| 0 |
| url |
VCID-14ex-w3x4-nub7 |
| vulnerability_id |
VCID-14ex-w3x4-nub7 |
| summary |
Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9963
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-14ex-w3x4-nub7 |
|
| 1 |
| url |
VCID-185a-5ehb-m3ag |
| vulnerability_id |
VCID-185a-5ehb-m3ag |
| summary |
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9998
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-185a-5ehb-m3ag |
|
| 2 |
| url |
VCID-19zm-bxkn-wbbg |
| vulnerability_id |
VCID-19zm-bxkn-wbbg |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9901
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-19zm-bxkn-wbbg |
|
| 3 |
| url |
VCID-1ggd-6qcg-t3fg |
| vulnerability_id |
VCID-1ggd-6qcg-t3fg |
| summary |
Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10010
|
| risk_score |
2.6 |
| exploitability |
0.5 |
| weighted_severity |
5.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1ggd-6qcg-t3fg |
|
| 4 |
| url |
VCID-21sm-xen5-5khq |
| vulnerability_id |
VCID-21sm-xen5-5khq |
| summary |
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9882
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-21sm-xen5-5khq |
|
| 5 |
| url |
VCID-243q-waa6-eqcj |
| vulnerability_id |
VCID-243q-waa6-eqcj |
| summary |
Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10017
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-243q-waa6-eqcj |
|
| 6 |
| url |
VCID-2fpz-7ky2-h3en |
| vulnerability_id |
VCID-2fpz-7ky2-h3en |
| summary |
Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10021
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2fpz-7ky2-h3en |
|
| 7 |
| url |
VCID-2mf4-zr2s-3fcu |
| vulnerability_id |
VCID-2mf4-zr2s-3fcu |
| summary |
Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9967
|
| risk_score |
4.2 |
| exploitability |
0.5 |
| weighted_severity |
8.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2mf4-zr2s-3fcu |
|
| 8 |
| url |
VCID-2n7e-4hqz-rbhn |
| vulnerability_id |
VCID-2n7e-4hqz-rbhn |
| summary |
Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9874
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2n7e-4hqz-rbhn |
|
| 9 |
| url |
VCID-31gb-s9w8-pfd8 |
| vulnerability_id |
VCID-31gb-s9w8-pfd8 |
| summary |
Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9934
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-31gb-s9w8-pfd8 |
|
| 10 |
| url |
VCID-326g-zs7w-7yb9 |
| vulnerability_id |
VCID-326g-zs7w-7yb9 |
| summary |
Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9983
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-326g-zs7w-7yb9 |
|
| 11 |
| url |
VCID-34g5-7fh3-4kfv |
| vulnerability_id |
VCID-34g5-7fh3-4kfv |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9927
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-34g5-7fh3-4kfv |
|
| 12 |
| url |
VCID-43ns-7r93-hffh |
| vulnerability_id |
VCID-43ns-7r93-hffh |
| summary |
Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10016
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-43ns-7r93-hffh |
|
| 13 |
| url |
VCID-4dhc-v4cj-gyf4 |
| vulnerability_id |
VCID-4dhc-v4cj-gyf4 |
| summary |
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a crafted video file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9989
|
| risk_score |
4.2 |
| exploitability |
0.5 |
| weighted_severity |
8.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4dhc-v4cj-gyf4 |
|
| 14 |
| url |
VCID-4p2e-4xm5-53fu |
| vulnerability_id |
VCID-4p2e-4xm5-53fu |
| summary |
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9999
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4p2e-4xm5-53fu |
|
| 15 |
| url |
VCID-4r8k-ucf4-43bj |
| vulnerability_id |
VCID-4r8k-ucf4-43bj |
| summary |
Use after free in Views in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9948
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4r8k-ucf4-43bj |
|
| 16 |
| url |
VCID-4xr1-cjnu-hud6 |
| vulnerability_id |
VCID-4xr1-cjnu-hud6 |
| summary |
Use after free in UI in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9951
|
| risk_score |
4.2 |
| exploitability |
0.5 |
| weighted_severity |
8.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4xr1-cjnu-hud6 |
|
| 17 |
| url |
VCID-56bu-yyyx-2kdy |
| vulnerability_id |
VCID-56bu-yyyx-2kdy |
| summary |
Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9956
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-56bu-yyyx-2kdy |
