/ Recent content in PatchGap on PatchGap — Browser n-day Tracker Hugo en-us Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87429/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87429/ LogicError in ServiceWorker /cve/cve-2026-87430/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87430/ OOB in WebRTC /cve/cve-2026-87431/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87431/ LogicError in Extensions /cve/cve-2026-87432/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87432/ LogicError in Navigatio /cve/cve-2026-87433/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87433/ Race in FileAPI /cve/cve-2026-87434/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87434/ CrossOrigin in CORS /cve/cve-2026-87435/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87435/ LogicError in ControlledFrame /cve/cve-2026-87436/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87436/ LogicError in Browser /cve/cve-2026-87437/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87437/ LogicError in Frames /cve/cve-2026-87438/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87438/ OOB in WebGL /cve/cve-2026-87439/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87439/ LogicError in ServiceWorker /cve/cve-2026-87440/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87440/ OOB in Media /cve/cve-2026-87441/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87441/ LogicError in Downloads /cve/cve-2026-87442/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87442/ LogicError in Prerender /cve/cve-2026-87443/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87443/ LogicError in Actor /cve/cve-2026-87444/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87444/ MemoryCorruption in Codecs /cve/cve-2026-87445/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87445/ LogicError in Sessio /cve/cve-2026-87446/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87446/ LogicError in Extensions /cve/cve-2026-87447/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87447/ LogicError in Network /cve/cve-2026-87448/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87448/ UAF in DevTools /cve/cve-2026-87449/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87449/ LogicError in DeviceBoundSessionCredentials /cve/cve-2026-87450/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87450/ LogicError in Permissions /cve/cve-2026-87451/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87451/ LogicError in Downloads /cve/cve-2026-87452/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87452/ LogicError in GPU /cve/cve-2026-87453/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87453/ LogicError in BackgroundFetch /cve/cve-2026-87454/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87454/ LogicError in Enterprise /cve/cve-2026-87455/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87455/ UAF in Aura /cve/cve-2026-87456/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87456/ UninitializedMemory in Media /cve/cve-2026-87457/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87457/ Race in Updater /cve/cve-2026-87458/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87458/ LogicError in Geometry /cve/cve-2026-87459/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87459/ LogicError in Select /cve/cve-2026-87460/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87460/ UAF in Platform /cve/cve-2026-87461/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87461/ LogicError in Core /cve/cve-2026-87462/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87462/ LogicError in FedCM /cve/cve-2026-87463/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87463/ LogicError in Certificate /cve/cve-2026-87464/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87464/ UAF in WebGL /cve/cve-2026-87465/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87465/ LogicError in Downloads /cve/cve-2026-87466/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87466/ LogicError in Workers /cve/cve-2026-87467/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87467/ Race in Updater /cve/cve-2026-87468/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87468/ LogicError in Isolated /cve/cve-2026-87469/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87469/ LogicError in Extensions /cve/cve-2026-87470/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87470/ LogicError in Tint /cve/cve-2026-87471/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87471/ LogicError in ServiceWorker /cve/cve-2026-87472/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87472/ LogicError in FedCM /cve/cve-2026-87473/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87473/ LogicError in FileHandling /cve/cve-2026-87474/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87474/ UAF in Payments /cve/cve-2026-87475/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87475/ LogicError in Omnibox /cve/cve-2026-87476/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87476/ LogicError in Loader /cve/cve-2026-87477/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87477/ LogicError in Core /cve/cve-2026-87478/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87478/ LogicError in Autofill /cve/cve-2026-87479/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87479/ LogicError in Extensions /cve/cve-2026-87480/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87480/ UAF in Printing /cve/cve-2026-87481/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87481/ LogicError in WebView /cve/cve-2026-87482/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87482/ LogicError in HttpsUpgrades /cve/cve-2026-87483/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87483/ LogicError in Browser /cve/cve-2026-87484/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87484/ LogicError in Geometry /cve/cve-2026-87485/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87485/ CrossOrigin in CORS /cve/cve-2026-87486/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87486/ LogicError in TrustedWebActivities /cve/cve-2026-87487/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87487/ LogicError in FileSystem /cve/cve-2026-87488/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87488/ UAF in WebGL /cve/cve-2026-87489/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87489/ MemoryCorruption in V8 /cve/cve-2026-87490/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87490/ LogicError in Transactions Platform /cve/cve-2026-87491/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87491/ OOB in V8 /cve/cve-2026-87492/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87492/ LogicError in DevTools /cve/cve-2026-87493/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87493/ LogicError in FileSystem /cve/cve-2026-87494/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87494/ UAF in Browser /cve/cve-2026-87495/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87495/ LogicError in Scroll /cve/cve-2026-87496/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87496/ LogicError in Browser /cve/cve-2026-87497/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87497/ UninitializedMemory in Codecs /cve/cve-2026-87498/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87498/ LogicError in WebUI /cve/cve-2026-87499/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87499/ LogicError in Network /cve/cve-2026-87500/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87500/ LogicError in ANGLE /cve/cve-2026-87501/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87501/ LogicError in Passwords /cve/cve-2026-87502/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87502/ LogicError in Fullscree /cve/cve-2026-87503/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87503/ LogicError in Downloads /cve/cve-2026-87504/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87504/ UAF in Core /cve/cve-2026-87505/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87505/ LogicError in FileSystem /cve/cve-2026-87506/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87506/ LogicError in WebUI /cve/cve-2026-87507/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87507/ LogicError in Downloads /cve/cve-2026-87508/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87508/ LogicError in Loader /cve/cve-2026-87509/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87509/ LogicError in Updater /cve/cve-2026-87510/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87510/ LogicError in FileAPI /cve/cve-2026-87511/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87511/ LogicError in DevTools /cve/cve-2026-87512/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87512/ UAF in ANGLE /cve/cve-2026-87513/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87513/ LogicError in ControlledFrame /cve/cve-2026-87514/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87514/ UAF in Views /cve/cve-2026-87515/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87515/ LogicError in FileAPI /cve/cve-2026-87516/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87516/ LogicError in Navigatio /cve/cve-2026-87517/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87517/ Race in Mobile /cve/cve-2026-87518/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87518/ LogicError in Safebrowsing /cve/cve-2026-87519/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87519/ LogicError in Safebrowsing /cve/cve-2026-87520/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87520/ UAF in Daw /cve/cve-2026-87521/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87521/ LogicError in WebMCP /cve/cve-2026-87522/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87522/ LogicError in WebView /cve/cve-2026-87523/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87523/ Race in DataTransfer /cve/cve-2026-87524/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87524/ UAF in Core /cve/cve-2026-87525/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87525/ OOB in Chromoting /cve/cve-2026-87526/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87526/ UAF in Passwords /cve/cve-2026-87527/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87527/ OOB in WebGL /cve/cve-2026-87528/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87528/ TypeConfusion in Rust /cve/cve-2026-87529/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87529/ LogicError in Media /cve/cve-2026-87530/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87530/ LogicError in CredentialProvider /cve/cve-2026-87531/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87531/ CrossOrigin in CORS /cve/cve-2026-87532/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87532/ LogicError in Safebrowsing /cve/cve-2026-87533/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87533/ UAF in DevTools /cve/cve-2026-87534/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87534/ LogicError in WebView /cve/cve-2026-87535/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87535/ LogicError in Safebrowsing /cve/cve-2026-87536/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87536/ UAF in V8 /cve/cve-2026-87537/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87537/ LogicError in Extensions /cve/cve-2026-87538/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87538/ LogicError in Input /cve/cve-2026-87539/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87539/ LogicError in Network /cve/cve-2026-87540/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87540/ LogicError in Isolated /cve/cve-2026-87541/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87541/ LogicError in Navigatio /cve/cve-2026-87542/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87542/ UAF in Input /cve/cve-2026-87543/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87543/ LogicError in Core /cve/cve-2026-87544/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87544/ LogicError in Extensions /cve/cve-2026-87545/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87545/ LogicError in Mobile /cve/cve-2026-87546/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87546/ TypeConfusion in Safebrowsing /cve/cve-2026-87547/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87547/ LogicError in FileSystem /cve/cve-2026-87548/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87548/ LogicError in Installer /cve/cve-2026-87549/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87549/ LogicError in Downloads /cve/cve-2026-87550/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87550/ LogicError in CSS /cve/cve-2026-87551/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87551/ CrossOrigin in CORS /cve/cve-2026-87552/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87552/ LogicError in TrustedWebActivities /cve/cve-2026-87553/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87553/ LogicError in SiteIsolatio /cve/cve-2026-87554/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87554/ Race in Chromoting /cve/cve-2026-87555/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87555/ UninitializedMemory in GPU /cve/cve-2026-87556/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87556/ LogicError in Browser /cve/cve-2026-87557/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87557/ LogicError in LocalNetworkAccess /cve/cve-2026-87558/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87558/ UAF in Payments /cve/cve-2026-87559/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87559/ LogicError in UI /cve/cve-2026-87560/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87560/ LogicError in Browser /cve/cve-2026-87561/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87561/ LogicError in Web Authenticatio /cve/cve-2026-87562/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87562/ LogicError in Accessibility /cve/cve-2026-87563/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87563/ LogicError in Paint /cve/cve-2026-87564/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87564/ TypeConfusion in V8 /cve/cve-2026-87565/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87565/ LogicError in Passwords /cve/cve-2026-87566/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87566/ LogicError in Layout /cve/cve-2026-87567/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87567/ LogicError in UrlFormatting /cve/cve-2026-87568/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87568/ LogicError in Chromium /cve/cve-2026-87569/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87569/ LogicError in Views /cve/cve-2026-87570/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87570/ LogicError in SiteIsolatio /cve/cve-2026-87571/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87571/ LogicError in Loader /cve/cve-2026-87572/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87572/ LogicError in DevTools /cve/cve-2026-87573/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87573/ LogicError in Network /cve/cve-2026-87574/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87574/ LogicError in ServiceWorker /cve/cve-2026-87575/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87575/ LogicError in Loader /cve/cve-2026-87576/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87576/ UninitializedMemory in GPU /cve/cve-2026-87577/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87577/ LogicError in Isolated /cve/cve-2026-87578/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87578/ UAF in Receiver /cve/cve-2026-87579/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87579/ OOB in WebRTC /cve/cve-2026-87580/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87580/ LogicError in WebAppInstalls /cve/cve-2026-87581/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87581/ UAF in Payments /cve/cve-2026-87582/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87582/ LogicError in DataTransfer /cve/cve-2026-87583/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87583/ LogicError in Passwords /cve/cve-2026-87584/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87584/ LogicError in WebUI /cve/cve-2026-87585/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87585/ LogicError in PDFium /cve/cve-2026-87586/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87586/ OOB in ANGLE /cve/cve-2026-87587/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87587/ UAF in V8 /cve/cve-2026-87588/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87588/ UAF in Chromecast /cve/cve-2026-87589/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87589/ LogicError in SiteIsolatio /cve/cve-2026-87590/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87590/ LogicError in Passwords /cve/cve-2026-87591/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87591/ LogicError in Extensions /cve/cve-2026-87592/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87592/ OOB in Tint /cve/cve-2026-87593/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87593/ LogicError in Editing /cve/cve-2026-87594/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87594/ LogicError in DataTransfer /cve/cve-2026-87595/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87595/ LogicError in Mobile /cve/cve-2026-87596/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87596/ OOB in ANGLE /cve/cve-2026-87597/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87597/ LogicError in CustomTabs /cve/cve-2026-87598/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87598/ LogicError in ServiceWorker /cve/cve-2026-87599/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87599/ LogicError in Interstitials /cve/cve-2026-87600/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87600/ LogicError in Safebrowsing /cve/cve-2026-87601/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87601/ Race in V8 /cve/cve-2026-87602/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87602/ OOB in ANGLE /cve/cve-2026-87603/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87603/ LogicError in FileSystem /cve/cve-2026-87604/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87604/ OOB in ANGLE /cve/cve-2026-87605/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87605/ LogicError in Contacts /cve/cve-2026-87606/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87606/ LogicError in SiteIsolatio /cve/cve-2026-87607/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87607/ UAF in Device /cve/cve-2026-87608/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87608/ LogicError in FedCM /cve/cve-2026-87609/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87609/ UAF in Sharing /cve/cve-2026-87610/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87610/ LogicError in Omnibox /cve/cve-2026-87611/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87611/ LogicError in FileSystem /cve/cve-2026-87612/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87612/ TypeConfusion in V8 /cve/cve-2026-87613/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87613/ LogicError in Extensions /cve/cve-2026-87614/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87614/ LogicError in ServiceWorker /cve/cve-2026-87615/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87615/ Race in Payments /cve/cve-2026-87616/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87616/ LogicError in Views /cve/cve-2026-87617/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87617/ UAF in DevTools /cve/cve-2026-87618/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87618/ LogicError in Storage /cve/cve-2026-87619/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87619/ LogicError in Prefetch /cve/cve-2026-87620/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87620/ LogicError in SVG /cve/cve-2026-87621/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87621/ OOB in ANGLE /cve/cve-2026-87622/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87622/ LogicError in FedCM /cve/cve-2026-87623/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87623/ LogicError in DOM /cve/cve-2026-87624/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87624/ LogicError in Passwords /cve/cve-2026-87625/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87625/ UAF in V8 /cve/cve-2026-87626/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87626/ LogicError in DeviceBoundSessionCredentials /cve/cve-2026-87627/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87627/ LogicError in Safebrowsing /cve/cve-2026-87628/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87628/ UAF in Cast /cve/cve-2026-87629/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87629/ LogicError in Sources /cve/cve-2026-87630/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87630/ IntegerOverflow in WebRTC /cve/cve-2026-87631/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87631/ LogicError in DOM /cve/cve-2026-87632/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87632/ LogicError in SanitizerAPI /cve/cve-2026-87633/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87633/ UAF in Views /cve/cve-2026-87634/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87634/ UAF in WebPackaging /cve/cve-2026-87635/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87635/ LogicError in Payments /cve/cve-2026-87636/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87636/ TypeConfusion in XML /cve/cve-2026-87637/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87637/ UAF in Extensions /cve/cve-2026-87638/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87638/ OOB in Media /cve/cve-2026-87639/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87639/ UAF in WebPackaging /cve/cve-2026-87640/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87640/ OOB in WebView /cve/cve-2026-87641/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87641/ Race in Browser /cve/cve-2026-87642/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87642/ UninitializedMemory in WebGL /cve/cve-2026-87643/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87643/ IntegerOverflow in GPU /cve/cve-2026-87644/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87644/ LogicError in Views /cve/cve-2026-87645/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87645/ LogicError in Safebrowsing /cve/cve-2026-87646/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87646/ UAF in Web Authenticatio /cve/cve-2026-87647/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87647/ UninitializedMemory in GPU /cve/cve-2026-87648/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87648/ UAF in ANGLE /cve/cve-2026-87649/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87649/ LogicError in Downloads /cve/cve-2026-87650/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87650/ OOB in WebGL /cve/cve-2026-87651/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87651/ LogicError in Paint /cve/cve-2026-87652/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87652/ LogicError in PushAPI /cve/cve-2026-87653/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87653/ LogicError in FullScree /cve/cve-2026-87654/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87654/ OOB in ANGLE /cve/cve-2026-87655/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87655/ LogicError in Downloads /cve/cve-2026-87656/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87656/ LogicError in Safebrowsing /cve/cve-2026-87657/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87657/ UAF in V8 /cve/cve-2026-87658/ Tue, 08 Sep 2026 00:00:00 +0000 /cve/cve-2026-87658/ LogicError in Extensions /cve/cve-2026-85042/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85042/ UAF in DevTools /cve/cve-2026-85043/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85043/ LogicError in Network /cve/cve-2026-85044/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85044/ LogicError in Mobile /cve/cve-2026-85045/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85045/ Race in V8 /cve/cve-2026-85046/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85046/ TypeConfusion in V8 /cve/cve-2026-85047/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85047/ LogicError in Transactions Platform /cve/cve-2026-85048/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85048/ UAF in Compositing /cve/cve-2026-85049/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85049/ UAF in Skia /cve/cve-2026-85050/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85050/ OOB in WebGL /cve/cve-2026-85051/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85051/ TypeConfusion in Compositing /cve/cve-2026-85052/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85052/ OOB in CrashReporting /cve/cve-2026-85053/ Thu, 03 Sep 2026 00:00:00 +0000 /cve/cve-2026-85053/ LogicError in CacheStorage /cve/cve-2026-84117/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84117/ LogicError in Core /cve/cve-2026-84118/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84118/ UAF in SpiderMonkey /cve/cve-2026-84119/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84119/ UAF in Core /cve/cve-2026-84120/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84120/ UAF in DOM /cve/cve-2026-84121/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84121/ UAF in Layout /cve/cve-2026-84122/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84122/ UAF in DOM /cve/cve-2026-84123/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84123/ UAF in Graphics /cve/cve-2026-84124/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84124/ UAF in DOM /cve/cve-2026-84125/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84125/ UAF in Core /cve/cve-2026-84126/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84126/ LogicError in Layout /cve/cve-2026-84127/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84127/ LogicError in Core /cve/cve-2026-84128/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84128/ LogicError in Core /cve/cve-2026-84129/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84129/ LogicError in DOM /cve/cve-2026-84130/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84130/ LogicError in Core /cve/cve-2026-84131/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84131/ LogicError in Graphics /cve/cve-2026-84132/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84132/ LogicError in Networking /cve/cve-2026-84133/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84133/ LogicError in Core /cve/cve-2026-84134/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84134/ LogicError in Core /cve/cve-2026-84135/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84135/ LogicError in Core /cve/cve-2026-84136/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84136/ LogicError in DOM /cve/cve-2026-84137/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84137/ LogicError in DOM /cve/cve-2026-84138/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84138/ LogicError in Core /cve/cve-2026-84139/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84139/ LogicError in DOM /cve/cve-2026-84140/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84140/ LogicError in DOM /cve/cve-2026-84141/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84141/ IntegerOverflow in ImageLib /cve/cve-2026-84142/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84142/ MemoryCorruption in SpiderMonkey /cve/cve-2026-84143/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84143/ MemoryCorruption in Core /cve/cve-2026-84144/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84144/ MemoryCorruption in Core /cve/cve-2026-84145/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84145/ MemoryCorruption in DOM /cve/cve-2026-84323/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84323/ LogicError in FileSystem /cve/cve-2026-84324/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84324/ UAF in Proxy /cve/cve-2026-84325/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84325/ LogicError in DataTransfer /cve/cve-2026-84326/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84326/ UninitializedMemory in V8 /cve/cve-2026-84327/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84327/ LogicError in Autofill /cve/cve-2026-84328/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84328/ LogicError in FileSystem /cve/cve-2026-84329/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84329/ LogicError in CredentialProvider /cve/cve-2026-84330/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84330/ LogicError in FullScree /cve/cve-2026-84331/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84331/ LogicError in Actor /cve/cve-2026-84332/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84332/ LogicError in SiteSettings /cve/cve-2026-84333/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84333/ UAF in Daw /cve/cve-2026-84334/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84334/ LogicError in Chromoting /cve/cve-2026-84335/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84335/ LogicError in TabStrip /cve/cve-2026-84347/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84347/ UAF in WebRTC /cve/cve-2026-84348/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84348/ LogicError in MediaCapture /cve/cve-2026-84349/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84349/ UAF in Browser /cve/cve-2026-84350/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84350/ UAF in TabStrip /cve/cve-2026-84351/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84351/ OOB in GPU /cve/cve-2026-84352/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84352/ UAF in WebGL /cve/cve-2026-84353/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84353/ UAF in Shared Tab Groups /cve/cve-2026-84354/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84354/ LogicError in FileSystem /cve/cve-2026-84355/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84355/ LogicError in Navigatio /cve/cve-2026-84356/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84356/ LogicError in FullScree /cve/cve-2026-84357/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84357/ LogicError in Omnibox /cve/cve-2026-84358/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84358/ LogicError in Downloads /cve/cve-2026-84359/ Tue, 01 Sep 2026 00:00:00 +0000 /cve/cve-2026-84359/ LogicError in Skia /cve/cve-2026-78891/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78891/ OOB in WebRTC /cve/cve-2026-78892/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78892/ LogicError in Chromoting /cve/cve-2026-78893/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78893/ LogicError in QUIC /cve/cve-2026-78894/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78894/ Race in Payments /cve/cve-2026-78895/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78895/ LogicError in Paint /cve/cve-2026-78896/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78896/ LogicError in StorageAccessAPI /cve/cve-2026-78897/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78897/ LogicError in BrowserTag /cve/cve-2026-78898/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78898/ LogicError in Downloads /cve/cve-2026-78899/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78899/ UAF in V8 /cve/cve-2026-78900/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78900/ LogicError in Media /cve/cve-2026-78901/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78901/ Race in V8 /cve/cve-2026-78903/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78903/ LogicError in SiteIsolatio /cve/cve-2026-78904/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78904/ TypeConfusion in ANGLE /cve/cve-2026-78905/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78905/ TypeConfusion in ANGLE /cve/cve-2026-78906/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78906/ Race in ANGLE /cve/cve-2026-78907/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78907/ LogicError in WebProtect /cve/cve-2026-78908/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78908/ LogicError in Canvas /cve/cve-2026-78909/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78909/ UAF in Views /cve/cve-2026-78910/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78910/ OOB in V8 /cve/cve-2026-78911/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78911/ LogicError in USB /cve/cve-2026-78912/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78912/ LogicError in Browser /cve/cve-2026-78913/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78913/ UAF in Chromoting /cve/cve-2026-78914/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78914/ UninitializedMemory in Skia /cve/cve-2026-78915/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78915/ Race in Enterprise /cve/cve-2026-78934/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78934/ Race in ReadAloud /cve/cve-2026-78935/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78935/ UninitializedMemory in Mobile /cve/cve-2026-78936/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78936/ LogicError in CustomTabs /cve/cve-2026-78937/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78937/ UAF in Search /cve/cve-2026-78938/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78938/ TypeConfusion in V8 /cve/cve-2026-78939/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78939/ UAF in Chromecast /cve/cve-2026-78940/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78940/ LogicError in Network /cve/cve-2026-78941/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78941/ LogicError in Core /cve/cve-2026-78942/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78942/ LogicError in Loader /cve/cve-2026-78943/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78943/ LogicError in Editing /cve/cve-2026-78944/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78944/ UAF in DevTools /cve/cve-2026-78945/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78945/ UAF in Views /cve/cve-2026-78946/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78946/ LogicError in Select /cve/cve-2026-78947/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78947/ LogicError in Chromium /cve/cve-2026-78948/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78948/ OOB in WebGL /cve/cve-2026-78949/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78949/ LogicError in CustomTabs /cve/cve-2026-78950/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78950/ IntegerOverflow in WebRTC /cve/cve-2026-78951/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78951/ UAF in ServiceWorker /cve/cve-2026-78952/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78952/ OOB in Crashpad /cve/cve-2026-78953/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78953/ LogicError in SiteIsolatio /cve/cve-2026-78954/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78954/ LogicError in Extensions /cve/cve-2026-78955/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78955/ LogicError in PerformanceAPIs /cve/cve-2026-78956/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78956/ TypeConfusion in V8 /cve/cve-2026-78957/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78957/ LogicError in Mobile /cve/cve-2026-78958/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78958/ UninitializedMemory in Skia /cve/cve-2026-78959/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78959/ LogicError in FileSystem /cve/cve-2026-78960/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78960/ LogicError in Extensions /cve/cve-2026-78961/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78961/ LogicError in Core /cve/cve-2026-78962/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78962/ UninitializedMemory in WebXR /cve/cve-2026-78963/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78963/ LogicError in Media /cve/cve-2026-78964/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78964/ UAF in Sync /cve/cve-2026-78965/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78965/ UninitializedMemory in ANGLE /cve/cve-2026-78966/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78966/ LogicError in QUIC /cve/cve-2026-78967/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78967/ LogicError in BFCache /cve/cve-2026-78968/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78968/ LogicError in Core /cve/cve-2026-78969/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78969/ UninitializedMemory in Video /cve/cve-2026-78974/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78974/ LogicError in Linux Toolkit Theming /cve/cve-2026-78975/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78975/ LogicError in DOM /cve/cve-2026-78976/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78976/ LogicError in StorageAccessAPI /cve/cve-2026-78977/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78977/ UninitializedMemory in GPU /cve/cve-2026-78978/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78978/ OOB in ANGLE /cve/cve-2026-78979/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78979/ Race in Core /cve/cve-2026-78980/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78980/ LogicError in ReaderMode /cve/cve-2026-78981/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78981/ LogicError in Mobile /cve/cve-2026-78983/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78983/ UAF in Views /cve/cve-2026-78984/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78984/ UninitializedMemory in GPU /cve/cve-2026-78985/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78985/ LogicError in FileSystem /cve/cve-2026-78986/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78986/ UninitializedMemory in GPU /cve/cve-2026-78987/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78987/ LogicError in Canvas /cve/cve-2026-78989/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78989/ OOB in ANGLE /cve/cve-2026-78990/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78990/ UAF in Compositing /cve/cve-2026-78991/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78991/ Race in WebProtect /cve/cve-2026-78999/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-78999/ LogicError in Navigatio /cve/cve-2026-79000/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79000/ LogicError in DeviceBoundSessionCredentials /cve/cve-2026-79001/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79001/ LogicError in Bluetooth /cve/cve-2026-79002/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79002/ LogicError in SiteIsolatio /cve/cve-2026-79003/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79003/ LogicError in Device /cve/cve-2026-79004/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79004/ OOB in Media /cve/cve-2026-79005/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79005/ LogicError in StorageAccessAPI /cve/cve-2026-79006/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79006/ LogicError in HttpsUpgrades /cve/cve-2026-79007/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79007/ UninitializedMemory in GPU /cve/cve-2026-79008/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79008/ LogicError in GPU /cve/cve-2026-79009/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79009/ LogicError in UI /cve/cve-2026-79010/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79010/ LogicError in Chromium /cve/cve-2026-79011/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79011/ LogicError in Browser /cve/cve-2026-79012/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79012/ UAF in Safebrowsing /cve/cve-2026-79013/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79013/ LogicError in Sync /cve/cve-2026-79014/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79014/ Race in Autofill /cve/cve-2026-79015/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79015/ LogicError in ServiceWorker /cve/cve-2026-79016/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79016/ LogicError in SVG /cve/cve-2026-79017/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79017/ Race in Extensions /cve/cve-2026-79018/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79018/ LogicError in FoldableAPIs /cve/cve-2026-79019/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79019/ OOB in ANGLE /cve/cve-2026-79020/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79020/ OOB in Skia /cve/cve-2026-79021/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79021/ LogicError in InterestGroups /cve/cve-2026-79022/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79022/ LogicError in Transactions Platform /cve/cve-2026-79023/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79023/ LogicError in Editing /cve/cve-2026-79024/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79024/ LogicError in ServiceWorker /cve/cve-2026-79025/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79025/ LogicError in Workers /cve/cve-2026-79026/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79026/ UAF in Extensions /cve/cve-2026-79027/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79027/ UAF in WebRTC /cve/cve-2026-79028/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79028/ LogicError in Network /cve/cve-2026-79030/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79030/ LogicError in Autofill /cve/cve-2026-79031/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79031/ LogicError in Preload /cve/cve-2026-79032/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79032/ LogicError in Network /cve/cve-2026-79033/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79033/ LogicError in DevTools /cve/cve-2026-79034/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79034/ CrossOrigin in CORS /cve/cve-2026-79038/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79038/ LogicError in WebProtect /cve/cve-2026-79039/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79039/ UAF in Mobile /cve/cve-2026-79040/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79040/ UninitializedMemory in GPU /cve/cve-2026-79041/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79041/ LogicError in Browser /cve/cve-2026-79042/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79042/ LogicError in Payments /cve/cve-2026-79043/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79043/ OOB in ANGLE /cve/cve-2026-79044/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79044/ LogicError in WebAppInstalls /cve/cve-2026-79045/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79045/ TypeConfusion in V8 /cve/cve-2026-79046/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79046/ Race in Permissions /cve/cve-2026-79047/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79047/ UAF in Views /cve/cve-2026-79048/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79048/ OOB in ANGLE /cve/cve-2026-79049/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79049/ LogicError in Passwords /cve/cve-2026-79050/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79050/ LogicError in Network /cve/cve-2026-79051/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79051/ LogicError in Loader /cve/cve-2026-79052/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79052/ UAF in Aura /cve/cve-2026-79053/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79053/ LogicError in Lighthouse /cve/cve-2026-79054/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79054/ UAF in Chromecast /cve/cve-2026-79055/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79055/ LogicError in Sharing /cve/cve-2026-79056/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79056/ UAF in ServiceWorker /cve/cve-2026-79057/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79057/ Race in Start /cve/cve-2026-79058/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79058/ LogicError in Passwords /cve/cve-2026-79059/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79059/ LogicError in BFCache /cve/cve-2026-79060/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79060/ LogicError in StorageAccessAPI /cve/cve-2026-79064/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79064/ UAF in Network /cve/cve-2026-79065/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79065/ LogicError in Network /cve/cve-2026-79066/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79066/ LogicError in Navigatio /cve/cve-2026-79067/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79067/ LogicError in Network /cve/cve-2026-79068/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79068/ LogicError in StreamsAPI /cve/cve-2026-79069/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79069/ MemoryCorruption in Tint /cve/cve-2026-79070/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79070/ LogicError in Cache /cve/cve-2026-79071/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79071/ Race in GPU /cve/cve-2026-79072/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79072/ LogicError in Performance /cve/cve-2026-79073/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79073/ LogicError in Parser /cve/cve-2026-79074/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79074/ LogicError in Network /cve/cve-2026-79075/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79075/ LogicError in Geolocatio /cve/cve-2026-79076/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79076/ LogicError in Sync /cve/cve-2026-79077/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79077/ LogicError in WebProtect /cve/cve-2026-79078/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79078/ UAF in FedCM /cve/cve-2026-79082/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79082/ LogicError in Transactions Platform /cve/cve-2026-79083/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79083/ LogicError in Media /cve/cve-2026-79084/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79084/ LogicError in Notifications /cve/cve-2026-79085/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79085/ LogicError in Network /cve/cve-2026-79086/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79086/ LogicError in CustomTabs /cve/cve-2026-79087/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79087/ LogicError in Chrome Tabs /cve/cve-2026-79088/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79088/ LogicError in FileSystem /cve/cve-2026-79089/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79089/ Race in Transactions Platform /cve/cve-2026-79090/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79090/ LogicError in Actor /cve/cve-2026-79091/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79091/ UAF in Bluetooth /cve/cve-2026-79093/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79093/ LogicError in Paint /cve/cve-2026-79094/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79094/ Race in Workers /cve/cve-2026-79095/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79095/ LogicError in Payments /cve/cve-2026-79097/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79097/ UAF in V8 /cve/cve-2026-79098/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79098/ LogicError in PermissionElement /cve/cve-2026-79099/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79099/ LogicError in Network /cve/cve-2026-79103/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79103/ LogicError in Speech /cve/cve-2026-79104/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79104/ LogicError in Sensor /cve/cve-2026-79105/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79105/ LogicError in Mobile /cve/cve-2026-79106/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79106/ LogicError in Input /cve/cve-2026-79107/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79107/ LogicError in TabGroups /cve/cve-2026-79108/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79108/ LogicError in Chromium /cve/cve-2026-79109/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79109/ LogicError in Printing /cve/cve-2026-79110/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79110/ LogicError in Preload /cve/cve-2026-79111/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79111/ LogicError in Daw /cve/cve-2026-79112/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79112/ OOB in Skia /cve/cve-2026-79116/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79116/ LogicError in Viz /cve/cve-2026-79117/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79117/ Race in WebAppInstalls /cve/cve-2026-79118/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79118/ UninitializedMemory in ANGLE /cve/cve-2026-79119/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79119/ UAF in PDF /cve/cve-2026-79120/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79120/ UninitializedMemory in ANGLE /cve/cve-2026-79121/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79121/ LogicError in Chromecast /cve/cve-2026-79122/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79122/ LogicError in SignI /cve/cve-2026-79123/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79123/ LogicError in NTP Footer /cve/cve-2026-79124/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79124/ LogicError in Intents /cve/cve-2026-79125/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79125/ LogicError in XR /cve/cve-2026-79126/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79126/ LogicError in Proxy /cve/cve-2026-79127/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79127/ OOB in ANGLE /cve/cve-2026-79128/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79128/ UAF in Views /cve/cve-2026-79129/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79129/ UAF in Sessions /cve/cve-2026-79130/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79130/ OOB in ANGLE /cve/cve-2026-79131/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79131/ OOB in ANGLE /cve/cve-2026-79132/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79132/ LogicError in Input /cve/cve-2026-79133/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79133/ LogicError in Forms /cve/cve-2026-79134/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79134/ LogicError in GetUserMedia /cve/cve-2026-79136/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79136/ LogicError in ServiceWorker /cve/cve-2026-79137/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79137/ LogicError in Extensions /cve/cve-2026-79138/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79138/ OOB in ANGLE /cve/cve-2026-79139/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79139/ LogicError in Media /cve/cve-2026-79140/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79140/ UAF in Views /cve/cve-2026-79141/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79141/ LogicError in Browser /cve/cve-2026-79142/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79142/ OOB in ANGLE /cve/cve-2026-79143/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79143/ LogicError in FileSystem /cve/cve-2026-79144/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79144/ LogicError in Skia /cve/cve-2026-79146/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79146/ LogicError in CustomTabs /cve/cve-2026-79147/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79147/ LogicError in Skia /cve/cve-2026-79148/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79148/ LogicError in DevTools /cve/cve-2026-79149/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79149/ UAF in ANGLE /cve/cve-2026-79150/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79150/ UAF in Views /cve/cve-2026-79151/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79151/ LogicError in Safebrowsing /cve/cve-2026-79152/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79152/ LogicError in CustomTabs /cve/cve-2026-79154/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79154/ LogicError in DevTools /cve/cve-2026-79155/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79155/ Race in FileSystem /cve/cve-2026-79173/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79173/ LogicError in WebAppInstalls /cve/cve-2026-79174/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79174/ LogicError in Extensions /cve/cve-2026-79175/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79175/ TypeConfusion in Accessibility /cve/cve-2026-79176/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79176/ LogicError in Extensions /cve/cve-2026-79177/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79177/ LogicError in Media /cve/cve-2026-79178/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79178/ LogicError in Chromium /cve/cve-2026-79179/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79179/ LogicError in DOM /cve/cve-2026-79180/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79180/ LogicError in CustomTabs /cve/cve-2026-79181/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79181/ LogicError in Glic /cve/cve-2026-79182/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79182/ LogicError in Media /cve/cve-2026-79183/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79183/ UAF in Accessibility /cve/cve-2026-79184/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79184/ LogicError in Preload /cve/cve-2026-79185/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79185/ LogicError in DOM /cve/cve-2026-79186/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79186/ LogicError in Network /cve/cve-2026-79187/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79187/ UAF in WebRTC /cve/cve-2026-79188/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79188/ OOB in ANGLE /cve/cve-2026-79189/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79189/ OOB in ANGLE /cve/cve-2026-79190/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79190/ LogicError in Extensions /cve/cve-2026-79191/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79191/ LogicError in SiteIsolatio /cve/cve-2026-79192/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79192/ LogicError in Variations /cve/cve-2026-79193/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79193/ LogicError in Canvas /cve/cve-2026-79194/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79194/ UAF in Chromoting /cve/cve-2026-79195/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79195/ UAF in Script /cve/cve-2026-79196/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79196/ Race in Editing /cve/cve-2026-79197/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79197/ UAF in V8 /cve/cve-2026-79198/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79198/ UAF in Platform /cve/cve-2026-79199/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79199/ LogicError in Network /cve/cve-2026-79200/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79200/ UAF in Aura /cve/cve-2026-79201/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79201/ LogicError in Workers /cve/cve-2026-79202/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79202/ UAF in Chromecast /cve/cve-2026-79203/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79203/ LogicError in DevTools /cve/cve-2026-79204/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79204/ LogicError in Input /cve/cve-2026-79205/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79205/ LogicError in Network /cve/cve-2026-79206/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79206/ OOB in FileSystem /cve/cve-2026-79207/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79207/ LogicError in Passwords /cve/cve-2026-79208/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79208/ LogicError in HTTP2 /cve/cve-2026-79209/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79209/ TypeConfusion in Animatio /cve/cve-2026-79210/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79210/ UAF in Audio /cve/cve-2026-79211/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79211/ LogicError in USB /cve/cve-2026-79212/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79212/ LogicError in Passwords /cve/cve-2026-79213/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79213/ LogicError in WebAppInstalls /cve/cve-2026-79214/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79214/ LogicError in Preload /cve/cve-2026-79215/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79215/ IntegerOverflow in WebGL /cve/cve-2026-79216/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79216/ OOB in Blink /cve/cve-2026-79217/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79217/ LogicError in Mobile /cve/cve-2026-79218/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79218/ SandboxEscape in Sandbox /cve/cve-2026-79219/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79219/ UAF in Bluetooth /cve/cve-2026-79220/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79220/ LogicError in Network /cve/cve-2026-79221/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79221/ UninitializedMemory in Daw /cve/cve-2026-79222/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79222/ LogicError in CustomTabs /cve/cve-2026-79223/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79223/ IntegerOverflow in Chromium /cve/cve-2026-79224/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79224/ UAF in Chromecast /cve/cve-2026-79225/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79225/ LogicError in Browser /cve/cve-2026-79226/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79226/ LogicError in Regional Capabilities /cve/cve-2026-79227/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79227/ TypeConfusion in DevTools /cve/cve-2026-79228/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79228/ LogicError in SiteIsolatio /cve/cve-2026-79229/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79229/ UninitializedMemory in ANGLE /cve/cve-2026-79230/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79230/ LogicError in ANGLE /cve/cve-2026-79231/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79231/ OOB in Media /cve/cve-2026-79232/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79232/ UAF in Aura /cve/cve-2026-79233/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79233/ LogicError in CustomTabs /cve/cve-2026-79234/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79234/ LogicError in CSS /cve/cve-2026-79235/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79235/ UAF in WebGL /cve/cve-2026-79236/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79236/ TypeConfusion in V8 /cve/cve-2026-79237/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79237/ LogicError in Navigatio /cve/cve-2026-79238/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79238/ LogicError in ServiceWorker /cve/cve-2026-79239/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79239/ OOB in Tint /cve/cve-2026-79240/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79240/ OOB in ANGLE /cve/cve-2026-79241/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79241/ OOB in GPU /cve/cve-2026-79242/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79242/ LogicError in HTML /cve/cve-2026-79243/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79243/ LogicError in ReadingList /cve/cve-2026-79244/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79244/ UAF in Animatio /cve/cve-2026-79245/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79245/ UAF in UI /cve/cve-2026-79246/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79246/ LogicError in DataTransfer /cve/cve-2026-79247/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79247/ UAF in Chromoting /cve/cve-2026-79248/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79248/ LogicError in Input /cve/cve-2026-79249/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79249/ LogicError in Bisectio /cve/cve-2026-79250/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79250/ LogicError in Navigatio /cve/cve-2026-79251/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79251/ LogicError in Network /cve/cve-2026-79252/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79252/ LogicError in ServiceWorker /cve/cve-2026-79253/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79253/ LogicError in Network /cve/cve-2026-79254/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79254/ LogicError in CustomTabs /cve/cve-2026-79255/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79255/ LogicError in WebRTC /cve/cve-2026-79256/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79256/ LogicError in WebView /cve/cve-2026-79257/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79257/ UAF in Views /cve/cve-2026-79258/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79258/ LogicError in WebXR /cve/cve-2026-79259/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79259/ LogicError in Safebrowsing /cve/cve-2026-79260/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79260/ LogicError in Cookies /cve/cve-2026-79261/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79261/ LogicError in Controls /cve/cve-2026-79262/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79262/ LogicError in Network /cve/cve-2026-79263/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79263/ Race in Extensions /cve/cve-2026-79264/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79264/ LogicError in Preload /cve/cve-2026-79265/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79265/ LogicError in GetUserMedia /cve/cve-2026-79266/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79266/ UAF in DevTools /cve/cve-2026-79267/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79267/ Race in Workers /cve/cve-2026-79269/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79269/ UninitializedMemory in ANGLE /cve/cve-2026-79270/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79270/ UninitializedMemory in ANGLE /cve/cve-2026-79271/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79271/ LogicError in DOM /cve/cve-2026-79272/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79272/ LogicError in FindInPage /cve/cve-2026-79273/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79273/ LogicError in WebView /cve/cve-2026-79274/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79274/ LogicError in GPU /cve/cve-2026-79275/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79275/ UAF in ANGLE /cve/cve-2026-79276/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79276/ LogicError in FileSystem /cve/cve-2026-79282/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79282/ UAF in ANGLE /cve/cve-2026-79283/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79283/ LogicError in Geometry /cve/cve-2026-79284/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79284/ LogicError in Core /cve/cve-2026-79285/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79285/ UninitializedMemory in ANGLE /cve/cve-2026-79286/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79286/ LogicError in CustomTabs /cve/cve-2026-79287/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79287/ LogicError in Forms /cve/cve-2026-79288/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79288/ LogicError in Autofill /cve/cve-2026-79289/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79289/ LogicError in Workers /cve/cve-2026-79290/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79290/ UAF in Aura /cve/cve-2026-79291/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79291/ LogicError in CSS /cve/cve-2026-79292/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79292/ IntegerOverflow in Chromecast /cve/cve-2026-79293/ Tue, 25 Aug 2026 00:00:00 +0000 /cve/cve-2026-79293/ LogicError in Animatio /cve/cve-2026-76017/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76017/ UAF in Chromoting /cve/cve-2026-76018/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76018/ LogicError in Import /cve/cve-2026-76019/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76019/ LogicError in Workers /cve/cve-2026-76020/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76020/ Race in V8 /cve/cve-2026-76021/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76021/ UAF in DOM /cve/cve-2026-76022/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76022/ OOB in Network /cve/cve-2026-76023/ Thu, 20 Aug 2026 00:00:00 +0000 /cve/cve-2026-76023/ LogicError in Linux Toolkit Theming /cve/cve-2026-74934/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74934/ LogicError in DOM /cve/cve-2026-74935/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74935/ LogicError in Networking /cve/cve-2026-74936/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74936/ UAF in SpiderMonkey /cve/cve-2026-74937/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74937/ UAF in SpiderMonkey /cve/cve-2026-74938/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74938/ LogicError in SpiderMonkey /cve/cve-2026-74939/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74939/ LogicError in Networking /cve/cve-2026-74940/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74940/ UAF in Graphics /cve/cve-2026-74941/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74941/ LogicError in DOM /cve/cve-2026-74942/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74942/ LogicError in Core /cve/cve-2026-74943/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74943/ UAF in ImageLib /cve/cve-2026-74944/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74944/ UAF in Layout /cve/cve-2026-74945/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74945/ LogicError in Graphics /cve/cve-2026-74946/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74946/ LogicError in DOM /cve/cve-2026-74947/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74947/ LogicError in DOM /cve/cve-2026-74948/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74948/ LogicError in DOM /cve/cve-2026-74949/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74949/ UAF in Graphics /cve/cve-2026-74950/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74950/ LogicError in Widget /cve/cve-2026-74951/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74951/ LogicError in Core /cve/cve-2026-74952/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74952/ LogicError in Toolkit /cve/cve-2026-74953/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74953/ LogicError in DOM /cve/cve-2026-74954/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74954/ LogicError in DOM /cve/cve-2026-74955/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74955/ LogicError in Core /cve/cve-2026-74956/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74956/ CrossOrigin in Core /cve/cve-2026-74957/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74957/ LogicError in Toolkit /cve/cve-2026-74958/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74958/ LogicError in DOM /cve/cve-2026-74959/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74959/ LogicError in DOM /cve/cve-2026-74960/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74960/ LogicError in Toolkit /cve/cve-2026-74961/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74961/ LogicError in DOM /cve/cve-2026-74962/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74962/ LogicError in DOM /cve/cve-2026-74963/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74963/ CrossOrigin in DOM /cve/cve-2026-74964/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74964/ IntegerOverflow in Graphics /cve/cve-2026-74965/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74965/ LogicError in DOM /cve/cve-2026-74966/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74966/ LogicError in Toolkit /cve/cve-2026-74967/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74967/ CrossOrigin in DOM /cve/cve-2026-74968/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74968/ LogicError in Core /cve/cve-2026-74969/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74969/ UAF in Graphics /cve/cve-2026-74970/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74970/ LogicError in Graphics /cve/cve-2026-74971/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74971/ LogicError in DOM /cve/cve-2026-74972/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74972/ LogicError in DOM /cve/cve-2026-74973/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74973/ UAF in Graphics /cve/cve-2026-74974/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74974/ CrossOrigin in Networking /cve/cve-2026-74975/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74975/ LogicError in Core /cve/cve-2026-74976/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74976/ LogicError in SpiderMonkey /cve/cve-2026-74977/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74977/ IntegerOverflow in Graphics /cve/cve-2026-74978/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74978/ LogicError in Widget /cve/cve-2026-74979/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74979/ LogicError in Toolkit /cve/cve-2026-74980/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74980/ LogicError in Core /cve/cve-2026-74981/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74981/ LogicError in Graphics /cve/cve-2026-74982/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74982/ LogicError in DOM /cve/cve-2026-74983/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74983/ LogicError in Toolkit /cve/cve-2026-74984/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74984/ Race in SpiderMonkey /cve/cve-2026-74985/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74985/ LogicError in Toolkit /cve/cve-2026-74986/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74986/ LogicError in DOM /cve/cve-2026-74987/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74987/ MemoryCorruption in Security/NSS /cve/cve-2026-74988/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74988/ MemoryCorruption in Graphics /cve/cve-2026-74989/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74989/ MemoryCorruption in Core /cve/cve-2026-74990/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-74990/ MemoryCorruption in DOM /cve/cve-2026-75874/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-75874/ SandboxEscape in Core /cve/cve-2026-76033/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76033/ CrossOrigin in CORS /cve/cve-2026-76034/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76034/ OOB in WebGL /cve/cve-2026-76035/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76035/ LogicError in Media /cve/cve-2026-76036/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76036/ OOB in Daw /cve/cve-2026-76037/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76037/ LogicError in CredentialProvider /cve/cve-2026-76038/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76038/ TypeConfusion in V8 /cve/cve-2026-76039/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76039/ LogicError in Core /cve/cve-2026-76040/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76040/ UAF in Browser /cve/cve-2026-76041/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76041/ LogicError in Skia /cve/cve-2026-76042/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76042/ UninitializedMemory in GPU /cve/cve-2026-76043/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76043/ LogicError in V8 /cve/cve-2026-76044/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76044/ Race in USB /cve/cve-2026-76045/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76045/ UAF in WebGL /cve/cve-2026-76046/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76046/ OOB in ANGLE /cve/cve-2026-76047/ Tue, 18 Aug 2026 00:00:00 +0000 /cve/cve-2026-76047/ TypeConfusion in V8 /cve/cve-2026-43794/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-43794/ UAF in WebKit /cve/cve-2026-43795/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-43795/ OOB in WebCore /cve/cve-2026-64715/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64715/ UAF in JSC /cve/cve-2026-64778/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64778/ LogicError in WebKit /cve/cve-2026-64779/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64779/ LogicError in WebKit /cve/cve-2026-64780/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64780/ TypeConfusion in JSC /cve/cve-2026-64781/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64781/ LogicError in WebKit /cve/cve-2026-64782/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64782/ LogicError in WebKit /cve/cve-2026-64784/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64784/ IntegerOverflow in JSC /cve/cve-2026-64787/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-64787/ UAF in WebCore /cve/cve-2026-65331/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65331/ TypeConfusion in JSC /cve/cve-2026-65332/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65332/ TypeConfusion in JSC /cve/cve-2026-65333/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65333/ TypeConfusion in JSC /cve/cve-2026-65334/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65334/ TypeConfusion in JSC /cve/cve-2026-65335/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65335/ OOB in JSC /cve/cve-2026-65336/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65336/ TypeConfusion in JSC /cve/cve-2026-65337/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65337/ UAF in JSC /cve/cve-2026-65338/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65338/ TypeConfusion in JSC /cve/cve-2026-65340/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65340/ OOB in JSC /cve/cve-2026-65341/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65341/ IntegerOverflow in WebCore /cve/cve-2026-65351/ Mon, 17 Aug 2026 00:00:00 +0000 /cve/cve-2026-65351/ LogicError in WebKit /cve/cve-2026-19556/ Tue, 11 Aug 2026 00:00:00 +0000 /cve/cve-2026-19556/ UAF in V8 /cve/cve-2026-19557/ Tue, 11 Aug 2026 00:00:00 +0000 /cve/cve-2026-19557/ UAF in TabStrip /cve/cve-2026-19558/ Tue, 11 Aug 2026 00:00:00 +0000 /cve/cve-2026-19558/ UAF in Extensions /cve/cve-2026-19559/ Tue, 11 Aug 2026 00:00:00 +0000 /cve/cve-2026-19559/ UAF in HTML /cve/cve-2026-19560/ Tue, 11 Aug 2026 00:00:00 +0000 /cve/cve-2026-19560/ UAF in Blink /cve/cve-2026-19137/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19137/ UAF in WebGL /cve/cve-2026-19138/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19138/ OOB in CrashReporting /cve/cve-2026-19139/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19139/ Race in CredentialProvider /cve/cve-2026-19140/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19140/ UAF in GPU /cve/cve-2026-19141/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19141/ UAF in Resources /cve/cve-2026-19142/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19142/ UAF in Views /cve/cve-2026-19143/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19143/ LogicError in WebAPKs /cve/cve-2026-19144/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19144/ UAF in HTML /cve/cve-2026-19145/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19145/ UAF in Translate /cve/cve-2026-19146/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19146/ UninitializedMemory in GPU /cve/cve-2026-19147/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19147/ UAF in Aura /cve/cve-2026-19148/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19148/ OOB in GPU /cve/cve-2026-19149/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19149/ UAF in Aura /cve/cve-2026-19150/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19150/ LogicError in V8 /cve/cve-2026-19151/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19151/ UAF in V8 /cve/cve-2026-19152/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19152/ LogicError in Navigatio /cve/cve-2026-19153/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19153/ LogicError in Workers /cve/cve-2026-19154/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19154/ UAF in Skia /cve/cve-2026-19155/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19155/ UAF in Payments /cve/cve-2026-19156/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19156/ OOB in Base /cve/cve-2026-19157/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19157/ OOB in ANGLE /cve/cve-2026-19158/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19158/ UAF in Views /cve/cve-2026-19159/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19159/ UAF in Views /cve/cve-2026-19160/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19160/ UninitializedMemory in Skia /cve/cve-2026-19161/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19161/ UninitializedMemory in Skia /cve/cve-2026-19162/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19162/ OOB in V8 /cve/cve-2026-19163/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19163/ UAF in Media /cve/cve-2026-19164/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19164/ LogicError in Codecs /cve/cve-2026-19165/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19165/ UAF in Extensions /cve/cve-2026-19166/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19166/ UAF in Web Authenticatio /cve/cve-2026-19167/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19167/ IntegerOverflow in GPU /cve/cve-2026-19168/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19168/ LogicError in V8 /cve/cve-2026-19169/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19169/ LogicError in Contextual Tasks /cve/cve-2026-19170/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19170/ UAF in WebGL /cve/cve-2026-19171/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19171/ UAF in Media /cve/cve-2026-19172/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19172/ UAF in Views /cve/cve-2026-19173/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19173/ OOB in Skia /cve/cve-2026-19174/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19174/ IntegerOverflow in V8 /cve/cve-2026-19175/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19175/ UAF in Payments /cve/cve-2026-19176/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19176/ UAF in Skia /cve/cve-2026-19177/ Thu, 06 Aug 2026 00:00:00 +0000 /cve/cve-2026-19177/ LogicError in UI /cve/cve-2026-18809/ Tue, 04 Aug 2026 00:00:00 +0000 /cve/cve-2026-18809/ LogicError in Core /cve/cve-2026-17650/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17650/ UAF in Compositing /cve/cve-2026-17651/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17651/ LogicError in Daw /cve/cve-2026-17652/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17652/ UAF in Views /cve/cve-2026-17653/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17653/ UAF in Skia /cve/cve-2026-17654/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17654/ Race in Updater /cve/cve-2026-17655/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17655/ LogicError in ANGLE /cve/cve-2026-17656/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17656/ UAF in Ozone /cve/cve-2026-17657/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17657/ UAF in Navigatio /cve/cve-2026-17658/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17658/ UAF in V8 /cve/cve-2026-17659/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17659/ LogicError in SiteIsolatio /cve/cve-2026-17660/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17660/ LogicError in Network /cve/cve-2026-17661/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17661/ UAF in Loader /cve/cve-2026-17662/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17662/ LogicError in Prefetch /cve/cve-2026-17663/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17663/ LogicError in GPU /cve/cve-2026-17664/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17664/ LogicError in Loader /cve/cve-2026-17665/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17665/ UAF in V8 /cve/cve-2026-17666/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17666/ LogicError in Enterprise /cve/cve-2026-17667/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17667/ UninitializedMemory in ANGLE /cve/cve-2026-17668/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17668/ UninitializedMemory in ANGLE /cve/cve-2026-17669/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17669/ LogicError in