.00% | google, chrome | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-8511 | 9.6 critical | 0.00% | google, chrome | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-8580 | 9.6 critical | 0.00% | google, chrome | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-12027 | 9.6 critical | 0.00% | google, chrome | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-12440 | 9.6 critical | 0.00% | google, chrome | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-13028 | 9.6 critical | 0.00% | google, chrome | Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13032 | 9.6 critical | 0.00% | google, chrome | Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13843 | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13846 | 9.6 critical | 0.00% | google, chrome | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13853 | 9.6 critical | 0.00% | google, chrome | Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13854 | 9.6 critical | 0.00% | google, chrome | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13859 | 9.6 critical | 0.00% | google, chrome | Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13861 | 9.6 critical | 0.00% | google, chrome | Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13869 | 9.6 critical | 0.00% | google, chrome | Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13878 | 9.6 critical | 0.00% | google, chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13880 | 9.6 critical | 0.00% | google, chrome | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13882 | 9.6 critical | 0.00% | google, chrome | Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13883 | 9.6 critical | 0.00% | google, chrome | Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13901 | 9.6 critical | 0.00% | google, chrome | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13909 | 9.6 critical | 0.00% | google, chrome | Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13920 | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14017 | 9.6 critical | 0.00% | google, chrome | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14037 | 9.6 critical | 0.00% | google, chrome | Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14043 | 9.6 critical | 0.00% | google, chrome | Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14044 | 9.6 critical | 0.00% | google, chrome | Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14055 | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14056 | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14419 | 9.6 critical | 0.00% | google, chrome | Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-14420 | 9.6 critical | 0.00% | google, chrome | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-14423 | 9.6 critical | 0.00% | google, chrome | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-14424 | 9.6 critical | 0.00% | google, chrome | Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-14425 | 9.6 critical | 0.00% | google, chrome | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13780 | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13781 | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13785 | 9.6 critical | 0.00% | google, chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13789 | 9.6 critical | 0.00% | google, chrome | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.