|
| 18 |
| url |
VCID-5bqx-eecz-hkbc |
| vulnerability_id |
VCID-5bqx-eecz-hkbc |
| summary |
Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9886
|
| risk_score |
4.2 |
| exploitability |
0.5 |
| weighted_severity |
8.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5bqx-eecz-hkbc |
|
| 19 |
| url |
VCID-69m4-vehj-aqah |
| vulnerability_id |
VCID-69m4-vehj-aqah |
| summary |
Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9894
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-69m4-vehj-aqah |
|
| 20 |
| url |
VCID-6t63-hu6d-u7gr |
| vulnerability_id |
VCID-6t63-hu6d-u7gr |
| summary |
Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10020
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6t63-hu6d-u7gr |
|
| 21 |
| url |
VCID-73qb-md3t-fybb |
| vulnerability_id |
VCID-73qb-md3t-fybb |
| summary |
Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9879
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-73qb-md3t-fybb |
|
| 22 |
| url |
VCID-75pz-t68v-gfbe |
| vulnerability_id |
VCID-75pz-t68v-gfbe |
| summary |
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9920
|
| risk_score |
2.6 |
| exploitability |
0.5 |
| weighted_severity |
5.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-75pz-t68v-gfbe |
|
| 23 |
| url |
VCID-75yd-zks8-53h4 |
| vulnerability_id |
VCID-75yd-zks8-53h4 |
| summary |
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9896
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-75yd-zks8-53h4 |
|
| 24 |
| url |
VCID-7qcu-e2s6-gff8 |
| vulnerability_id |
VCID-7qcu-e2s6-gff8 |
| summary |
Use after free in WebView in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9888
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7qcu-e2s6-gff8 |
|
| 25 |
| url |
VCID-7qnw-br2k-qbb2 |
| vulnerability_id |
VCID-7qnw-br2k-qbb2 |
| summary |
Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9917
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7qnw-br2k-qbb2 |
|
| 26 |
| url |
VCID-7w3h-3azb-57d8 |
| vulnerability_id |
VCID-7w3h-3azb-57d8 |
| summary |
Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9976
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7w3h-3azb-57d8 |
|
| 27 |
| url |
VCID-7xq3-ctmk-bug3 |
| vulnerability_id |
VCID-7xq3-ctmk-bug3 |
| summary |
Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9957
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7xq3-ctmk-bug3 |
|
| 28 |
| url |
VCID-81bx-eckp-t7ch |
| vulnerability_id |
VCID-81bx-eckp-t7ch |
| summary |
Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9898
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-81bx-eckp-t7ch |
|
| 29 |
| url |
VCID-81gx-9ra9-bfc2 |
| vulnerability_id |
VCID-81gx-9ra9-bfc2 |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9878
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-81gx-9ra9-bfc2 |
|
| 30 |
| url |
VCID-8777-k2qb-2ke4 |
| vulnerability_id |
VCID-8777-k2qb-2ke4 |
| summary |
Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9974
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8777-k2qb-2ke4 |
|
| 31 |
| url |
VCID-8jrh-sd2w-2ygz |
| vulnerability_id |
VCID-8jrh-sd2w-2ygz |
| summary |
Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9921
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8jrh-sd2w-2ygz |
|
| 32 |
| url |
VCID-9ea1-xw6h-aufa |
| vulnerability_id |
VCID-9ea1-xw6h-aufa |
| summary |
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10009
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9ea1-xw6h-aufa |
|
| 33 |
| url |
VCID-9hy8-fn9x-2fdc |
| vulnerability_id |
VCID-9hy8-fn9x-2fdc |
| summary |
Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9932
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9hy8-fn9x-2fdc |
|
| 34 |
| url |
VCID-9shd-bkht-ffeb |
| vulnerability_id |
VCID-9shd-bkht-ffeb |
| summary |
Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9873
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9shd-bkht-ffeb |
|
| 35 |
| url |
VCID-a3j9-a97s-duby |
| vulnerability_id |
VCID-a3j9-a97s-duby |
| summary |
Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9912
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-a3j9-a97s-duby |
|
| 36 |
| url |
VCID-a6e9-m93m-hkc4 |
| vulnerability_id |
VCID-a6e9-m93m-hkc4 |
| summary |
Out of bounds read in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9928