Chrome for iOS /cve/cve-2026-17670/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17670/ UAF in Views /cve/cve-2026-17671/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17671/ LogicError in ANGLE /cve/cve-2026-17672/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17672/ LogicError in Chromecast /cve/cve-2026-17673/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17673/ IntegerOverflow in QUIC /cve/cve-2026-17674/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17674/ LogicError in HTML /cve/cve-2026-17675/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17675/ OOB in ANGLE /cve/cve-2026-17676/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17676/ LogicError in ANGLE /cve/cve-2026-17677/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17677/ LogicError in ANGLE /cve/cve-2026-17678/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17678/ OOB in ANGLE /cve/cve-2026-17679/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17679/ LogicError in Print Preview /cve/cve-2026-17680/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17680/ OOB in Color /cve/cve-2026-17681/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17681/ LogicError in Web Authenticatio /cve/cve-2026-17682/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17682/ IntegerOverflow in ANGLE /cve/cve-2026-17683/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17683/ LogicError in ANGLE /cve/cve-2026-17684/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17684/ LogicError in Chrome for iOS /cve/cve-2026-17685/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17685/ UAF in Autofill /cve/cve-2026-17686/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17686/ LogicError in Passwords /cve/cve-2026-17687/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17687/ TypeConfusion in ANGLE /cve/cve-2026-17688/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17688/ UAF in Input /cve/cve-2026-17689/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17689/ UninitializedMemory in ANGLE /cve/cve-2026-17690/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17690/ LogicError in PDF /cve/cve-2026-17691/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17691/ OOB in ANGLE /cve/cve-2026-17692/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17692/ UAF in DataTransfer /cve/cve-2026-17693/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17693/ LogicError in FileSystem /cve/cve-2026-17694/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17694/ UAF in DOM /cve/cve-2026-17695/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17695/ LogicError in ANGLE /cve/cve-2026-17696/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17696/ LogicError in Media /cve/cve-2026-17697/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17697/ TypeConfusion in ANGLE /cve/cve-2026-17698/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17698/ LogicError in UI /cve/cve-2026-17699/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17699/ UAF in Views /cve/cve-2026-17700/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17700/ LogicError in Actor /cve/cve-2026-17701/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17701/ OOB in ANGLE /cve/cve-2026-17702/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17702/ LogicError in Skia /cve/cve-2026-17703/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17703/ LogicError in Chrome for iOS /cve/cve-2026-17704/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17704/ UAF in ANGLE /cve/cve-2026-17705/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17705/ IntegerOverflow in libxml2 /cve/cve-2026-17706/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17706/ LogicError in Media /cve/cve-2026-17707/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17707/ UninitializedMemory in Media /cve/cve-2026-17708/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17708/ UAF in Audio /cve/cve-2026-17709/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17709/ Race in Downloads /cve/cve-2026-17710/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17710/ LogicError in MHTML /cve/cve-2026-17711/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17711/ Race in Downloads /cve/cve-2026-17712/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17712/ Race in Skia /cve/cve-2026-17713/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17713/ LogicError in Accessibility /cve/cve-2026-17714/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17714/ UninitializedMemory in ANGLE /cve/cve-2026-17715/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17715/ LogicError in Passwords /cve/cve-2026-17716/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17716/ UAF in Updater /cve/cve-2026-17717/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17717/ IntegerOverflow in ANGLE /cve/cve-2026-17718/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17718/ UAF in ANGLE /cve/cve-2026-17719/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17719/ UAF in Input /cve/cve-2026-17720/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17720/ LogicError in Passwords /cve/cve-2026-17721/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17721/ OOB in ANGLE /cve/cve-2026-17722/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17722/ LogicError in WebView /cve/cve-2026-17723/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17723/ UAF in Media /cve/cve-2026-17724/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17724/ Race in Chrome for iOS /cve/cve-2026-17725/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17725/ TypeConfusion in V8 /cve/cve-2026-17726/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17726/ IntegerOverflow in WebGL /cve/cve-2026-17727/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17727/ OOB in WebGL /cve/cve-2026-17728/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17728/ LogicError in Extensions /cve/cve-2026-17729/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17729/ UAF in V8 /cve/cve-2026-17730/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17730/ LogicError in Autofill /cve/cve-2026-17731/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17731/ LogicError in Autofill /cve/cve-2026-17732/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17732/ LogicError in SVG /cve/cve-2026-17733/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17733/ LogicError in QUIC /cve/cve-2026-17734/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17734/ LogicError in Autofill /cve/cve-2026-17735/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17735/ LogicError in BFCache /cve/cve-2026-17736/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17736/ LogicError in WebView /cve/cve-2026-17737/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17737/ UAF in Bluetooth /cve/cve-2026-17738/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17738/ LogicError in Payments /cve/cve-2026-17739/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17739/ LogicError in Extensions /cve/cve-2026-17740/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17740/ UninitializedMemory in ANGLE /cve/cve-2026-17741/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17741/ LogicError in WebView /cve/cve-2026-17742/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17742/ LogicError in Payments /cve/cve-2026-17743/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17743/ LogicError in ControlledFrame /cve/cve-2026-17744/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17744/ LogicError in File Input /cve/cve-2026-17745/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17745/ OOB in Skia /cve/cve-2026-17746/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17746/ UAF in GPU /cve/cve-2026-17747/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17747/ LogicError in Payments /cve/cve-2026-17748/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17748/ LogicError in Extensions /cve/cve-2026-17749/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17749/ LogicError in Extensions /cve/cve-2026-17750/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17750/ UAF in ANGLE /cve/cve-2026-17751/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17751/ LogicError in AdFilter /cve/cve-2026-17752/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17752/ UAF in Views /cve/cve-2026-17753/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17753/ LogicError in Autofill /cve/cve-2026-17754/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17754/ LogicError in Blink /cve/cve-2026-17755/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17755/ LogicError in Extensions /cve/cve-2026-17756/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17756/ LogicError in Presentatio /cve/cve-2026-17757/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17757/ UninitializedMemory in Skia /cve/cve-2026-17758/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17758/ OOB in Daw /cve/cve-2026-17759/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17759/ UninitializedMemory in Codecs /cve/cve-2026-17760/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17760/ LogicError in NoStatePrefetch /cve/cve-2026-17761/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17761/ LogicError in Chrome for iOS /cve/cve-2026-17762/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17762/ LogicError in Chrome for iOS /cve/cve-2026-17763/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17763/ LogicError in GPU /cve/cve-2026-17764/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17764/ LogicError in FedCM /cve/cve-2026-17765/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17765/ LogicError in WebProtect /cve/cve-2026-17766/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17766/ LogicError in Clipboard /cve/cve-2026-17767/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17767/ LogicError in WebView /cve/cve-2026-17768/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17768/ LogicError in WebSockets /cve/cve-2026-17769/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17769/ LogicError in Cast /cve/cve-2026-17770/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17770/ OOB in Media /cve/cve-2026-17771/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17771/ UninitializedMemory in Skia /cve/cve-2026-17772/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17772/ OOB in WebGL /cve/cve-2026-17773/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17773/ LogicError in Cast /cve/cve-2026-17774/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17774/ LogicError in Variations /cve/cve-2026-17775/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17775/ LogicError in PresentationAPI /cve/cve-2026-17776/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17776/ LogicError in Receiver /cve/cve-2026-17777/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17777/ LogicError in Autofill /cve/cve-2026-17778/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17778/ UAF in Extensions /cve/cve-2026-17779/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17779/ LogicError in Site Isolatio /cve/cve-2026-17780/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17780/ LogicError in Isolated Web Apps /cve/cve-2026-17781/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17781/ LogicError in Extensions /cve/cve-2026-17782/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17782/ LogicError in Chrome for iOS /cve/cve-2026-17783/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17783/ LogicError in Loader /cve/cve-2026-17784/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17784/ UAF in Audio /cve/cve-2026-17785/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17785/ UninitializedMemory in ANGLE /cve/cve-2026-17786/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17786/ LogicError in DevTools /cve/cve-2026-17787/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17787/ LogicError in DevTools /cve/cve-2026-17788/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17788/ LogicError in Blink /cve/cve-2026-17789/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17789/ LogicError in Chrome for iOS /cve/cve-2026-17790/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17790/ UninitializedMemory in ANGLE /cve/cve-2026-17791/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17791/ LogicError in Payments /cve/cve-2026-17792/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17792/ LogicError in Credential Management /cve/cve-2026-17793/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17793/ LogicError in Messages /cve/cve-2026-17794/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17794/ LogicError in Mobile /cve/cve-2026-17795/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17795/ LogicError in GetUserMedia /cve/cve-2026-17796/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17796/ LogicError in WebXR /cve/cve-2026-17797/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17797/ LogicError in CSS /cve/cve-2026-17798/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17798/ LogicError in Cast /cve/cve-2026-17799/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17799/ LogicError in Safe Browsing /cve/cve-2026-17800/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17800/ LogicError in MediaRecording /cve/cve-2026-17801/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17801/ OOB in ANGLE /cve/cve-2026-17802/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17802/ LogicError in GPU /cve/cve-2026-17803/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17803/ LogicError in Save to Drive /cve/cve-2026-17804/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17804/ UAF in Media /cve/cve-2026-17805/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17805/ LogicError in Glic /cve/cve-2026-17806/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17806/ LogicError in Extensions /cve/cve-2026-17807/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17807/ UAF in V8 /cve/cve-2026-17808/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17808/ UninitializedMemory in WebGL /cve/cve-2026-17809/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17809/ LogicError in Extensions /cve/cve-2026-17810/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17810/ UninitializedMemory in Daw /cve/cve-2026-17811/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17811/ UAF in ANGLE /cve/cve-2026-17812/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17812/ LogicError in DigitalCredentials /cve/cve-2026-17813/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17813/ LogicError in Chrome for iOS /cve/cve-2026-17814/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17814/ LogicError in Chrome for iOS /cve/cve-2026-17815/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17815/ LogicError in GuestView /cve/cve-2026-17816/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17816/ LogicError in Speech /cve/cve-2026-17817/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17817/ LogicError in ReportingAndNEL /cve/cve-2026-17818/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17818/ LogicError in Network /cve/cve-2026-17819/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17819/ LogicError in WebAppInstalls /cve/cve-2026-17820/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17820/ LogicError in Autofill /cve/cve-2026-17821/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17821/ LogicError in Extensions /cve/cve-2026-17822/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17822/ LogicError in Chrome for iOS /cve/cve-2026-17823/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17823/ LogicError in WebXR /cve/cve-2026-17824/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17824/ LogicError in ServiceWorker /cve/cve-2026-17825/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17825/ LogicError in Passwords /cve/cve-2026-17826/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17826/ LogicError in Chrome for iOS /cve/cve-2026-17827/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17827/ LogicError in CSS /cve/cve-2026-17828/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17828/ LogicError in Chrome for iOS /cve/cve-2026-17829/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17829/ LogicError in Passwords /cve/cve-2026-17830/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17830/ LogicError in Chrome for iOS /cve/cve-2026-17831/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17831/ LogicError in Passwords /cve/cve-2026-17832/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17832/ UAF in ANGLE /cve/cve-2026-17833/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17833/ LogicError in Passwords /cve/cve-2026-17834/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17834/ LogicError in Passwords /cve/cve-2026-17835/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17835/ LogicError in Chrome for iOS /cve/cve-2026-17836/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17836/ UAF in V8 /cve/cve-2026-17837/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17837/ LogicError in DevTools /cve/cve-2026-17838/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17838/ LogicError in Chrome for iOS /cve/cve-2026-17839/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17839/ LogicError in Chrome for iOS /cve/cve-2026-17840/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17840/ LogicError in Passwords /cve/cve-2026-17841/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17841/ Race in Chrome for iOS /cve/cve-2026-17842/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17842/ LogicError in Chrome for iOS /cve/cve-2026-17843/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17843/ LogicError in CSS /cve/cve-2026-17844/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17844/ LogicError in Cast /cve/cve-2026-17845/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17845/ LogicError in CSS /cve/cve-2026-17846/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17846/ LogicError in Media /cve/cve-2026-17847/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17847/ LogicError in ANGLE /cve/cve-2026-17848/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17848/ LogicError in Codecs /cve/cve-2026-17849/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17849/ LogicError in Chrome for iOS /cve/cve-2026-17850/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17850/ LogicError in Permissions /cve/cve-2026-17851/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17851/ LogicError in Autofill /cve/cve-2026-17852/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17852/ LogicError in Media Router /cve/cve-2026-17853/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17853/ LogicError in DevTools /cve/cve-2026-17854/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17854/ LogicError in WebMCP /cve/cve-2026-17855/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17855/ Race in DevTools /cve/cve-2026-17856/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17856/ LogicError in Network /cve/cve-2026-17857/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17857/ LogicError in Network /cve/cve-2026-17858/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17858/ UninitializedMemory in WebNN /cve/cve-2026-17859/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17859/ LogicError in Favicons /cve/cve-2026-17860/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17860/ LogicError in Mobile /cve/cve-2026-17861/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17861/ LogicError in Updater /cve/cve-2026-17862/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17862/ UAF in Tracing /cve/cve-2026-17863/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17863/ LogicError in Browser /cve/cve-2026-17864/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17864/ LogicError in Updater /cve/cve-2026-17865/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17865/ LogicError in Crypto /cve/cve-2026-17866/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17866/ TypeConfusion in Tab /cve/cve-2026-17867/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17867/ LogicError in Daw /cve/cve-2026-17868/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17868/ LogicError in USB /cve/cve-2026-17869/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17869/ OOB in WebXR /cve/cve-2026-17870/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17870/ LogicError in Cast /cve/cve-2026-17871/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17871/ LogicError in Passwords /cve/cve-2026-17872/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17872/ LogicError in WebAppInstalls /cve/cve-2026-17873/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17873/ LogicError in Chrome for iOS /cve/cve-2026-17874/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17874/ LogicError in Chrome for iOS /cve/cve-2026-17875/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17875/ UAF in PDFium /cve/cve-2026-17876/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17876/ LogicError in Payments /cve/cve-2026-17877/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17877/ LogicError in Chromoting /cve/cve-2026-17878/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17878/ LogicError in CSS /cve/cve-2026-17879/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17879/ LogicError in Autofill /cve/cve-2026-17880/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17880/ LogicError in Autofill /cve/cve-2026-17881/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17881/ UAF in WebXR /cve/cve-2026-17882/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17882/ LogicError in Extensions /cve/cve-2026-17883/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17883/ LogicError in Headless /cve/cve-2026-17884/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17884/ LogicError in WebRTC /cve/cve-2026-17885/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17885/ LogicError in Paint /cve/cve-2026-17886/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17886/ UAF in Enterprise /cve/cve-2026-17887/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17887/ UAF in TabStrip /cve/cve-2026-17888/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17888/ LogicError in WebUI /cve/cve-2026-17889/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17889/ UninitializedMemory in WebXR /cve/cve-2026-17890/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17890/ LogicError in DevTools /cve/cve-2026-17891/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17891/ UAF in ANGLE /cve/cve-2026-17892/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17892/ LogicError in WebXR /cve/cve-2026-17893/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17893/ LogicError in Updater /cve/cve-2026-17894/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17894/ UAF in Views /cve/cve-2026-17895/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17895/ LogicError in DataTransfer /cve/cve-2026-17896/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17896/ UAF in DevTools /cve/cve-2026-17897/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17897/ LogicError in ORB /cve/cve-2026-17898/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17898/ UAF in DevTools /cve/cve-2026-17899/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17899/ LogicError in DevTools /cve/cve-2026-17900/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17900/ LogicError in Enterprise /cve/cve-2026-17901/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17901/ LogicError in Sharing /cve/cve-2026-17902/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17902/ LogicError in Editing /cve/cve-2026-17903/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17903/ LogicError in Chromecast /cve/cve-2026-17904/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17904/ LogicError in NFC /cve/cve-2026-17905/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17905/ LogicError in SurfaceCapture /cve/cve-2026-17906/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17906/ LogicError in Bluetooth /cve/cve-2026-17907/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17907/ LogicError in Network /cve/cve-2026-17908/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17908/ LogicError in Printing /cve/cve-2026-17909/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17909/ LogicError in Isolated Web Apps /cve/cve-2026-17910/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17910/ LogicError in NFC /cve/cve-2026-17911/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17911/ LogicError in SVG /cve/cve-2026-17912/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17912/ LogicError in Chrome for iOS /cve/cve-2026-17913/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17913/ LogicError in Chrome for iOS /cve/cve-2026-17914/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17914/ LogicError in Skia /cve/cve-2026-17915/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17915/ LogicError in WebView /cve/cve-2026-17916/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17916/ LogicError in Settings /cve/cve-2026-17917/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17917/ LogicError in Chrome for iOS /cve/cve-2026-17918/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17918/ UAF in Sync /cve/cve-2026-17919/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17919/ LogicError in Enterprise /cve/cve-2026-17920/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17920/ UAF in V8 /cve/cve-2026-17921/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17921/ LogicError in Navigatio /cve/cve-2026-17922/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17922/ LogicError in Enterprise /cve/cve-2026-17923/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17923/ LogicError in Enterprise /cve/cve-2026-17924/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17924/ UAF in DNS /cve/cve-2026-17925/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17925/ LogicError in Cast /cve/cve-2026-17926/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17926/ LogicError in DevTools /cve/cve-2026-17927/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17927/ LogicError in DevTools /cve/cve-2026-17928/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17928/ LogicError in DataTransfer /cve/cve-2026-17929/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17929/ LogicError in DevTools /cve/cve-2026-17930/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17930/ LogicError in