Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-13848 | 8.8 high | 0.00% | google, chrome | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13850 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13884 | 8.8 high | 0.00% | google, chrome | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13885 | 8.8 high | 0.00% | google, chrome | Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13888 | 8.8 high | 0.00% | google, chrome | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13897 | 8.8 high | 0.00% | google, chrome | Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13898 | 8.8 high | 0.00% | google, chrome | Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13899 | 8.8 high | 0.00% | google, chrome | Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13903 | 8.8 high | 0.00% | google, chrome | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13915 | 8.8 high | 0.00% | google, chrome | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13918 | 8.8 high | 0.00% | google, chrome | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13928 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13938 | 8.8 high | 0.00% | google, chrome | Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13965 | 8.8 high | 0.00% | google, chrome | Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13967 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14005 | 8.8 high | 0.00% | google, chrome | Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14006 | 8.8 high | 0.00% | google, chrome | Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14009 | 8.8 high | 0.00% | google, chrome | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14024 | 8.8 high | 0.00% | google, chrome | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14025 | 8.8 high | 0.00% | google, chrome | Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14027 | 8.8 high | 0.00% | google, chrome | Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14036 | 8.8 high | 0.00% | google, chrome | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14040 | 8.8 high | 0.00% | google, chrome | Use after free in BrowserTag in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14041 | 8.8 high | 0.00% | google, chrome | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14067 | 8.8 high | 0.00% | google, chrome | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14422 | 8.8 high | 0.00% | google, chrome | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-14432 | 8.8 high | 0.00% | google, chrome | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13777 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13783 | 8.8 high | 0.00% | google, chrome | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13784 | 8.8 high | 0.00% | google, chrome | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13786 | 8.8 high | 0.00% | google, chrome | Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13788 | 8.8 high | 0.00% | google, chrome | Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
| CVE-2026-13805 | 8.8 high | 0.00% | google, chrome | Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13811 | 8.8 high | 0.00% | google, chrome | Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13815 | 8.8 high | 0.00% | google, chrome | Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13817 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13821 | 8.8 high | 0.00% | google, chrome | Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-14078 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14084 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14086 | 8.8 high | 0.00% | google, chrome | Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14087 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14091 | 8.8 high | 0.00% | google, chrome | Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14099 | 8.8 high | 0.00% | google, chrome | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14102 | 8.8 high | 0.00% | google, chrome | Use after free in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14107 | 8.8 high | 0.00% | google, chrome | Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14108 | 8.8 high | 0.00% | google, chrome | Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14149 | 8.8 high | 0.00% | google, chrome | Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-15107 | 8.8 high | 0.00% | google, chrome | Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-15110 | 8.8 high | 0.00% | google, chrome | Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-15112 | 8.8 high | 0.00% | google, chrome | Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Sun 25 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.