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-a6e9-m93m-hkc4 |
|
| 37 |
| url |
VCID-acbn-jedu-9ycy |
| vulnerability_id |
VCID-acbn-jedu-9ycy |
| summary |
Use after free in GFX in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9936
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-acbn-jedu-9ycy |
|
| 38 |
| url |
VCID-aeem-fbx5-63fp |
| vulnerability_id |
VCID-aeem-fbx5-63fp |
| summary |
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9969
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-aeem-fbx5-63fp |
|
| 39 |
| url |
VCID-ahzs-199q-57fb |
| vulnerability_id |
VCID-ahzs-199q-57fb |
| summary |
Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9930
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ahzs-199q-57fb |
|
| 40 |
| url |
VCID-avm6-aajr-qber |
| vulnerability_id |
VCID-avm6-aajr-qber |
| summary |
Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC script. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9887
|
| risk_score |
4.4 |
| exploitability |
0.5 |
| weighted_severity |
8.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-avm6-aajr-qber |
|
| 41 |
| url |
VCID-aytk-tkwj-33dx |
| vulnerability_id |
VCID-aytk-tkwj-33dx |
| summary |
Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9924
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-aytk-tkwj-33dx |
|
| 42 |
| url |
VCID-bgfh-zb3y-wyc1 |
| vulnerability_id |
VCID-bgfh-zb3y-wyc1 |
| summary |
Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9980
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bgfh-zb3y-wyc1 |
|
| 43 |
| url |
VCID-bgkk-xha8-8ua9 |
| vulnerability_id |
VCID-bgkk-xha8-8ua9 |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9941
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bgkk-xha8-8ua9 |
|
| 44 |
| url |
VCID-bpw6-6ctw-aybv |
| vulnerability_id |
VCID-bpw6-6ctw-aybv |
| summary |
Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9947
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bpw6-6ctw-aybv |
|
| 45 |
| url |
VCID-byzn-9gfs-k3fj |
| vulnerability_id |
VCID-byzn-9gfs-k3fj |
| summary |
Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10005
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-byzn-9gfs-k3fj |
|
| 46 |
| url |
VCID-cab5-8a81-bufu |
| vulnerability_id |
VCID-cab5-8a81-bufu |
| summary |
Use after free in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9945
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cab5-8a81-bufu |
|
| 47 |
| url |
VCID-cfa5-h56t-r3cj |
| vulnerability_id |
VCID-cfa5-h56t-r3cj |
| summary |
Inappropriate implementation in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9913
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cfa5-h56t-r3cj |
|
| 48 |
| url |
VCID-chwy-qjzh-gfbd |
| vulnerability_id |
VCID-chwy-qjzh-gfbd |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9946
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-chwy-qjzh-gfbd |
|
| 49 |
| url |
VCID-cnrv-zr6v-zkfh |
| vulnerability_id |
VCID-cnrv-zr6v-zkfh |
| summary |
Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10014
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cnrv-zr6v-zkfh |
|
| 50 |
| url |
VCID-cu7n-35pq-5kae |
| vulnerability_id |
VCID-cu7n-35pq-5kae |
| summary |
Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9880
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cu7n-35pq-5kae |
|
| 51 |
| url |
VCID-dgpt-m9au-zyd2 |
| vulnerability_id |
VCID-dgpt-m9au-zyd2 |
| summary |
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9949
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dgpt-m9au-zyd2 |
|
| 52 |
| url |
VCID-dgrf-p1x1-1bcq |
| vulnerability_id |
VCID-dgrf-p1x1-1bcq |
| summary |
Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9950
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dgrf-p1x1-1bcq |
|
| 53 |
| url |
VCID-dvgc-p31x-akfx |
| vulnerability_id |
VCID-dvgc-p31x-akfx |
| summary |
Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9937
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dvgc-p31x-akfx |
|
| 54 |
| url |
VCID-ed8w-87bm-yuf1 |
| vulnerability_id |
VCID-ed8w-87bm-yuf1 |
| summary |
Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9933
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ed8w-87bm-yuf1 |
|
| 55 |
| url |
VCID-edmt-9j97-aker |
| vulnerability_id |
VCID-edmt-9j97-aker |
| summary |