Extensions /cve/cve-2026-17931/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17931/ LogicError in DevTools /cve/cve-2026-17932/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17932/ UAF in DataTransfer /cve/cve-2026-17933/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17933/ LogicError in DOMStorage /cve/cve-2026-17934/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17934/ LogicError in DevTools /cve/cve-2026-17935/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17935/ OOB in Codecs /cve/cve-2026-17936/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17936/ LogicError in DevTools /cve/cve-2026-17937/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17937/ LogicError in DevTools /cve/cve-2026-17938/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17938/ LogicError in FullScree /cve/cve-2026-17939/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17939/ LogicError in Passwords /cve/cve-2026-17940/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17940/ LogicError in Picture-in-Picture /cve/cve-2026-17941/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17941/ LogicError in Chrome for iOS /cve/cve-2026-17942/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17942/ LogicError in SVG /cve/cve-2026-17943/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17943/ LogicError in Parser /cve/cve-2026-17944/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17944/ LogicError in Chrome for iOS /cve/cve-2026-17945/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17945/ LogicError in Navigatio /cve/cve-2026-17946/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17946/ UninitializedMemory in Daw /cve/cve-2026-17947/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17947/ UAF in WebSockets /cve/cve-2026-17948/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17948/ TypeConfusion in V8 /cve/cve-2026-17949/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17949/ UninitializedMemory in GPU /cve/cve-2026-17950/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17950/ LogicError in Safebrowsing /cve/cve-2026-17951/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17951/ OOB in WebRTC /cve/cve-2026-17952/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17952/ LogicError in V8 /cve/cve-2026-17953/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17953/ LogicError in WebView /cve/cve-2026-17954/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17954/ LogicError in MHTML /cve/cve-2026-17955/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17955/ LogicError in Payments /cve/cve-2026-17956/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17956/ LogicError in Scheduling /cve/cve-2026-17957/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17957/ CrossOrigin in CORS /cve/cve-2026-17958/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17958/ LogicError in Views /cve/cve-2026-17959/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17959/ LogicError in Network /cve/cve-2026-17960/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17960/ LogicError in Chrome for iOS /cve/cve-2026-17961/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17961/ LogicError in Sessio /cve/cve-2026-17962/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17962/ LogicError in Blink /cve/cve-2026-17963/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17963/ LogicError in SVG /cve/cve-2026-17964/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17964/ LogicError in UI /cve/cve-2026-17965/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17965/ LogicError in Chrome for iOS /cve/cve-2026-17966/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17966/ LogicError in Views /cve/cve-2026-17967/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17967/ UAF in Chrome for iOS /cve/cve-2026-17968/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17968/ UninitializedMemory in WebXR /cve/cve-2026-17969/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17969/ LogicError in Passwords /cve/cve-2026-17970/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17970/ LogicError in Passwords /cve/cve-2026-17971/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17971/ LogicError in Frame /cve/cve-2026-17972/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17972/ LogicError in Chrome for iOS /cve/cve-2026-17973/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17973/ LogicError in Views /cve/cve-2026-17974/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17974/ LogicError in DevTools /cve/cve-2026-17975/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17975/ LogicError in IME /cve/cve-2026-17976/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17976/ LogicError in Extensions /cve/cve-2026-17977/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17977/ LogicError in CSS /cve/cve-2026-17978/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17978/ LogicError in WebCodecs /cve/cve-2026-17979/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17979/ Race in V8 /cve/cve-2026-17980/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17980/ LogicError in UI /cve/cve-2026-17981/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17981/ LogicError in Blink /cve/cve-2026-17982/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17982/ LogicError in Cast /cve/cve-2026-17983/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17983/ LogicError in Global Media Controls /cve/cve-2026-17984/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17984/ LogicError in Browser /cve/cve-2026-17985/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17985/ LogicError in Speech /cve/cve-2026-17986/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17986/ LogicError in Bluetooth /cve/cve-2026-17987/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17987/ LogicError in Notifications /cve/cve-2026-17988/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17988/ LogicError in Navigatio /cve/cve-2026-17989/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17989/ TypeConfusion in V8 /cve/cve-2026-17990/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17990/ LogicError in WebAuth /cve/cve-2026-17991/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17991/ LogicError in AI /cve/cve-2026-17992/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17992/ UninitializedMemory in Skia /cve/cve-2026-17993/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17993/ Race in Updater /cve/cve-2026-17994/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17994/ LogicError in Media /cve/cve-2026-17995/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17995/ OOB in Daw /cve/cve-2026-17996/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17996/ LogicError in Browser /cve/cve-2026-17997/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17997/ LogicError in Passwords /cve/cve-2026-17998/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17998/ LogicError in Extensions /cve/cve-2026-17999/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-17999/ LogicError in PictureInPicture /cve/cve-2026-18000/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18000/ LogicError in USB /cve/cve-2026-18001/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18001/ LogicError in WebGL /cve/cve-2026-18002/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18002/ LogicError in Google Lens /cve/cve-2026-18003/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18003/ LogicError in Chrome for iOS /cve/cve-2026-18004/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18004/ LogicError in Speech /cve/cve-2026-18005/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18005/ LogicError in WebXR /cve/cve-2026-18006/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18006/ LogicError in Google Lens /cve/cve-2026-18007/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18007/ LogicError in Input /cve/cve-2026-18008/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18008/ LogicError in Settings /cve/cve-2026-18009/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18009/ LogicError in Passwords /cve/cve-2026-18010/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18010/ LogicError in Passwords /cve/cve-2026-18011/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18011/ LogicError in Chrome for iOS /cve/cve-2026-18012/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18012/ UAF in PDFium /cve/cve-2026-18013/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18013/ LogicError in Chrome for iOS /cve/cve-2026-18014/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18014/ LogicError in DevTools /cve/cve-2026-18015/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18015/ LogicError in Tint /cve/cve-2026-18016/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18016/ LogicError in Chrome for iOS /cve/cve-2026-18017/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18017/ UAF in Daw /cve/cve-2026-18018/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18018/ LogicError in Updater /cve/cve-2026-18019/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-18019/ LogicError in Media /cve/cve-2026-82072/ Wed, 29 Jul 2026 00:00:00 +0000 /cve/cve-2026-82072/ OOB in V8 /cve/cve-2026-43804/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-43804/ Bypass in WebCore /cve/cve-2026-43821/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-43821/ Bypass in WebKit /cve/cve-2026-64713/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64713/ CrossOrigin in WebCore /cve/cve-2026-64718/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64718/ Race in WebCore /cve/cve-2026-64719/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64719/ OOB in WebKit /cve/cve-2026-64728/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64728/ CrossOrigin in WebCore /cve/cve-2026-64730/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64730/ LogicError in WTF /cve/cve-2026-64757/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64757/ OOB in JSC /cve/cve-2026-64783/ Mon, 27 Jul 2026 00:00:00 +0000 /cve/cve-2026-64783/ UAF in WebCore /cve/cve-2026-16804/ Thu, 23 Jul 2026 00:00:00 +0000 /cve/cve-2026-16804/ UAF in Input /cve/cve-2026-16805/ Thu, 23 Jul 2026 00:00:00 +0000 /cve/cve-2026-16805/ UAF in Blink /cve/cve-2026-16806/ Thu, 23 Jul 2026 00:00:00 +0000 /cve/cve-2026-16806/ UAF in WebMCP /cve/cve-2026-16807/ Thu, 23 Jul 2026 00:00:00 +0000 /cve/cve-2026-16807/ OOB in Codecs /cve/cve-2026-16349/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16349/ CrossOrigin in Core /cve/cve-2026-16350/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16350/ LogicError in Toolkit /cve/cve-2026-16351/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16351/ UAF in Core /cve/cve-2026-16352/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16352/ UAF in Core /cve/cve-2026-16353/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16353/ LogicError in DOM /cve/cve-2026-16354/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16354/ LogicError in ImageLib /cve/cve-2026-16355/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16355/ LogicError in SpiderMonkey /cve/cve-2026-16356/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16356/ UAF in Core /cve/cve-2026-16357/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16357/ LogicError in Graphics /cve/cve-2026-16358/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16358/ LogicError in Graphics /cve/cve-2026-16359/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16359/ LogicError in DOM /cve/cve-2026-16360/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16360/ MemoryCorruption in Graphics /cve/cve-2026-16362/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16362/ UAF in DOM /cve/cve-2026-16363/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16363/ LogicError in SpiderMonkey /cve/cve-2026-16364/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16364/ LogicError in DOM /cve/cve-2026-16365/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16365/ LogicError in Core /cve/cve-2026-16366/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16366/ LogicError in Core /cve/cve-2026-16367/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16367/ SandboxEscape in Core /cve/cve-2026-16368/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16368/ LogicError in SpiderMonkey /cve/cve-2026-16369/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16369/ IntegerOverflow in SpiderMonkey /cve/cve-2026-16370/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16370/ LogicError in DOM /cve/cve-2026-16371/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16371/ LogicError in DOM /cve/cve-2026-16372/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16372/ LogicError in DOM /cve/cve-2026-16373/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16373/ LogicError in Core /cve/cve-2026-16374/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16374/ LogicError in Core /cve/cve-2026-16375/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16375/ LogicError in Networking /cve/cve-2026-16376/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16376/ LogicError in Core /cve/cve-2026-16377/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16377/ LogicError in Toolkit /cve/cve-2026-16378/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16378/ LogicError in Widget /cve/cve-2026-16379/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16379/ LogicError in DOM /cve/cve-2026-16380/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16380/ LogicError in Networking /cve/cve-2026-16381/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16381/ CrossOrigin in Networking /cve/cve-2026-16382/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16382/ LogicError in DOM /cve/cve-2026-16383/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16383/ LogicError in DOM /cve/cve-2026-16384/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16384/ UninitializedMemory in Core /cve/cve-2026-16385/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16385/ UninitializedMemory in Core /cve/cve-2026-16386/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16386/ UninitializedMemory in Core /cve/cve-2026-16387/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16387/ LogicError in DOM /cve/cve-2026-16388/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16388/ SandboxEscape in DOM /cve/cve-2026-16389/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16389/ IntegerOverflow in Core /cve/cve-2026-16390/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16390/ LogicError in Core /cve/cve-2026-16391/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16391/ LogicError in DOM /cve/cve-2026-16392/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16392/ LogicError in SpiderMonkey /cve/cve-2026-16393/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16393/ LogicError in DOM /cve/cve-2026-16394/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16394/ LogicError in DOM /cve/cve-2026-16395/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16395/ IntegerOverflow in DOM /cve/cve-2026-16396/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16396/ LogicError in Core /cve/cve-2026-16397/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16397/ LogicError in Core /cve/cve-2026-16398/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16398/ LogicError in Core /cve/cve-2026-16399/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16399/ LogicError in DOM /cve/cve-2026-16400/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16400/ LogicError in DOM /cve/cve-2026-16401/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16401/ LogicError in DOM /cve/cve-2026-16402/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16402/ IntegerOverflow in ImageLib /cve/cve-2026-16403/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16403/ LogicError in Core /cve/cve-2026-16404/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16404/ LogicError in Core /cve/cve-2026-16405/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16405/ LogicError in Networking /cve/cve-2026-16406/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16406/ LogicError in Networking /cve/cve-2026-16407/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16407/ LogicError in DOM /cve/cve-2026-16408/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16408/ IntegerOverflow in DOM /cve/cve-2026-16409/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16409/ LogicError in Security/NSS /cve/cve-2026-16410/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16410/ LogicError in SpiderMonkey /cve/cve-2026-16411/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16411/ MemoryCorruption in DOM /cve/cve-2026-16412/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16412/ MemoryCorruption in SpiderMonkey /cve/cve-2026-16413/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16413/ OOB in ANGLE /cve/cve-2026-16414/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16414/ LogicError in Chromecast /cve/cve-2026-16415/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16415/ LogicError in Extensions /cve/cve-2026-16416/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16416/ IntegerOverflow in Chromecast /cve/cve-2026-16417/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16417/ UninitializedMemory in Skia /cve/cve-2026-16418/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16418/ OOB in V8 /cve/cve-2026-16419/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16419/ OOB in ANGLE /cve/cve-2026-16420/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16420/ TypeConfusion in WebAudio /cve/cve-2026-16421/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16421/ LogicError in WebAudio /cve/cve-2026-16422/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16422/ LogicError in Certificate /cve/cve-2026-16423/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16423/ UAF in UI /cve/cve-2026-16424/ Tue, 21 Jul 2026 00:00:00 +0000 /cve/cve-2026-16424/ UAF in GPU /cve/cve-2026-15899/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15899/ UAF in CameraCapture /cve/cve-2026-15900/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15900/ UAF in GPU /cve/cve-2026-15901/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15901/ UAF in Network /cve/cve-2026-15902/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15902/ UAF in Cast /cve/cve-2026-15903/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15903/ OOB in V8 /cve/cve-2026-15904/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15904/ UAF in Ozone /cve/cve-2026-15905/ Thu, 16 Jul 2026 00:00:00 +0000 /cve/cve-2026-15905/ UAF in Aura /cve/cve-2026-15718/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15718/ LogicError in SpiderMonkey /cve/cve-2026-15719/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15719/ LogicError in Core /cve/cve-2026-15764/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15764/ UAF in Ozone /cve/cve-2026-15765/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15765/ UAF in Ozone /cve/cve-2026-15766/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15766/ UninitializedMemory in Skia /cve/cve-2026-15767/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15767/ OOB in Chromium /cve/cve-2026-15768/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15768/ LogicError in HTML-in-Canvas /cve/cve-2026-15769/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15769/ LogicError in Linux Toolkit Theming /cve/cve-2026-15770/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15770/ UninitializedMemory in V8 /cve/cve-2026-15771/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15771/ LogicError in Media /cve/cve-2026-15772/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15772/ UAF in GPU /cve/cve-2026-15773/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15773/ UAF in Core /cve/cve-2026-15774/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15774/ UAF in Skia /cve/cve-2026-15775/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15775/ LogicError in V8 /cve/cve-2026-15776/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15776/ TypeConfusion in V8 /cve/cve-2026-15777/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15777/ UAF in UI /cve/cve-2026-15778/ Tue, 14 Jul 2026 00:00:00 +0000 /cve/cve-2026-15778/ LogicError in Navigatio /cve/cve-2026-15107/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15107/ UAF in IndexedDB /cve/cve-2026-15108/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15108/ IntegerOverflow in Extensions API /cve/cve-2026-15109/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15109/ UninitializedMemory in ANGLE /cve/cve-2026-15110/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15110/ UAF in Extensions /cve/cve-2026-15111/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15111/ UAF in Views /cve/cve-2026-15112/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15112/ UAF in Ozone /cve/cve-2026-15113/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15113/ UAF in Autofill /cve/cve-2026-15114/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15114/ OOB in Codecs /cve/cve-2026-15115/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15115/ LogicError in WebAppInstalls /cve/cve-2026-15116/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15116/ UAF in Actor /cve/cve-2026-15117/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15117/ UAF in Payments /cve/cve-2026-15118/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15118/ UAF in Input /cve/cve-2026-15119/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15119/ LogicError in GetUserMedia /cve/cve-2026-15120/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15120/ UAF in Core /cve/cve-2026-15121/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15121/ UAF in WebRTC /cve/cve-2026-15122/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15122/ LogicError in Codecs /cve/cve-2026-15123/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15123/ LogicError in DOM /cve/cve-2026-15124/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15124/ LogicError in Passwords /cve/cve-2026-15125/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15125/ LogicError in Forms /cve/cve-2026-15126/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15126/ UAF in Forms /cve/cve-2026-15127/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15127/ LogicError in WebGL /cve/cve-2026-15128/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15128/ LogicError in Forms /cve/cve-2026-15129/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15129/ UAF in Views /cve/cve-2026-15130/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15130/ LogicError in Navigatio /cve/cve-2026-15131/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15131/ LogicError in Navigatio /cve/cve-2026-15132/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15132/ UninitializedMemory in V8 /cve/cve-2026-15133/ Wed, 08 Jul 2026 00:00:00 +0000 /cve/cve-2026-15133/ UAF in InterestGroups /cve/cve-2026-13774/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13774/ UAF in Extensions /cve/cve-2026-13775/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13775/ UAF in GPU /cve/cve-2026-13776/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13776/ TypeConfusion in Daw /cve/cve-2026-13777/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13777/ LogicError in Chromium /cve/cve-2026-13778/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13778/ UAF in WebUSB /cve/cve-2026-13779/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13779/ UAF in Chromoting /cve/cve-2026-13780/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13780/ LogicError in ANGLE /cve/cve-2026-13781/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13781/ LogicError in Skia /cve/cve-2026-13782/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13782/ UAF in Browser /cve/cve-2026-13783/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13783/ UAF in Views /cve/cve-2026-13784/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13784/ UAF in Views /cve/cve-2026-13785/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13785/ UAF in Bluetooth /cve/cve-2026-13786/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13786/ UAF in Ozone /cve/cve-2026-13787/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13787/ UAF in Chromoting /cve/cve-2026-13788/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13788/ UAF in Fullscree /cve/cve-2026-13790/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13790/ LogicError in Scroll /cve/cve-2026-13791/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13791/ LogicError in Downloads /cve/cve-2026-13792/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13792/ UAF in Touchbar /cve/cve-2026-13793/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13793/ LogicError in SVG /cve/cve-2026-13794/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13794/ LogicError in WebAppInstalls /cve/cve-2026-13795/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13795/ LogicError in Chrome for iOS /cve/cve-2026-13796/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13796/ IntegerOverflow in Chromecast /cve/cve-2026-13797/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13797/ LogicError in Chromecast /cve/cve-2026-13798/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13798/ OOB in Chromecast /cve/cve-2026-13799/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13799/ UAF in QUIC /cve/cve-2026-13800/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13800/ LogicError in Updater /cve/cve-2026-13801/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13801/ IntegerOverflow in Chromecast /cve/cve-2026-13802/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13802/ UAF in Views /cve/cve-2026-13803/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13803/ TypeConfusion in Chrome Tabs /cve/cve-2026-13804/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13804/ UAF in Chromecast /cve/cve-2026-13805/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13805/ UAF in GFX /cve/cve-2026-13806/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13806/ LogicError in Accessibility /cve/cve-2026-13807/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13807/ UAF in Import /cve/cve-2026-13808/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13808/ LogicError in Chrome for iOS /cve/cve-2026-13809/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13809/ LogicError in Safe Browsing /cve/cve-2026-13810/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13810/ LogicError