Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-118313 | 8.8 high | 0.00% | no CPE yet | Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118304 | 8.8 high | 0.00% | no CPE yet | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118335 | 8.8 high | 0.00% | no CPE yet | Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-118330 | 8.8 high | 0.00% | no CPE yet | Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Wed 28 Oct |
| CVE-2026-5285 | 8.8 high | 0.00% | google, chrome | Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6315 | 8.8 high | 0.00% | google, chrome | Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6363 | 8.8 high | 0.00% | google, chrome | Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-5274 | 8.8 high | 0.00% | google, chrome | Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5275 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5278 | 8.8 high | 0.00% | google, chrome | Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5279 | 8.8 high | 0.00% | google, chrome | Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5280 | 8.8 high | 0.00% | google, chrome | Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5286 | 8.8 high | 0.00% | google, chrome | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-5292 | 8.8 high | 0.00% | google, chrome | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-6301 | 8.8 high | 0.00% | google, chrome | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6302 | 8.8 high | 0.00% | google, chrome | Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6303 | 8.8 high | 0.00% | google, chrome | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6305 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6306 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6316 | 8.8 high | 0.00% | google, chrome | Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6317 | 8.8 high | 0.00% | google, chrome | Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-6318 | 8.8 high | 0.00% | google, chrome | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-6358 | 8.8 high | 0.00% | google, chrome | Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-6359 | 8.8 high | 0.00% | google, chrome | Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-113076 | 8.8 high | 0.00% | google, chrome | Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7896 | 8.8 high | 0.00% | google, chrome | Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-7898 | 8.8 high | 0.00% | google, chrome | Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-7901 | 8.8 high | 0.00% | google, chrome | Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7902 | 8.8 high | 0.00% | google, chrome | Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7906 | 8.8 high | 0.00% | google, chrome | Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7907 | 8.8 high | 0.00% | google, chrome | Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7921 | 8.8 high | 0.00% | google, chrome | Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7928 | 8.8 high | 0.00% | google, chrome | Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7938 | 8.8 high | 0.00% | google, chrome | Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7951 | 8.8 high | 0.00% | google, chrome | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7957 | 8.8 high | 0.00% | google, chrome | Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7973 | 8.8 high | 0.00% | google, chrome | Integer overflow in Dawn in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7974 | 8.8 high | 0.00% | google, chrome | Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7980 | 8.8 high | 0.00% | google, chrome | Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7984 | 8.8 high | 0.00% | google, chrome | Use after free in ReadingMode in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7987 | 8.8 high | 0.00% | google, chrome | Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7988 | 8.8 high | 0.00% | google, chrome | Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7991 | 8.8 high | 0.00% | google, chrome | Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7992 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7995 | 8.8 high | 0.00% | google, chrome | Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-8000 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-8002 | 8.8 high | 0.00% | google, chrome | Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-113079 | 8.8 high | 0.00% | google, chrome | Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-113083 | 8.8 high | 0.00% | google, chrome | Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-113344 | 8.8 high | 0.00% | google, chrome | Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.