Out of bounds memory access in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9910
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-edmt-9j97-aker |
|
| 56 |
| url |
VCID-ekkj-6gdb-6fah |
| vulnerability_id |
VCID-ekkj-6gdb-6fah |
| summary |
Use after free in Browser in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9884
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ekkj-6gdb-6fah |
|
| 57 |
| url |
VCID-eq9a-d52k-dbgm |
| vulnerability_id |
VCID-eq9a-d52k-dbgm |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9899
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-eq9a-d52k-dbgm |
|
| 58 |
| url |
VCID-f8e2-hqws-muau |
| vulnerability_id |
VCID-f8e2-hqws-muau |
| summary |
Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9991
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-f8e2-hqws-muau |
|
| 59 |
| url |
VCID-fbd1-nn7v-z7cj |
| vulnerability_id |
VCID-fbd1-nn7v-z7cj |
| summary |
Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted font file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9960
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fbd1-nn7v-z7cj |
|
| 60 |
| url |
VCID-fj34-a1qp-tfhc |
| vulnerability_id |
VCID-fj34-a1qp-tfhc |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9877
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fj34-a1qp-tfhc |
|
| 61 |
| url |
VCID-fm9e-c5mq-9uch |
| vulnerability_id |
VCID-fm9e-c5mq-9uch |
| summary |
Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9931
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fm9e-c5mq-9uch |
|
| 62 |
| url |
VCID-ftn6-c2qu-7bb9 |
| vulnerability_id |
VCID-ftn6-c2qu-7bb9 |
| summary |
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9942
|
| risk_score |
3.9 |
| exploitability |
0.5 |
| weighted_severity |
7.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ftn6-c2qu-7bb9 |
|
| 63 |
| url |
VCID-fwb9-cbua-1fge |
| vulnerability_id |
VCID-fwb9-cbua-1fge |
| summary |
Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10006
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fwb9-cbua-1fge |
|
| 64 |
| url |
VCID-g5q7-qaxu-5fah |
| vulnerability_id |
VCID-g5q7-qaxu-5fah |
| summary |
Use after free in Accessibility in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9902
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g5q7-qaxu-5fah |
|
| 65 |
| url |
VCID-gc6x-x32j-wqb9 |
| vulnerability_id |
VCID-gc6x-x32j-wqb9 |
| summary |
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10012
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gc6x-x32j-wqb9 |
|
| 66 |
| url |
VCID-gppy-rrym-auex |
| vulnerability_id |
VCID-gppy-rrym-auex |
| summary |
Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9993
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gppy-rrym-auex |
|
| 67 |
| url |
VCID-h134-e62z-fkdp |
| vulnerability_id |
VCID-h134-e62z-fkdp |
| summary |
Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9986
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h134-e62z-fkdp |
|
| 68 |
| url |
VCID-h7mu-81kq-hqfn |
| vulnerability_id |
VCID-h7mu-81kq-hqfn |
| summary |
Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9954
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h7mu-81kq-hqfn |
|
| 69 |
| url |
VCID-hcyg-bfsd-qyb1 |
| vulnerability_id |
VCID-hcyg-bfsd-qyb1 |
| summary |
Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10013
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hcyg-bfsd-qyb1 |
|
| 70 |
| url |
VCID-heyq-fefc-1feg |
| vulnerability_id |
VCID-heyq-fefc-1feg |
| summary |
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10008
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-heyq-fefc-1feg |
|
| 71 |
| url |
VCID-hg98-tqyg-qfb6 |
| vulnerability_id |
VCID-hg98-tqyg-qfb6 |
| summary |
Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9972
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hg98-tqyg-qfb6 |
|
| 72 |
| url |
VCID-hhdq-5ymu-yyde |
| vulnerability_id |
VCID-hhdq-5ymu-yyde |
| summary |
Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9897
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hhdq-5ymu-yyde |
|
| 73 |
| url |
VCID-hmpt-use3-f7fz |
| vulnerability_id |
VCID-hmpt-use3-f7fz |
| summary |
Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted MHTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9903
|
| risk_score |
3.9 |
| exploitability |
0.5 |
| weighted_severity |
