Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-113020 | 9.6 critical | 0.00% | google, chrome | Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 21 Oct |
| CVE-2026-110916 | 9.6 critical | 0.00% | google, chrome | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 19 Oct |
| CVE-2026-110165 | 9.6 critical | 0.00% | google, chrome | Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 15 Oct |
| CVE-2026-110161 | 9.6 critical | 0.00% | google, chrome | Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical) | 15 Oct |
| CVE-2026-110159 | 9.6 critical | 0.00% | google, chrome | Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | 15 Oct |
| CVE-2026-110149 | 9.6 critical | 0.00% | google, chrome | Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 15 Oct |
| CVE-2026-110142 | 9.6 critical | 0.00% | google, chrome | Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 15 Oct |
| CVE-2026-110136 | 9.6 critical | 0.00% | google, chrome | Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 15 Oct |
| CVE-2026-106237 | 9.6 critical | 0.00% | google, chrome | Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) | 9 Oct |
| CVE-2026-106211 | 9.6 critical | 0.00% | google, chrome | Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8 Oct |
| CVE-2026-102322 | 9.6 critical | 0.00% | google, chrome | Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | 8 Oct |
| CVE-2026-14038 | 9.3 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-16416 | 9.3 critical | 0.00% | google, chrome | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-13851 | 9.1 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13852 | 9.1 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13872 | 9.1 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-17666 | 9.1 critical | 0.00% | google, chrome | Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-106294 | 9.1 critical | 0.00% | google, chrome | Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) | 13 Oct |
| CVE-2026-106195 | 9.1 critical | 0.00% | google, chrome | Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low) | 9 Oct |
| CVE-2026-118350 | 8.8 high | 0.00% | google, chrome | Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118351 | 8.8 high | 0.00% | google, chrome | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118352 | 8.8 high | 0.00% | google, chrome | Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118353 | 8.8 high | 0.00% | google, chrome | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118354 | 8.8 high | 0.00% | google, chrome | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118356 | 8.8 high | 0.00% | google, chrome | Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118357 | 8.8 high | 0.00% | google, chrome | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118358 | 8.8 high | 0.00% | google, chrome | Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118359 | 8.8 high | 0.00% | google, chrome | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118336 | 8.8 high | 0.00% | google, chrome | Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118338 | 8.8 high | 0.00% | google, chrome | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Wed 28 Oct |
| CVE-2026-118339 | 8.8 high | 0.00% | google, chrome | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118349 | 8.8 high | 0.00% | google, chrome | Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118341 | 8.8 high | 0.00% | google, chrome | Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118346 | 8.8 high | 0.00% | google, chrome | Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118345 | 8.8 high | 0.00% | google, chrome | Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118344 | 8.8 high | 0.00% | google, chrome | Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Wed 28 Oct |
| CVE-2026-118343 | 8.8 high | 0.00% | google, chrome | Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118347 | 8.8 high | 0.00% | google, chrome | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118348 | 8.8 high | 0.00% | google, chrome | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Wed 28 Oct |
| CVE-2026-118327 | 8.8 high | 0.00% | google, chrome | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118328 | 8.8 high | 0.00% | google, chrome | Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118329 | 8.8 high | 0.00% | google, chrome | Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118334 | 8.8 high | 0.00% | google, chrome | Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118331 | 8.8 high | 0.00% | google, chrome | Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Wed 28 Oct |
| CVE-2026-118314 | 8.8 high | 0.00% | google, chrome | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118315 | 8.8 high | 0.00% | google, chrome | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118317 | 8.8 high | 0.00% | google, chrome | Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118320 | 8.8 high | 0.00% | google, chrome | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118307 | 8.8 high | 0.00% | no CPE yet | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118311 | 8.8 high | 0.00% | no CPE yet | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.