Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-6358 | 8.8 high | 0.00% | google, chrome | Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-6359 | 8.8 high | 0.00% | google, chrome | Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-113076 | 8.8 high | 0.00% | google, chrome | Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7896 | 8.8 high | 0.00% | google, chrome | Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-7898 | 8.8 high | 0.00% | google, chrome | Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-7901 | 8.8 high | 0.00% | google, chrome | Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7902 | 8.8 high | 0.00% | google, chrome | Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7906 | 8.8 high | 0.00% | google, chrome | Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7907 | 8.8 high | 0.00% | google, chrome | Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7921 | 8.8 high | 0.00% | google, chrome | Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7928 | 8.8 high | 0.00% | google, chrome | Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-7938 | 8.8 high | 0.00% | google, chrome | Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7951 | 8.8 high | 0.00% | google, chrome | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7957 | 8.8 high | 0.00% | google, chrome | Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7973 | 8.8 high | 0.00% | google, chrome | Integer overflow in Dawn in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7974 | 8.8 high | 0.00% | google, chrome | Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7980 | 8.8 high | 0.00% | google, chrome | Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7984 | 8.8 high | 0.00% | google, chrome | Use after free in ReadingMode in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7987 | 8.8 high | 0.00% | google, chrome | Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7988 | 8.8 high | 0.00% | google, chrome | Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7991 | 8.8 high | 0.00% | google, chrome | Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7992 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-7995 | 8.8 high | 0.00% | google, chrome | Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-8000 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-8002 | 8.8 high | 0.00% | google, chrome | Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-113079 | 8.8 high | 0.00% | google, chrome | Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-113083 | 8.8 high | 0.00% | google, chrome | Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | Mon 26 Oct |
| CVE-2026-113344 | 8.8 high | 0.00% | google, chrome | Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-8509 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-8517 | 8.8 high | 0.00% | google, chrome | Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-8518 | 8.8 high | 0.00% | google, chrome | Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-8519 | 8.8 high | 0.00% | google, chrome | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-8522 | 8.8 high | 0.00% | google, chrome | Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-8524 | 8.8 high | 0.00% | google, chrome | Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8526 | 8.8 high | 0.00% | google, chrome | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8527 | 8.8 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8531 | 8.8 high | 0.00% | google, chrome | Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8532 | 8.8 high | 0.00% | google, chrome | Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8540 | 8.8 high | 0.00% | google, chrome | Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8544 | 8.8 high | 0.00% | google, chrome | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8549 | 8.8 high | 0.00% | google, chrome | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8551 | 8.8 high | 0.00% | google, chrome | Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8555 | 8.8 high | 0.00% | google, chrome | Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8558 | 8.8 high | 0.00% | google, chrome | Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8577 | 8.8 high | 0.00% | google, chrome | Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-8587 | 8.8 high | 0.00% | google, chrome | Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-113220 | 8.8 high | 0.00% | google, chrome | Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-12452 | 8.8 high | 0.00% | google, chrome | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-12007 | 8.8 high | 0.00% | google, chrome | Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) | Mon 26 Oct |
| CVE-2026-12020 | 8.8 high | 0.00% | google, chrome | Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.