7.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hmpt-use3-f7fz |
|
| 74 |
| url |
VCID-hu41-q4h1-2qhg |
| vulnerability_id |
VCID-hu41-q4h1-2qhg |
| summary |
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9987
|
| risk_score |
3.3 |
| exploitability |
0.5 |
| weighted_severity |
6.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hu41-q4h1-2qhg |
|
| 75 |
| url |
VCID-jnfe-6tv4-nbfd |
| vulnerability_id |
VCID-jnfe-6tv4-nbfd |
| summary |
Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9958
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jnfe-6tv4-nbfd |
|
| 76 |
|
| 77 |
| url |
VCID-jyrt-y6pg-myfm |
| vulnerability_id |
VCID-jyrt-y6pg-myfm |
| summary |
Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9905
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jyrt-y6pg-myfm |
|
| 78 |
| url |
VCID-kaem-23uz-kyfn |
| vulnerability_id |
VCID-kaem-23uz-kyfn |
| summary |
Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9979
|
| risk_score |
3.5 |
| exploitability |
0.5 |
| weighted_severity |
7.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kaem-23uz-kyfn |
|
| 79 |
| url |
VCID-m1jq-dab2-d3cw |
| vulnerability_id |
VCID-m1jq-dab2-d3cw |
| summary |
Insufficient validation of untrusted input in UI in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9885
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m1jq-dab2-d3cw |
|
| 80 |
| url |
VCID-m4ne-jm1m-eqcc |
| vulnerability_id |
VCID-m4ne-jm1m-eqcc |
| summary |
Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10001
|
| risk_score |
3.9 |
| exploitability |
0.5 |
| weighted_severity |
7.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m4ne-jm1m-eqcc |
|
| 81 |
| url |
VCID-m8nk-qqta-1qf7 |
| vulnerability_id |
VCID-m8nk-qqta-1qf7 |
| summary |
Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9952
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m8nk-qqta-1qf7 |
|
| 82 |
| url |
VCID-m8z5-qhne-17h7 |
| vulnerability_id |
VCID-m8z5-qhne-17h7 |
| summary |
Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9938
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m8z5-qhne-17h7 |
|
| 83 |
| url |
VCID-mara-d9p2-1ub2 |
| vulnerability_id |
VCID-mara-d9p2-1ub2 |
| summary |
Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9962
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mara-d9p2-1ub2 |
|
| 84 |
| url |
VCID-mfms-fmx5-7ybj |
| vulnerability_id |
VCID-mfms-fmx5-7ybj |
| summary |
Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9961
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mfms-fmx5-7ybj |
|
| 85 |
| url |
VCID-mgbm-eac8-kbd8 |
| vulnerability_id |
VCID-mgbm-eac8-kbd8 |
| summary |
Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9988
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mgbm-eac8-kbd8 |
|
| 86 |
| url |
VCID-mmcc-vacc-sycn |
| vulnerability_id |
VCID-mmcc-vacc-sycn |
| summary |
Heap buffer overflow in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9939
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mmcc-vacc-sycn |
|
| 87 |
| url |
VCID-mrbh-g1ur-ekfr |
| vulnerability_id |
VCID-mrbh-g1ur-ekfr |
| summary |
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9973
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mrbh-g1ur-ekfr |
|
| 88 |
| url |
VCID-mxkj-pmuc-sbdv |
| vulnerability_id |
VCID-mxkj-pmuc-sbdv |
| summary |
Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9977
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mxkj-pmuc-sbdv |
|
| 89 |
| url |
VCID-n1fv-pgdf-vbed |
| vulnerability_id |
VCID-n1fv-pgdf-vbed |
| summary |
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9909
|
| risk_score |
3.6 |
| exploitability |
0.5 |
| weighted_severity |
7.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-n1fv-pgdf-vbed |
|
| 90 |
| url |
VCID-n3ay-hrjc-efb8 |
| vulnerability_id |
VCID-n3ay-hrjc-efb8 |
| summary |
Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9872
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-n3ay-hrjc-efb8 |
|
| 91 |
| url |
VCID-n4e8-4muu-xkf8 |
| vulnerability_id |
VCID-n4e8-4muu-xkf8 |
| summary |
Out of bounds read in Dawn in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9907
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-n4e8-4muu-xkf8 |
|
| 92 |
| url |
VCID-nf5w-jcrw-jbfg |
| vulnerability_id |
VCID-nf5w-jcrw-jbfg |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9925
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nf5w-jcrw-jbfg |
|
| 93 |
| url |
VCID-nh5j-3zmg-3kgz |
| vulnerability_id |
VCID-nh5j-3zmg-3kgz |
| summary |
Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9997
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nh5j-3zmg-3kgz |
|
| 94 |
| url |
VCID-njdg-4xzq-cba6 |
| vulnerability_id |
VCID-njdg-4xzq-cba6 |
| summary |
Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9889
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-njdg-4xzq-cba6 |
|
| 95 |
| url |
VCID-nsp5-xysf-bbg9 |
| vulnerability_id |
VCID-nsp5-xysf-bbg9 |
| summary |
Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10000
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nsp5-xysf-bbg9 |
|
| 96 |
| url |
VCID-ntqm-xy9k-6fa3 |
| vulnerability_id |
VCID-ntqm-xy9k-6fa3 |
| summary |
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9893
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ntqm-xy9k-6fa3 |
|
| 97 |
| url |
VCID-nwh9-p78n-c3b8 |
| vulnerability_id |
VCID-nwh9-p78n-c3b8 |
| summary |
Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9968
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nwh9-p78n-c3b8 |
|
| 98 |
| url |
VCID-nxnh-gq2h-rucj |
| vulnerability_id |
VCID-nxnh-gq2h-rucj |
| summary |
Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10015
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nxnh-gq2h-rucj |
|
| 99 |
| url |
VCID-p26z-s4k4-n3bd |
| vulnerability_id |
VCID-p26z-s4k4-n3bd |
| summary |
Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9890
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p26z-s4k4-n3bd |
|
| 100 |
| url |
VCID-p3wu-284s-wqfu |
| vulnerability_id |
VCID-p3wu-284s-wqfu |
| summary |
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9914
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p3wu-284s-wqfu |
|
| 101 |
| url |
VCID-pktf-kb4h-8ba8 |
| vulnerability_id |
VCID-pktf-kb4h-8ba8 |
| summary |
Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9964
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pktf-kb4h-8ba8 |
|
| 102 |
| url |
VCID-pmxc-9t6t-tudu |
| vulnerability_id |
VCID-pmxc-9t6t-tudu |
| summary |
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10011
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pmxc-9t6t-tudu |
|
| 103 |
| url |
VCID-puza-7mhw-k7ev |
| vulnerability_id |
VCID-puza-7mhw-k7ev |
| summary |
Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9918
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-puza-7mhw-k7ev |
|
| 104 |
| url |
VCID-pwk9-49qk-ekcy |
| vulnerability_id |
VCID-pwk9-49qk-ekcy |
| summary |
Insufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9985
|
| risk_score |
2.1 |
| exploitability |
0.5 |
| weighted_severity |
4.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pwk9-49qk-ekcy |
|
| 105 |
| url |
VCID-q51u-k3bt-qffk |
| vulnerability_id |
VCID-q51u-k3bt-qffk |
| summary |
Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9966
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q51u-k3bt-qffk |
|
| 106 |
| url |
VCID-qdm5-9nw4-wugf |
| vulnerability_id |
VCID-qdm5-9nw4-wugf |
| summary |
Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9904
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qdm5-9nw4-wugf |
|
| 107 |
|
| 108 |
| url |
VCID-qk88-gt84-bycv |
| vulnerability_id |
VCID-qk88-gt84-bycv |
| summary |
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9944
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qk88-gt84-bycv |
|
| 109 |
| url |
VCID-qtmf-4wd2-mqbd |
| vulnerability_id |
VCID-qtmf-4wd2-mqbd |
| summary |
Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10002
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qtmf-4wd2-mqbd |
|
| 110 |
| url |
VCID-qxr6-ayhk-6yff |
| vulnerability_id |
VCID-qxr6-ayhk-6yff |
| summary |
Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9996
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qxr6-ayhk-6yff |
|
| 111 |
| url |
VCID-r1bt-67cf-1yde |
| vulnerability_id |
VCID-r1bt-67cf-1yde |
| summary |
Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9995
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r1bt-67cf-1yde |
|
| 112 |
| url |
VCID-rac8-75zr-9bhr |
| vulnerability_id |
VCID-rac8-75zr-9bhr |
| summary |
Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9926
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rac8-75zr-9bhr |
|
| 113 |
| url |
VCID-rupa-umze-ckbp |
| vulnerability_id |
VCID-rupa-umze-ckbp |
| summary |
Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9992
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rupa-umze-ckbp |
|
| 114 |
| url |
VCID-rw8t-7mg1-gfb8 |
| vulnerability_id |
VCID-rw8t-7mg1-gfb8 |
| summary |
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9994
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rw8t-7mg1-gfb8 |
|
| 115 |
| url |
VCID-s6nk-c1sa-qqck |
| vulnerability_id |
VCID-s6nk-c1sa-qqck |
| summary |
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9923
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s6nk-c1sa-qqck |
|
| 116 |
| url |
VCID-sgt2-zs6e-1bbs |
| vulnerability_id |
VCID-sgt2-zs6e-1bbs |
| summary |
Use after free in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9970
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sgt2-zs6e-1bbs |
|
| 117 |
| url |
VCID-skyh-tp6m-77h2 |
| vulnerability_id |
VCID-skyh-tp6m-77h2 |
| summary |
Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9876
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-skyh-tp6m-77h2 |
|
| 118 |
| url |
VCID-t4h8-szzv-dqhf |
| vulnerability_id |
VCID-t4h8-szzv-dqhf |
| summary |
Out of bounds read and write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9975
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t4h8-szzv-dqhf |
|
| 119 |
| url |
VCID-t795-gc6d-wfe8 |
| vulnerability_id |
VCID-t795-gc6d-wfe8 |
| summary |
Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10022
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t795-gc6d-wfe8 |
|
| 120 |
| url |
VCID-t9g4-456d-b7c1 |
| vulnerability_id |
VCID-t9g4-456d-b7c1 |
| summary |
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9982
|
| risk_score |
3.6 |
| exploitability |
0.5 |
| weighted_severity |
7.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t9g4-456d-b7c1 |
|
| 121 |
| url |
VCID-tbd5-j3xs-pkab |
| vulnerability_id |
VCID-tbd5-j3xs-pkab |
| summary |
Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9881
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tbd5-j3xs-pkab |
|
| 122 |
| url |
VCID-tcsu-w6sc-7qf9 |
| vulnerability_id |
VCID-tcsu-w6sc-7qf9 |
| summary |
Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9971
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tcsu-w6sc-7qf9 |
|
| 123 |
| url |
VCID-tpvz-ws87-5bbm |
| vulnerability_id |
VCID-tpvz-ws87-5bbm |
| summary |
Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9990
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tpvz-ws87-5bbm |
|
| 124 |
| url |
VCID-tseh-87m8-quce |
| vulnerability_id |
VCID-tseh-87m8-quce |
| summary |
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10019
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tseh-87m8-quce |
|
| 125 |
| url |
VCID-u67w-fevn-eqgs |
| vulnerability_id |
VCID-u67w-fevn-eqgs |
| summary |
Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9892
|
| risk_score |
3.9 |
| exploitability |
0.5 |
| weighted_severity |
7.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u67w-fevn-eqgs |
|
| 126 |
| url |
VCID-urq1-6b5e-jydk |
| vulnerability_id |
VCID-urq1-6b5e-jydk |
| summary |
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9919
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-urq1-6b5e-jydk |
|
| 127 |
| url |
VCID-uxxk-rs3e-mbgq |
| vulnerability_id |
VCID-uxxk-rs3e-mbgq |
| summary |
Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9915
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-uxxk-rs3e-mbgq |
|
| 128 |
| url |
VCID-uy7e-wu5x-73dq |
| vulnerability_id |
VCID-uy7e-wu5x-73dq |
| summary |
Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9900
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-uy7e-wu5x-73dq |
|
| 129 |
| url |
VCID-vg3u-s1wf-myhu |
| vulnerability_id |
VCID-vg3u-s1wf-myhu |
| summary |
Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9906
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vg3u-s1wf-myhu |
|
| 130 |
| url |
VCID-vp3w-yzbv-wqf5 |
| vulnerability_id |
VCID-vp3w-yzbv-wqf5 |
| summary |
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9875
|
| risk_score |
4.3 |
| exploitability |
0.5 |
| weighted_severity |
8.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vp3w-yzbv-wqf5 |
|
| 131 |
|
| 132 |
| url |
VCID-vys6-p3s5-qbdh |
| vulnerability_id |
VCID-vys6-p3s5-qbdh |
| summary |
Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9891
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vys6-p3s5-qbdh |
|
| 133 |
| url |
VCID-w7jy-mjuz-kyd3 |
| vulnerability_id |
VCID-w7jy-mjuz-kyd3 |
| summary |
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9943
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w7jy-mjuz-kyd3 |
|
| 134 |
| url |
VCID-wd71-fthu-qfah |
| vulnerability_id |
VCID-wd71-fthu-qfah |
| summary |
Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9908
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wd71-fthu-qfah |
|
| 135 |
| url |
VCID-wmnv-qztm-57f9 |
| vulnerability_id |
VCID-wmnv-qztm-57f9 |
| summary |
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9981
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wmnv-qztm-57f9 |
|
| 136 |
| url |
VCID-wr4n-46vk-hkc3 |
| vulnerability_id |
VCID-wr4n-46vk-hkc3 |
| summary |
Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9916
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wr4n-46vk-hkc3 |
|
| 137 |
| url |
VCID-wwxq-3gah-tfea |
| vulnerability_id |
VCID-wwxq-3gah-tfea |
| summary |
Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9922
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wwxq-3gah-tfea |
|
| 138 |
| url |
VCID-wyaq-zqs1-33gx |
| vulnerability_id |
VCID-wyaq-zqs1-33gx |
| summary |
Inappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9929
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wyaq-zqs1-33gx |
|
| 139 |
| url |
VCID-wzqq-gzep-m7cs |
| vulnerability_id |
VCID-wzqq-gzep-m7cs |
| summary |
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9911
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wzqq-gzep-m7cs |
|
| 140 |
| url |
VCID-x9zu-z9j1-uych |
| vulnerability_id |
VCID-x9zu-z9j1-uych |
| summary |
Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9953
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-x9zu-z9j1-uych |
|
| 141 |
| url |
VCID-xb3z-r9ha-qkdz |
| vulnerability_id |
VCID-xb3z-r9ha-qkdz |
| summary |
Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9965
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xb3z-r9ha-qkdz |
|
| 142 |
| url |
VCID-xs6n-zscm-sbga |
| vulnerability_id |
VCID-xs6n-zscm-sbga |
| summary |
Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9955
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xs6n-zscm-sbga |
|
| 143 |
| url |
VCID-y3gp-6k3g-mucy |
| vulnerability_id |
VCID-y3gp-6k3g-mucy |
| summary |
Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9984
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y3gp-6k3g-mucy |
|
| 144 |
| url |
VCID-y6e2-zvss-dyfq |
| vulnerability_id |
VCID-y6e2-zvss-dyfq |
| summary |
Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10003
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y6e2-zvss-dyfq |
|
| 145 |
| url |
VCID-y9w9-5s9k-byf9 |
| vulnerability_id |
VCID-y9w9-5s9k-byf9 |
| summary |
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10018
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y9w9-5s9k-byf9 |
|
| 146 |
| url |
VCID-z26a-acyq-jbeq |
| vulnerability_id |
VCID-z26a-acyq-jbeq |
| summary |
Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9895
|
| risk_score |
3.7 |
| exploitability |
0.5 |
| weighted_severity |
7.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z26a-acyq-jbeq |
|
| 147 |
| url |
VCID-z2gk-ye5j-hfa1 |
| vulnerability_id |
VCID-z2gk-ye5j-hfa1 |
| summary |
Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9940
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z2gk-ye5j-hfa1 |
|
| 148 |
| url |
VCID-zb1k-9qye-gkca |
| vulnerability_id |
VCID-zb1k-9qye-gkca |
| summary |
Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10007
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zb1k-9qye-gkca |
|
| 149 |
| url |
VCID-zg9c-4q96-w3f5 |
| vulnerability_id |
VCID-zg9c-4q96-w3f5 |
| summary |
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-10004
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
4.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zg9c-4q96-w3f5 |
|
| 150 |
| url |
VCID-zhra-afct-d7ct |
| vulnerability_id |
VCID-zhra-afct-d7ct |
| summary |
Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-9978
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zhra-afct-d7ct |
|