in Input /cve/cve-2026-13811/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13811/ UAF in IME /cve/cve-2026-13812/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13812/ LogicError in Chrome for iOS /cve/cve-2026-13813/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13813/ LogicError in Chrome for iOS /cve/cve-2026-13814/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13814/ UAF in Views /cve/cve-2026-13815/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13815/ UAF in Blink /cve/cve-2026-13816/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13816/ LogicError in File Input /cve/cve-2026-13817/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13817/ LogicError in Glic /cve/cve-2026-13818/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13818/ LogicError in Passwords /cve/cve-2026-13819/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13819/ OOB in ANGLE /cve/cve-2026-13820/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13820/ OOB in Skia /cve/cve-2026-13821/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13821/ UAF in Canvas /cve/cve-2026-13822/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13822/ LogicError in Extensions /cve/cve-2026-13823/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13823/ UAF in Glic /cve/cve-2026-13824/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13824/ LogicError in Extensions /cve/cve-2026-13825/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13825/ UninitializedMemory in Daw /cve/cve-2026-13826/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13826/ LogicError in Autofill /cve/cve-2026-13827/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13827/ UAF in Updater /cve/cve-2026-13828/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13828/ LogicError in Enterprise /cve/cve-2026-13829/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13829/ LogicError in Settings /cve/cve-2026-13830/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13830/ UAF in Chromoting /cve/cve-2026-13831/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13831/ UAF in GPU /cve/cve-2026-13832/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13832/ UAF in Headless /cve/cve-2026-13833/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13833/ UninitializedMemory in ANGLE /cve/cve-2026-13834/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13834/ LogicError in ANGLE /cve/cve-2026-13835/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13835/ LogicError in XML /cve/cve-2026-13836/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13836/ LogicError in CSS /cve/cve-2026-13837/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13837/ LogicError in CSS /cve/cve-2026-13838/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13838/ LogicError in CSS /cve/cve-2026-13839/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13839/ LogicError in CSS /cve/cve-2026-13840/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13840/ LogicError in Canvas /cve/cve-2026-13841/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13841/ IntegerOverflow in Skia /cve/cve-2026-13842/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13842/ LogicError in Chrome for iOS /cve/cve-2026-13843/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13843/ LogicError in Chrome for iOS /cve/cve-2026-13844/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13844/ UAF in Updater /cve/cve-2026-13845/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13845/ UAF in DOM /cve/cve-2026-13846/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13846/ UAF in USB /cve/cve-2026-13847/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13847/ LogicError in Chrome for iOS /cve/cve-2026-13848/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13848/ UAF in Forms /cve/cve-2026-13849/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13849/ LogicError in Chromoting /cve/cve-2026-13850/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13850/ LogicError in Chrome for iOS /cve/cve-2026-13851/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13851/ LogicError in WebAppInstalls /cve/cve-2026-13852/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13852/ LogicError in WebAppInstalls /cve/cve-2026-13853/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13853/ UAF in Journeys /cve/cve-2026-13854/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13854/ UAF in Ozone /cve/cve-2026-13855/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13855/ UAF in Ozone /cve/cve-2026-13856/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13856/ LogicError in Speech /cve/cve-2026-13857/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13857/ LogicError in Geometry /cve/cve-2026-13858/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13858/ OOB in FFmpeg /cve/cve-2026-13859/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13859/ LogicError in ANGLE /cve/cve-2026-13860/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13860/ LogicError in Autofill /cve/cve-2026-13861/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13861/ UAF in Core /cve/cve-2026-13862/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13862/ LogicError in Chromium /cve/cve-2026-13863/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13863/ LogicError in CustomTabs /cve/cve-2026-13864/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13864/ LogicError in WebHID /cve/cve-2026-13865/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13865/ LogicError in Enterprise /cve/cve-2026-13866/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13866/ LogicError in Input /cve/cve-2026-13867/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13867/ LogicError in Geolocatio /cve/cve-2026-13868/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13868/ LogicError in Network /cve/cve-2026-13869/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13869/ UAF in Device /cve/cve-2026-13870/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13870/ UAF in WebView /cve/cve-2026-13871/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13871/ LogicError in GuestView /cve/cve-2026-13872/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13872/ LogicError in WebAppInstalls /cve/cve-2026-13873/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13873/ OOB in Layout /cve/cve-2026-13874/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13874/ LogicError in DataTransfer /cve/cve-2026-13875/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13875/ LogicError in GPU /cve/cve-2026-13876/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13876/ LogicError in Network /cve/cve-2026-13877/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13877/ LogicError in ANGLE /cve/cve-2026-13878/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13878/ UAF in Bluetooth /cve/cve-2026-13879/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13879/ UAF in Bluetooth /cve/cve-2026-13880/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13880/ UAF in USB /cve/cve-2026-13881/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13881/ LogicError in WebAppInstalls /cve/cve-2026-13882/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13882/ LogicError in USB /cve/cve-2026-13883/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13883/ TypeConfusion in ANGLE /cve/cve-2026-13884/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13884/ OOB in Chromecast /cve/cve-2026-13885/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13885/ UAF in Skia /cve/cve-2026-13886/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13886/ LogicError in Isolated Web Apps /cve/cve-2026-13887/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13887/ LogicError in NFC /cve/cve-2026-13888/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13888/ UAF in Extensions /cve/cve-2026-13889/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13889/ LogicError in WebAuthenticatio /cve/cve-2026-13890/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13890/ OOB in Chromecast /cve/cve-2026-13891/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13891/ LogicError in Extensions /cve/cve-2026-13892/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13892/ LogicError in Chrome for iOS /cve/cve-2026-13893/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13893/ LogicError in WebUI /cve/cve-2026-13894/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13894/ LogicError in Network /cve/cve-2026-13895/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13895/ LogicError in Autofill /cve/cve-2026-13896/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13896/ LogicError in Glic /cve/cve-2026-13897/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13897/ LogicError in Chromecast /cve/cve-2026-13898/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13898/ UAF in Cast Receiver /cve/cve-2026-13899/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13899/ UAF in HTML /cve/cve-2026-13900/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13900/ LogicError in Chromecast /cve/cve-2026-13901/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13901/ LogicError in Serial /cve/cve-2026-13902/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13902/ LogicError in Chrome for iOS /cve/cve-2026-13903/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13903/ LogicError in Bluetooth /cve/cve-2026-13904/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13904/ LogicError in Safe Browsing /cve/cve-2026-13905/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13905/ LogicError in Chrome for iOS /cve/cve-2026-13906/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13906/ OOB in Codecs /cve/cve-2026-13907/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13907/ LogicError in Chromium /cve/cve-2026-13908/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13908/ LogicError in Omnibox /cve/cve-2026-13909/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13909/ LogicError in DevTools /cve/cve-2026-13910/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13910/ LogicError in WebXR /cve/cve-2026-13911/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13911/ LogicError in Spellcheck /cve/cve-2026-13912/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13912/ LogicError in Safe Browsing /cve/cve-2026-13913/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13913/ LogicError in Autofill /cve/cve-2026-13914/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13914/ LogicError in Passwords /cve/cve-2026-13915/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13915/ UAF in Chrome for iOS /cve/cve-2026-13916/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13916/ LogicError in Chrome for iOS /cve/cve-2026-13917/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13917/ LogicError in Chrome for iOS /cve/cve-2026-13918/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13918/ UAF in Chrome for iOS /cve/cve-2026-13919/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13919/ LogicError in Extensions /cve/cve-2026-13920/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13920/ LogicError in Media /cve/cve-2026-13921/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13921/ LogicError in DeviceBoundSessionCredentials /cve/cve-2026-13922/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13922/ LogicError in Paint /cve/cve-2026-13923/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13923/ UninitializedMemory in GPU /cve/cve-2026-13924/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13924/ LogicError in WebView /cve/cve-2026-13925/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13925/ LogicError in Downloads /cve/cve-2026-13926/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13926/ LogicError in Network /cve/cve-2026-13927/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13927/ LogicError in UI /cve/cve-2026-13928/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13928/ LogicError in Enterprise /cve/cve-2026-13929/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13929/ LogicError in DevTools /cve/cve-2026-13930/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13930/ LogicError in Actor /cve/cve-2026-13931/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13931/ LogicError in Media /cve/cve-2026-13932/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13932/ LogicError in Sharing /cve/cve-2026-13933/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13933/ LogicError in Passwords /cve/cve-2026-13934/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13934/ LogicError in Daw /cve/cve-2026-13935/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13935/ LogicError in ComputePressure /cve/cve-2026-13936/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13936/ LogicError in Passwords /cve/cve-2026-13937/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13937/ LogicError in Passwords /cve/cve-2026-13938/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13938/ IntegerOverflow in Fonts /cve/cve-2026-13939/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13939/ LogicError in WebShare /cve/cve-2026-13940/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13940/ UninitializedMemory in Cast /cve/cve-2026-13941/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13941/ LogicError in SiteSettings /cve/cve-2026-13942/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13942/ LogicError in Video Capture /cve/cve-2026-13943/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13943/ UninitializedMemory in CSS /cve/cve-2026-13944/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13944/ LogicError in DataTransfer /cve/cve-2026-13945/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13945/ LogicError in Extensions /cve/cve-2026-13946/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13946/ LogicError in ScriptInjections /cve/cve-2026-13947/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13947/ UninitializedMemory in XR /cve/cve-2026-13948/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13948/ LogicError in Extensions /cve/cve-2026-13949/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13949/ LogicError in Payments /cve/cve-2026-13950/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13950/ UninitializedMemory in GPU /cve/cve-2026-13951/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13951/ LogicError in USB /cve/cve-2026-13952/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13952/ LogicError in PerformanceAPIs /cve/cve-2026-13953/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13953/ LogicError in SplitView /cve/cve-2026-13954/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13954/ LogicError in XML /cve/cve-2026-13955/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13955/ LogicError in CustomTabs /cve/cve-2026-13956/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13956/ LogicError in PageInfo /cve/cve-2026-13957/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13957/ LogicError in Extensions /cve/cve-2026-13958/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13958/ UninitializedMemory in Codecs /cve/cve-2026-13959/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13959/ LogicError in Blink /cve/cve-2026-13960/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13960/ LogicError in Passwords /cve/cve-2026-13961/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13961/ LogicError in DevTools /cve/cve-2026-13962/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13962/ LogicError in PDF /cve/cve-2026-13963/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13963/ LogicError in DevTools /cve/cve-2026-13964/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13964/ LogicError in WebView /cve/cve-2026-13965/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13965/ UAF in Oilpa /cve/cve-2026-13966/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13966/ LogicError in History /cve/cve-2026-13967/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13967/ TypeConfusion in V8 /cve/cve-2026-13968/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13968/ LogicError in DevTools /cve/cve-2026-13969/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13969/ UninitializedMemory in UI /cve/cve-2026-13970/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13970/ UninitializedMemory in Media /cve/cve-2026-13971/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13971/ UninitializedMemory in Skia /cve/cve-2026-13972/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13972/ LogicError in Paint /cve/cve-2026-13973/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13973/ LogicError in UI /cve/cve-2026-13974/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13974/ IntegerOverflow in Safe Browsing /cve/cve-2026-13975/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13975/ OOB in ANGLE /cve/cve-2026-13976/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13976/ OOB in Storage /cve/cve-2026-13977/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13977/ LogicError in HTMLParser /cve/cve-2026-13978/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13978/ LogicError in PageInfo /cve/cve-2026-13979/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13979/ LogicError in Paint /cve/cve-2026-13980/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13980/ LogicError in Chrome for iOS /cve/cve-2026-13981/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13981/ LogicError in Chrome for iOS /cve/cve-2026-13982/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13982/ LogicError in Passwords /cve/cve-2026-13983/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13983/ LogicError in Chrome for iOS /cve/cve-2026-13984/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13984/ LogicError in TabStrip /cve/cve-2026-13985/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13985/ LogicError in MediaCapture /cve/cve-2026-13986/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13986/ LogicError in Media UI /cve/cve-2026-13987/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13987/ LogicError in Mobile /cve/cve-2026-13988/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13988/ LogicError in Paint /cve/cve-2026-13989/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13989/ LogicError in PageInfo /cve/cve-2026-13990/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13990/ LogicError in DataTransfer /cve/cve-2026-13991/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13991/ LogicError in Chrome for iOS /cve/cve-2026-13992/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13992/ LogicError in UI /cve/cve-2026-13993/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13993/ LogicError in WebAppInstalls /cve/cve-2026-13994/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13994/ LogicError in Credential Management /cve/cve-2026-13995/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13995/ LogicError in Autofill /cve/cve-2026-13996/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13996/ LogicError in Permissions /cve/cve-2026-13997/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13997/ LogicError in Extensions /cve/cve-2026-13998/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13998/ LogicError in File Input /cve/cve-2026-13999/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-13999/ LogicError in Extensions /cve/cve-2026-14000/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14000/ LogicError in XML /cve/cve-2026-14001/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14001/ LogicError in Network /cve/cve-2026-14002/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14002/ LogicError in Geolocatio /cve/cve-2026-14003/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14003/ LogicError in Extensions /cve/cve-2026-14004/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14004/ LogicError in CSS /cve/cve-2026-14005/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14005/ UAF in Omnibox /cve/cve-2026-14006/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14006/ UAF in Navigatio /cve/cve-2026-14007/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14007/ LogicError in PermissionsPolicy /cve/cve-2026-14008/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14008/ UninitializedMemory in WebXR /cve/cve-2026-14009/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14009/ LogicError in Passwords /cve/cve-2026-14010/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14010/ UninitializedMemory in Codecs /cve/cve-2026-14011/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14011/ OOB in SurfaceCapture /cve/cve-2026-14012/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14012/ LogicError in CSS /cve/cve-2026-14013/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14013/ LogicError in SVG /cve/cve-2026-14014/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14014/ LogicError in Paint /cve/cve-2026-14015/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14015/ LogicError in WebRTC /cve/cve-2026-14016/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14016/ LogicError in SVG /cve/cve-2026-14017/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14017/ LogicError in Navigatio /cve/cve-2026-14018/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14018/ UAF in Updater /cve/cve-2026-14019/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14019/ LogicError in Passwords /cve/cve-2026-14020/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14020/ LogicError in WebXR /cve/cve-2026-14021/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14021/ LogicError in StorageAccessAPI /cve/cve-2026-14022/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14022/ LogicError in Network /cve/cve-2026-14023/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14023/ LogicError in SanitizerAPI /cve/cve-2026-14024/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14024/ UAF in Ozone /cve/cve-2026-14025/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14025/ UAF in Views /cve/cve-2026-14026/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14026/ LogicError in SplitView /cve/cve-2026-14027/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14027/ UAF in SignI /cve/cve-2026-14028/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14028/ LogicError in Chrome for iOS /cve/cve-2026-14030/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14030/ LogicError in SplitView /cve/cve-2026-14031/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14031/ LogicError in File Input /cve/cve-2026-14032/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14032/ UAF in Bluetooth /cve/cve-2026-14033/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14033/ LogicError in Media /cve/cve-2026-14034/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14034/ LogicError in WebXR /cve/cve-2026-14035/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14035/ LogicError in Bluetooth /cve/cve-2026-14036/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14036/ LogicError in Bluetooth /cve/cve-2026-14037/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14037/ LogicError in GPU /cve/cve-2026-14038/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14038/ LogicError in New Tab Page /cve/cve-2026-14039/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14039/ LogicError in GetUserMedia /cve/cve-2026-14040/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14040/ UAF in BrowserTag /cve/cve-2026-14041/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14041/ LogicError in Serial /cve/cve-2026-14042/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14042/ LogicError in Isolated Web Apps /cve/cve-2026-14043/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14043/ UAF in GetUserMedia /cve/cve-2026-14044/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14044/ UAF in ANGLE /cve/cve-2026-14045/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14045/ LogicError in Network /cve/cve-2026-14046/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14046/ LogicError in CustomTabs /cve/cve-2026-14047/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14047/ LogicError in Extensions /cve/cve-2026-14048/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14048/ UAF in Chromecast /cve/cve-2026-14049/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14049/ LogicError in GPU /cve/cve-2026-14050/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14050/ LogicError in Passwords /cve/cve-2026-14051/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14051/ UninitializedMemory in GamepadAPI /cve/cve-2026-14052/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14052/ LogicError in FileSystem /cve/cve-2026-14053/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14053/ LogicError in Extensions /cve/cve-2026-14054/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14054/ LogicError in Network /cve/cve-2026-14055/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14055/ LogicError in Device Trust /cve/cve-2026-14056/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14056/ LogicError in Media /cve/cve-2026-14057/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14057/ LogicError in FedCM /cve/cve-2026-14058/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14058/ LogicError in Parser /cve/cve-2026-14059/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14059/ LogicError in Related-Website-Sets /cve/cve-2026-14060/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14060/ LogicError in Chromoting /cve/cve-2026-14061/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14061/ LogicError in Daw /cve/cve-2026-14062/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14062/ LogicError in Views /cve/cve-2026-14063/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14063/ OOB in Chromecast /cve/cve-2026-14064/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14064/ UAF in PageInfo /cve/cve-2026-14065/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14065/ LogicError in PageInfo /cve/cve-2026-14066/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14066/ LogicError in Chrome for iOS /cve/cve-2026-14067/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14067/ UAF in Chrome for iOS /cve/cve-2026-14068/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14068/ LogicError in Omnibox /cve/cve-2026-14069/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14069/ IntegerOverflow in WebNN /cve/cve-2026-14070/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14070/ UninitializedMemory in WebNN /cve/cve-2026-14071/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14071/ LogicError in WebAudio /cve/cve-2026-14072/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14072/ LogicError in SplitView /cve/cve-2026-14073/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14073/ LogicError in WebXR /cve/cve-2026-14074/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14074/ LogicError in WebAuthenticatio /cve/cve-2026-14075/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14075/ LogicError in Chrome for iOS /cve/cve-2026-14076/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14076/ LogicError in Network /cve/cve-2026-14077/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14077/ LogicError in Select /cve/cve-2026-14078/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14078/ LogicError in WebRTC /cve/cve-2026-14079/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14079/ LogicError in Network /cve/cve-2026-14080/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14080/ LogicError in TabSwitcher /cve/cve-2026-14081/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14081/ LogicError in DevTools /cve/cve-2026-14082/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14082/ Race in Storage /cve/cve-2026-14083/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14083/ LogicError in HTML /cve/cve-2026-14084/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14084/ LogicError in Chromoting /cve/cve-2026-14085/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14085/ LogicError in CSS /cve/cve-2026-14086/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14086/ LogicError in HID /cve/cve-2026-14087/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14087/ LogicError in WebNN /cve/cve-2026-14088/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14088/ UninitializedMemory in Canvas /cve/cve-2026-14089/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14089/ LogicError in PopupBlocker /cve/cve-2026-14090/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14090/ OOB in CameraCapture /cve/cve-2026-14091/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14091/ UAF in DevTools /cve/cve-2026-14092/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14092/ LogicError in Privacy /cve/cve-2026-14093/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14093/ UAF in Cast /cve/cve-2026-14094/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14094/ UAF in Installer /cve/cve-2026-14095/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14095/ LogicError in Browser /cve/cve-2026-14096/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14096/ LogicError in Input /cve/cve-2026-14097/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14097/ LogicError in WebAppInstalls /cve/cve-2026-14098/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14098/ LogicError in CSS /cve/cve-2026-14099/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14099/ UAF in Chrome for iOS /cve/cve-2026-14100/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14100/ LogicError in NetworkCache /cve/cve-2026-14101/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14101/ SandboxEscape in Sandbox /cve/cve-2026-14102/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14102/ UAF in Passwords /cve/cve-2026-14103/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14103/ UAF in SSL /cve/cve-2026-14104/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14104/ LogicError in WebAppInstalls /cve/cve-2026-14105/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14105/ LogicError in Speech /cve/cve-2026-14106/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14106/ LogicError in Text /cve/cve-2026-14107/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14107/ UAF in Scheduling /cve/cve-2026-14108/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14108/ UAF in PDFium /cve/cve-2026-14109/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14109/ LogicError in Mojo /cve/cve-2026-14110/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14110/ LogicError in DarkMode /cve/cve-2026-14111/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14111/ UAF in WebProtect /cve/cve-2026-14112/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14112/ LogicError in Enterprise /cve/cve-2026-14113/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14113/ UAF in Updater /cve/cve-2026-14114/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14114/ LogicError in WebAppInstalls /cve/cve-2026-14115/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14115/ LogicError in Cast /cve/cve-2026-14116/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14116/ LogicError in DevTools /cve/cve-2026-14117/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14117/ LogicError in DevTools /cve/cve-2026-14118/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14118/ LogicError in DevTools /cve/cve-2026-14119/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14119/ TypeConfusion in Bluetooth /cve/cve-2026-14120/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14120/ LogicError in DevTools /cve/cve-2026-14121/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14121/ UAF in Chromoting /cve/cve-2026-14122/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14122/ LogicError in WebAppInstalls /cve/cve-2026-14123/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14123/ LogicError in Chrome for iOS /cve/cve-2026-14124/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14124/ LogicError in CredentialProvider /cve/cve-2026-14125/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14125/ UninitializedMemory in ANGLE /cve/cve-2026-14126/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14126/ LogicError in UI /cve/cve-2026-14127/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14127/ LogicError in Printing /cve/cve-2026-14128/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14128/ LogicError in Chrome for iOS /cve/cve-2026-14129/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14129/ LogicError in PreviewTab /cve/cve-2026-14130/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14130/ LogicError in Omnibox /cve/cve-2026-14131/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14131/ LogicError in WebAppInstalls /cve/cve-2026-14132/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14132/ LogicError in WebXR /cve/cve-2026-14133/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14133/ Race in History Embeddings /cve/cve-2026-14134/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14134/ LogicError in Autofill /cve/cve-2026-14135/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14135/ LogicError in Network /cve/cve-2026-14136/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14136/ LogicError in Chrome for iOS /cve/cve-2026-14137/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14137/ LogicError in Chrome for iOS /cve/cve-2026-14138/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14138/ LogicError in WebAppInstalls /cve/cve-2026-14139/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14139/ LogicError in TabStrip /cve/cve-2026-14140/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14140/ LogicError in Input /cve/cve-2026-14141/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14141/ LogicError in Document Picture-in-Picture /cve/cve-2026-14142/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14142/ LogicError in Extensions /cve/cve-2026-14143/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14143/ LogicError in Passwords /cve/cve-2026-14144/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14144/ LogicError in Views /cve/cve-2026-14145/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14145/ LogicError in CSS /cve/cve-2026-14146/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14146/ LogicError in CSS /cve/cve-2026-14147/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14147/ LogicError in CSS /cve/cve-2026-14148/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14148/ TypeConfusion in CSS /cve/cve-2026-14149/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14149/ UAF in Audio /cve/cve-2026-14150/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14150/ LogicError in Speech /cve/cve-2026-14151/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14151/ LogicError in AI /cve/cve-2026-14152/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14152/ OOB in ANGLE /cve/cve-2026-14153/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14153/ LogicError in Glic /cve/cve-2026-14154/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14154/ LogicError in DevTools /cve/cve-2026-14155/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14155/ LogicError in StorageAccessAPI /cve/cve-2026-14156/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14156/ LogicError in StorageAccessAPI /cve/cve-2026-14241/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14241/ MemoryCorruption in DOM /cve/cve-2026-14381/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14381/ LogicError in WebAppInstalls /cve/cve-2026-14382/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14382/ LogicError in ANGLE /cve/cve-2026-14383/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14383/ LogicError in V8 /cve/cve-2026-14384/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14384/ OOB in ANGLE /cve/cve-2026-14385/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14385/ OOB in ANGLE /cve/cve-2026-14386/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14386/ OOB in ANGLE /cve/cve-2026-14387/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14387/ IntegerOverflow in Skia /cve/cve-2026-14388/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14388/ OOB in ANGLE /cve/cve-2026-14389/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14389/ IntegerOverflow in Skia /cve/cve-2026-14390/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14390/ UAF in ANGLE /cve/cve-2026-14391/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14391/ IntegerOverflow in ANGLE /cve/cve-2026-14392/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14392/ OOB in Tint /cve/cve-2026-14393/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14393/ UAF in V8 /cve/cve-2026-14394/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14394/ UAF in V8 /cve/cve-2026-14395/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14395/ OOB in V8 /cve/cve-2026-14396/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14396/ OOB in ANGLE /cve/cve-2026-14397/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14397/ OOB in ANGLE /cve/cve-2026-14398/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14398/ UAF in ANGLE /cve/cve-2026-14399/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14399/ UninitializedMemory in Daw /cve/cve-2026-14400/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14400/ OOB in ANGLE /cve/cve-2026-14401/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14401/ LogicError in ANGLE /cve/cve-2026-14402/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14402/ UninitializedMemory in ANGLE /cve/cve-2026-14403/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14403/ UAF in V8 /cve/cve-2026-14404/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14404/ LogicError in PDFium /cve/cve-2026-14405/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14405/ UninitializedMemory in V8 /cve/cve-2026-14406/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14406/ OOB in V8 /cve/cve-2026-14407/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14407/ LogicError in V8 /cve/cve-2026-14408/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14408/ UninitializedMemory in Daw /cve/cve-2026-14409/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14409/ LogicError in V8 /cve/cve-2026-14410/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14410/ LogicError in Skia /cve/cve-2026-14411/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14411/ LogicError in ANGLE /cve/cve-2026-14412/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14412/ LogicError in ANGLE /cve/cve-2026-14413/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14413/ UninitializedMemory in ANGLE /cve/cve-2026-14414/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14414/ LogicError in Skia /cve/cve-2026-14415/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14415/ LogicError in V8 /cve/cve-2026-14416/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14416/ OOB in Daw /cve/cve-2026-14417/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14417/ UAF in Daw /cve/cve-2026-14418/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14418/ UninitializedMemory in ANGLE /cve/cve-2026-14419/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14419/ UAF in Skia /cve/cve-2026-14420/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14420/ OOB in Daw /cve/cve-2026-14421/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14421/ UninitializedMemory in Daw /cve/cve-2026-14422/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14422/ OOB in Tint /cve/cve-2026-14423/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14423/ TypeConfusion in Tint /cve/cve-2026-14424/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14424/ UAF in Daw /cve/cve-2026-14425/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14425/ UAF in ANGLE /cve/cve-2026-14426/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14426/ UAF in V8 /cve/cve-2026-14427/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14427/ OOB in Skia /cve/cve-2026-14428/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14428/ LogicError in Daw /cve/cve-2026-14429/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14429/ LogicError in Skia /cve/cve-2026-14430/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14430/ IntegerOverflow in V8 /cve/cve-2026-14431/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14431/ TypeConfusion in V8 /cve/cve-2026-14432/ Tue, 30 Jun 2026 00:00:00 +0000 /cve/cve-2026-14432/ UAF in V8 /cve/cve-2026-28979/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-28979/ OOB in WebKit /cve/cve-2026-39872/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-39872/ Race in WebCore /cve/cve-2026-43663/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43663/ UAF in JSC /cve/cve-2026-43676/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43676/ OOB in WebKit /cve/cve-2026-43699/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43699/ UAF in WebKit /cve/cve-2026-43700/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43700/ CrossOrigin in WebCore /cve/cve-2026-43701/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43701/ Bypass in WebCore /cve/cve-2026-43704/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43704/ UAF in WebKit /cve/cve-2026-43705/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43705/ TypeConfusion in WebCore /cve/cve-2026-43707/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43707/ LogicError in WebKit /cve/cve-2026-43708/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43708/ CrossOrigin in WebKit /cve/cve-2026-43709/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43709/ UAF in WebKit /cve/cve-2026-43712/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43712/ UAF in JSC /cve/cve-2026-43713/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43713/ Bypass in WebCore /cve/cve-2026-43715/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43715/ UAF in WebCore /cve/cve-2026-43716/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43716/ UAF in JSC /cve/cve-2026-43717/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43717/ UAF in WebKit /cve/cve-2026-43718/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43718/ IntegerOverflow in WebKit /cve/cve-2026-43720/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43720/ UAF in WebCore /cve/cve-2026-43721/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43721/ Bypass in WebCore /cve/cve-2026-43725/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43725/ SandboxEscape in WebKit /cve/cve-2026-43726/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43726/ OOB in JSC /cve/cve-2026-43727/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43727/ UAF in WebCore /cve/cve-2026-43731/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43731/ Race in WebKit /cve/cve-2026-43732/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43732/ Bypass in WebKit /cve/cve-2026-43734/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43734/ UAF in WebCore /cve/cve-2026-43735/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43735/ CrossOrigin in WebCore /cve/cve-2026-43740/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43740/ OOB in JSC /cve/cve-2026-43742/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43742/ UAF in WebCore /cve/cve-2026-43745/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43745/ LogicError in JSC /cve/cve-2026-43746/ Mon, 29 Jun 2026 00:00:00 +0000 /cve/cve-2026-43746/ UAF in WebKit /cve/cve-2026-13281/ Thu, 25 Jun 2026 00:00:00 +0000 /cve/cve-2026-13281/ IntegerOverflow in Mojo /cve/cve-2026-13282/ Thu, 25 Jun 2026 00:00:00 +0000 /cve/cve-2026-13282/ UAF in Payments /cve/cve-2026-13283/ Thu, 25 Jun 2026 00:00:00 +0000 /cve/cve-2026-13283/ UAF in AdFilter /cve/cve-2026-13021/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13021/ LogicError in DeviceBoundSessionCredentials /cve/cve-2026-13022/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13022/ LogicError in Autofill /cve/cve-2026-13023/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13023/ UninitializedMemory in GPU /cve/cve-2026-13024/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13024/ LogicError in Navigatio /cve/cve-2026-13025/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13025/ LogicError in DevTools /cve/cve-2026-13026/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13026/ UAF in Digital Credentials /cve/cve-2026-13027/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13027/ UAF in FileSystem /cve/cve-2026-13028/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13028/ UAF in WebGL /cve/cve-2026-13029/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13029/ UAF in Web Authenticatio /cve/cve-2026-13030/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13030/ UninitializedMemory in GPU /cve/cve-2026-13031/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13031/ UAF in Blink /cve/cve-2026-13032/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13032/ UAF in WebGL /cve/cve-2026-13033/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13033/ OOB in Chromium /cve/cve-2026-13034/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13034/ LogicError in Passwords /cve/cve-2026-13035/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13035/ UAF in Bluetooth /cve/cve-2026-13036/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13036/ UAF in Blink /cve/cve-2026-13037/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13037/ UAF in WebView /cve/cve-2026-13038/ Tue, 23 Jun 2026 00:00:00 +0000 /cve/cve-2026-13038/ UAF in Autofill /cve/cve-2026-12289/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12289/ LogicError in Graphics /cve/cve-2026-12290/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12290/ LogicError in DOM /cve/cve-2026-12291/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12291/ UAF in Networking /cve/cve-2026-12292/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12292/ LogicError in DOM /cve/cve-2026-12293/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12293/ UAF in Core /cve/cve-2026-12294/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12294/ SandboxEscape in DOM /cve/cve-2026-12295/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12295/ SandboxEscape in DOM /cve/cve-2026-12296/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12296/ SandboxEscape in Security/NSS /cve/cve-2026-12297/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12297/ SandboxEscape in Networking /cve/cve-2026-12298/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12298/ LogicError in Core /cve/cve-2026-12299/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12299/ LogicError in DOM /cve/cve-2026-12300/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12300/ LogicError in Toolkit /cve/cve-2026-12301/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12301/ LogicError in Networking /cve/cve-2026-12302/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12302/ LogicError in DOM /cve/cve-2026-12303/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12303/ LogicError in Core /cve/cve-2026-12304/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12304/ CrossOrigin in DOM /cve/cve-2026-12305/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12305/ LogicError in Graphics /cve/cve-2026-12306/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12306/ LogicError in DOM /cve/cve-2026-12307/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12307/ LogicError in Core /cve/cve-2026-12308/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12308/ LogicError in DOM /cve/cve-2026-12309/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12309/ LogicError in DOM /cve/cve-2026-12310/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12310/ LogicError in DOM /cve/cve-2026-12311/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12311/ SandboxEscape in Security/NSS /cve/cve-2026-12312/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12312/ LogicError in Networking /cve/cve-2026-12313/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12313/ SandboxEscape in Security/NSS /cve/cve-2026-12314/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12314/ LogicError in Core /cve/cve-2026-12315/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12315/ LogicError in DOM /cve/cve-2026-12316/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12316/ LogicError in DOM /cve/cve-2026-12317/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12317/ LogicError in DOM /cve/cve-2026-12318/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12318/ LogicError in Core /cve/cve-2026-12319/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12319/ LogicError in Core /cve/cve-2026-12320/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12320/ LogicError in Toolkit /cve/cve-2026-12321/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12321/ LogicError in SpiderMonkey /cve/cve-2026-12322/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12322/ LogicError in Widget /cve/cve-2026-12323/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12323/ LogicError in Core /cve/cve-2026-12324/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12324/ LogicError in DOM /cve/cve-2026-12325/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12325/ LogicError in Media /cve/cve-2026-12326/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12326/ MemoryCorruption in Core /cve/cve-2026-12327/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12327/ MemoryCorruption in Widget /cve/cve-2026-12328/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12328/ MemoryCorruption in Graphics /cve/cve-2026-12437/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12437/ UAF in WebShare /cve/cve-2026-12438/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12438/ LogicError in WebView /cve/cve-2026-12439/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12439/ UAF in Digital Credentials /cve/cve-2026-12440/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12440/ UAF in DigitalCredentials /cve/cve-2026-12441/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12441/ UAF in File Input /cve/cve-2026-12442/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12442/ UAF in Passwords /cve/cve-2026-12443/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12443/ UAF in Web Authenticatio /cve/cve-2026-12444/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12444/ OOB in Chromoting /cve/cve-2026-12445/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12445/ UAF in Extensions /cve/cve-2026-12446/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12446/ LogicError in Passwords /cve/cve-2026-12447/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12447/ OOB in WebRTC /cve/cve-2026-12448/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12448/ LogicError in WebView /cve/cve-2026-12449/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12449/ UAF in Chromoting /cve/cve-2026-12450/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12450/ LogicError in Media /cve/cve-2026-12451/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12451/ UAF in DigitalCredentials /cve/cve-2026-12452/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12452/ UAF in Downloads /cve/cve-2026-12453/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12453/ LogicError in Input /cve/cve-2026-12454/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12454/ Race in Safe Browsing /cve/cve-2026-12455/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12455/ UAF in Tab Strip /cve/cve-2026-12456/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12456/ LogicError in Extensions /cve/cve-2026-12457/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12457/ LogicError in Extensions /cve/cve-2026-12458/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12458/ LogicError in Passwords /cve/cve-2026-12459/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12459/ LogicError in Serial /cve/cve-2026-12460/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12460/ LogicError in File System Access /cve/cve-2026-12461/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12461/ OOB in WebRTC /cve/cve-2026-12462/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12462/ UAF in Media /cve/cve-2026-12463/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12463/ LogicError in Views /cve/cve-2026-12464/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12464/ UAF in Browser /cve/cve-2026-12465/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12465/ LogicError in Metrics /cve/cve-2026-12466/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12466/ OOB in WebRTC /cve/cve-2026-12467/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12467/ UAF in Extensions /cve/cve-2026-12468/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12468/ LogicError in Updater /cve/cve-2026-12469/ Tue, 16 Jun 2026 00:00:00 +0000 /cve/cve-2026-12469/ UninitializedMemory in GPU /cve/cve-2026-12007/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12007/ UAF in Chromium /cve/cve-2026-12008/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12008/ UAF in Chromium /cve/cve-2026-12009/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12009/ LogicError in Chromium /cve/cve-2026-12010/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12010/ OOB in Chromium /cve/cve-2026-12011/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12011/ UAF in Chromium /cve/cve-2026-12012/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12012/ UAF in Chromium /cve/cve-2026-12014/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12014/ UAF in Chromium /cve/cve-2026-12015/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12015/ UAF in Chromium /cve/cve-2026-12016/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12016/ LogicError in Chromium /cve/cve-2026-12017/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12017/ LogicError in Chromium /cve/cve-2026-12018/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12018/ LogicError in Chromium /cve/cve-2026-12019/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12019/ OOB in Chromium /cve/cve-2026-12020/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12020/ UAF in Chromium /cve/cve-2026-12022/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12022/ Race in Chromium /cve/cve-2026-12023/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12023/ UAF in Chromium /cve/cve-2026-12024/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12024/ LogicError in Chromium /cve/cve-2026-12025/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12025/ LogicError in Chromium /cve/cve-2026-12026/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12026/ OOB in Chromium /cve/cve-2026-12027/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12027/ LogicError in Chromium /cve/cve-2026-12028/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12028/ UAF in Chromium /cve/cve-2026-12029/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12029/ UAF in Chromium /cve/cve-2026-12030/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12030/ OOB in Chromium /cve/cve-2026-12031/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12031/ LogicError in Chromium /cve/cve-2026-12032/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12032/ LogicError in Chromium /cve/cve-2026-12033/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12033/ OOB in Chromium /cve/cve-2026-12034/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12034/ LogicError in Chromium /cve/cve-2026-12035/ Thu, 11 Jun 2026 00:00:00 +0000 /cve/cve-2026-12035/ UAF in Chromium /cve/cve-2026-11628/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11628/ UAF in Ozone /cve/cve-2026-11629/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11629/ UAF in Ozone /cve/cve-2026-11630/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11630/ UAF in File Input /cve/cve-2026-11631/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11631/ UAF in Aura /cve/cve-2026-11632/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11632/ UAF in TabStrip /cve/cve-2026-11633/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11633/ UAF in Bluetooth /cve/cve-2026-11634/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11634/ UAF in Gamepad /cve/cve-2026-11635/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11635/ UAF in Bluetooth /cve/cve-2026-11636/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11636/ UAF in Autofill /cve/cve-2026-11637/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11637/ UAF in Views /cve/cve-2026-11638/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11638/ UAF in Printing /cve/cve-2026-11639/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11639/ UAF in Compositing /cve/cve-2026-11640/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11640/ IntegerOverflow in Chromium /cve/cve-2026-11641/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11641/ UAF in Bluetooth /cve/cve-2026-11642/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11642/ UAF in Web Apps /cve/cve-2026-11643/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11643/ UAF in Proxy /cve/cve-2026-11644/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11644/ UAF in Views /cve/cve-2026-11645/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11645/ OOB in V8 /cve/cve-2026-11646/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11646/ UAF in ViewTransitions /cve/cve-2026-11647/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11647/ UAF in Printing /cve/cve-2026-11648/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11648/ UAF in FullScree /cve/cve-2026-11649/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11649/ UAF in V8 /cve/cve-2026-11650/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11650/ UAF in V8 /cve/cve-2026-11651/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11651/ UAF in Network /cve/cve-2026-11652/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11652/ UAF in Extensions /cve/cve-2026-11653/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11653/ LogicError in Extensions /cve/cve-2026-11654/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11654/ UAF in CameraCapture /cve/cve-2026-11655/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11655/ IntegerOverflow in Media /cve/cve-2026-11656/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11656/ UAF in ServiceWorker /cve/cve-2026-11657/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11657/ UAF in Payments /cve/cve-2026-11658/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11658/ LogicError in Extensions /cve/cve-2026-11659/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11659/ LogicError in UI /cve/cve-2026-11660/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11660/ LogicError in New Tab Page /cve/cve-2026-11661/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11661/ UAF in Views /cve/cve-2026-11662/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11662/ TypeConfusion in Bindings /cve/cve-2026-11663/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11663/ UAF in Skia /cve/cve-2026-11664/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11664/ UAF in Payments /cve/cve-2026-11665/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11665/ OOB in Daw /cve/cve-2026-11666/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11666/ LogicError in Input /cve/cve-2026-11667/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11667/ OOB in WebRTC /cve/cve-2026-11668/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11668/ UninitializedMemory in Codecs /cve/cve-2026-11669/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11669/ IntegerOverflow in Media /cve/cve-2026-11670/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11670/ UAF in PDF /cve/cve-2026-11671/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11671/ UAF in Navigatio /cve/cve-2026-11672/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11672/ OOB in GPU /cve/cve-2026-11673/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11673/ UAF in InterestGroups /cve/cve-2026-11674/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11674/ UAF in Guest View /cve/cve-2026-11675/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11675/ LogicError in Skia /cve/cve-2026-11676/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11676/ LogicError in Daw /cve/cve-2026-11677/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11677/ Race in Network /cve/cve-2026-11678/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11678/ IntegerOverflow in Chromium /cve/cve-2026-11679/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11679/ UAF in Codecs /cve/cve-2026-11680/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11680/ UAF in Media /cve/cve-2026-11681/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11681/ UAF in Ozone /cve/cve-2026-11682/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11682/ LogicError in Views /cve/cve-2026-11683/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11683/ UAF in WebCodecs /cve/cve-2026-11684/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11684/ LogicError in Network /cve/cve-2026-11685/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11685/ LogicError in MediaCapture /cve/cve-2026-11686/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11686/ LogicError in Daw /cve/cve-2026-11687/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11687/ UAF in Daw /cve/cve-2026-11688/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11688/ LogicError in SVG /cve/cve-2026-11689/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11689/ LogicError in Passwords /cve/cve-2026-11690/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11690/ OOB in Media /cve/cve-2026-11691/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11691/ LogicError in New Tab Page /cve/cve-2026-11692/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11692/ UAF in Read Anything /cve/cve-2026-11693/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11693/ LogicError in Plugins /cve/cve-2026-11694/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11694/ UAF in ServiceWorker /cve/cve-2026-11695/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11695/ LogicError in Passwords /cve/cve-2026-11696/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11696/ UninitializedMemory in Video /cve/cve-2026-11697/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11697/ LogicError in UI /cve/cve-2026-11698/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11698/ UAF in Bluetooth /cve/cve-2026-11699/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11699/ UAF in Bluetooth /cve/cve-2026-11700/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11700/ UAF in Tracing /cve/cve-2026-11701/ Mon, 08 Jun 2026 00:00:00 +0000 /cve/cve-2026-11701/ LogicError in Guest View /cve/cve-2026-10701/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10701/ LogicError in Core /cve/cve-2026-10702/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10702/ LogicError in SpiderMonkey /cve/cve-2026-10881/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10881/ OOB in ANGLE /cve/cve-2026-10882/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10882/ UAF in Network /cve/cve-2026-10883/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10883/ OOB in ANGLE /cve/cve-2026-10884/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10884/ UAF in Chromecast /cve/cve-2026-10885/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10885/ UAF in Chrome for iOS /cve/cve-2026-10886/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10886/ UAF in FileSystem /cve/cve-2026-10887/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10887/ UAF in Chromoting /cve/cve-2026-10888/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10888/ UAF in Cast Streaming /cve/cve-2026-10889/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10889/ OOB in ANGLE /cve/cve-2026-10890/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10890/ UAF in Cast /cve/cve-2026-10891/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10891/ UAF in GFX /cve/cve-2026-10892/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10892/ OOB in GPU /cve/cve-2026-10893/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10893/ UAF in Chromoting /cve/cve-2026-10894/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10894/ UAF in Printing /cve/cve-2026-10895/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10895/ UAF in Ozone /cve/cve-2026-10896/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10896/ UAF in Chrome for iOS /cve/cve-2026-10897/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10897/ OOB in GPU /cve/cve-2026-10898/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10898/ OOB in GPU /cve/cve-2026-10899/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10899/ UAF in Ozone /cve/cve-2026-10900/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10900/ UAF in Passwords /cve/cve-2026-10901/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10901/ UAF in Passwords /cve/cve-2026-10902/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10902/ UAF in Ozone /cve/cve-2026-10903/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10903/ UAF in WebRTC /cve/cve-2026-10904/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10904/ LogicError in V8 /cve/cve-2026-10905/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10905/ UAF in Network /cve/cve-2026-10906/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10906/ UAF in WebAuthenticatio /cve/cve-2026-10907/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10907/ OOB in ANGLE /cve/cve-2026-10908/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10908/ UAF in FullScree /cve/cve-2026-10909/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10909/ UAF in Daw /cve/cve-2026-10910/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10910/ TypeConfusion in V8 /cve/cve-2026-10911/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10911/ LogicError in Media /cve/cve-2026-10912/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10912/ LogicError in Extensions /cve/cve-2026-10913/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10913/ UAF in ANGLE /cve/cve-2026-10914/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10914/ UAF in ANGLE /cve/cve-2026-10915/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10915/ UAF in Core /cve/cve-2026-10916/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10916/ LogicError in DevTools /cve/cve-2026-10917/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10917/ LogicError in Media /cve/cve-2026-10918/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10918/ UAF in Viz /cve/cve-2026-10919/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10919/ UAF in ANGLE /cve/cve-2026-10920/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10920/ LogicError in WebShare /cve/cve-2026-10921/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10921/ IntegerOverflow in Daw /cve/cve-2026-10922/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10922/ LogicError in DevTools /cve/cve-2026-10923/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10923/ UAF in WebAppInstalls /cve/cve-2026-10924/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10924/ IntegerOverflow in Chromecast /cve/cve-2026-10925/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10925/ OOB in Skia /cve/cve-2026-10926/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10926/ UAF in Cast /cve/cve-2026-10927/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10927/ OOB in Daw /cve/cve-2026-10928/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10928/ LogicError in Headless /cve/cve-2026-10929/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10929/ OOB in ANGLE /cve/cve-2026-10930/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10930/ OOB in ANGLE /cve/cve-2026-10931/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10931/ UAF in FileSystem /cve/cve-2026-10932/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10932/ UAF in UI /cve/cve-2026-10933/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10933/ UAF in Audio /cve/cve-2026-10934/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10934/ UAF in Autofill /cve/cve-2026-10935/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10935/ LogicError in V8 /cve/cve-2026-10936/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10936/ TypeConfusion in V8 /cve/cve-2026-10937/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10937/ LogicError in Passwords /cve/cve-2026-10938/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10938/ LogicError in Input /cve/cve-2026-10939/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10939/ UAF in WebRTC /cve/cve-2026-10940/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10940/ Race in Codecs /cve/cve-2026-10941/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10941/ OOB in Skia /cve/cve-2026-10942/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10942/ LogicError in UI /cve/cve-2026-10943/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10943/ UAF in WebRTC /cve/cve-2026-10944/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10944/ LogicError in Autofill /cve/cve-2026-10945/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10945/ UAF in PDF /cve/cve-2026-10946/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10946/ OOB in Media /cve/cve-2026-10947/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10947/ UAF in WebRTC /cve/cve-2026-10948/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10948/ UAF in WebRTC /cve/cve-2026-10949/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10949/ OOB in Video /cve/cve-2026-10950/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10950/ LogicError in Autofill /cve/cve-2026-10951/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10951/ UAF in Autofill /cve/cve-2026-10952/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10952/ UAF in Chrome for iOS /cve/cve-2026-10953/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10953/ UAF in Core /cve/cve-2026-10954/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10954/ UAF in Actor /cve/cve-2026-10955/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10955/ TypeConfusion in ANGLE /cve/cve-2026-10956/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10956/ UAF in MimeHandlerView /cve/cve-2026-10957/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10957/ UAF in Glic /cve/cve-2026-10958/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10958/ UAF in Chrome for iOS /cve/cve-2026-10959/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10959/ UAF in Input /cve/cve-2026-10960/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10960/ UninitializedMemory in Codecs /cve/cve-2026-10961/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10961/ UAF in Chrome for iOS /cve/cve-2026-10962/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10962/ TypeConfusion in Media /cve/cve-2026-10963/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10963/ IntegerOverflow in V8 /cve/cve-2026-10964/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10964/ IntegerOverflow in V8 /cve/cve-2026-10965/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10965/ IntegerOverflow in DevTools /cve/cve-2026-10966/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10966/ LogicError in Codecs /cve/cve-2026-10967/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10967/ UAF in SurfaceCapture /cve/cve-2026-10968/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10968/ LogicError in Daw /cve/cve-2026-10969/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10969/ LogicError in Extensions /cve/cve-2026-10970/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10970/ LogicError in InterestGroups /cve/cve-2026-10971/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10971/ LogicError in Printing /cve/cve-2026-10972/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10972/ UAF in Ozone /cve/cve-2026-10973/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10973/ UninitializedMemory in Daw /cve/cve-2026-10974/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10974/ LogicError in ANGLE /cve/cve-2026-10975/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10975/ UAF in WebRTC /cve/cve-2026-10976/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10976/ UninitializedMemory in Daw /cve/cve-2026-10977/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10977/ UninitializedMemory in Skia /cve/cve-2026-10978/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10978/ UAF in Chromoting /cve/cve-2026-10979/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10979/ OOB in ANGLE /cve/cve-2026-10980/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10980/ LogicError in DevTools /cve/cve-2026-10981/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10981/ LogicError in Codecs /cve/cve-2026-10982/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10982/ UAF in WebXR /cve/cve-2026-10983/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10983/ LogicError in Daw /cve/cve-2026-10984/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10984/ LogicError in Accessibility /cve/cve-2026-10985/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10985/ OOB in Skia /cve/cve-2026-10986/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10986/ IntegerOverflow in Media /cve/cve-2026-10987/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10987/ IntegerOverflow in V8 /cve/cve-2026-10988/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10988/ UAF in Views /cve/cve-2026-10989/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10989/ LogicError in V8 /cve/cve-2026-10990/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10990/ UAF in Glic /cve/cve-2026-10991/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10991/ UAF in V8 /cve/cve-2026-10992/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10992/ LogicError in Animatio /cve/cve-2026-10993/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10993/ OOB in Skia /cve/cve-2026-10994/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10994/ UninitializedMemory in ANGLE /cve/cve-2026-10995/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10995/ OOB in TabStrip /cve/cve-2026-10996/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10996/ LogicError in Workers /cve/cve-2026-10997/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10997/ LogicError in Extensions /cve/cve-2026-10998/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10998/ OOB in Media /cve/cve-2026-10999/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-10999/ OOB in ANGLE /cve/cve-2026-11000/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11000/ UAF in Fonts /cve/cve-2026-11001/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11001/ LogicError in Payments /cve/cve-2026-11002/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11002/ UAF in Autofill /cve/cve-2026-11003/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11003/ UAF in WebRTC /cve/cve-2026-11004/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11004/ OOB in ANGLE /cve/cve-2026-11005/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11005/ OOB in ANGLE /cve/cve-2026-11006/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11006/ OOB in Daw /cve/cve-2026-11007/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11007/ LogicError in WebView /cve/cve-2026-11008/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11008/ LogicError in WebAppInstalls /cve/cve-2026-11009/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11009/ UAF in USB /cve/cve-2026-11010/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11010/ UAF in WebShare /cve/cve-2026-11011/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11011/ LogicError in Password Manager /cve/cve-2026-11012/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11012/ UAF in Serial /cve/cve-2026-11013/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11013/ LogicError in Network /cve/cve-2026-11014/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11014/ LogicError in Extensions /cve/cve-2026-11015/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11015/ OOB in WebGPU /cve/cve-2026-11016/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11016/ LogicError in Network /cve/cve-2026-11017/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11017/ LogicError in Link Preview /cve/cve-2026-11018/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11018/ LogicError in Actor /cve/cve-2026-11019/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11019/ LogicError in Payments /cve/cve-2026-11020/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11020/ LogicError in Extensions /cve/cve-2026-11021/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11021/ LogicError in GPU /cve/cve-2026-11022/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11022/ LogicError in DevTools /cve/cve-2026-11023/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11023/ LogicError in WebAppInstalls /cve/cve-2026-11024/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11024/ OOB in Skia /cve/cve-2026-11025/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11025/ LogicError in Navigatio /cve/cve-2026-11026/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11026/ LogicError in Extensions /cve/cve-2026-11027/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11027/ LogicError in Glic /cve/cve-2026-11028/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11028/ UAF in Media /cve/cve-2026-11029/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11029/ LogicError in Drag and Drop /cve/cve-2026-11030/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11030/ UAF in Network /cve/cve-2026-11031/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11031/ LogicError in Password Manager /cve/cve-2026-11032/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11032/ LogicError in Password Manager /cve/cve-2026-11033/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11033/ UninitializedMemory in WebML /cve/cve-2026-11034/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11034/ LogicError in Tab Group Sync /cve/cve-2026-11035/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11035/ LogicError in Custom Tabs /cve/cve-2026-11036/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11036/ LogicError in DOM /cve/cve-2026-11037/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11037/ OOB in Codecs /cve/cve-2026-11038/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11038/ LogicError in Subresource Integrity /cve/cve-2026-11039/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11039/ UninitializedMemory in Skia /cve/cve-2026-11040/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11040/ UAF in ANGLE /cve/cve-2026-11041/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11041/ LogicError in Media /cve/cve-2026-11042/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11042/ UAF in Views /cve/cve-2026-11043/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11043/ OOB in ANGLE /cve/cve-2026-11044/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11044/ IntegerOverflow in ANGLE /cve/cve-2026-11045/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11045/ LogicError in GPU /cve/cve-2026-11046/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11046/ LogicError in Media /cve/cve-2026-11047/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11047/ LogicError in Base /cve/cve-2026-11048/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11048/ LogicError in Extensions /cve/cve-2026-11049/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11049/ UAF in Password Manager /cve/cve-2026-11050/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11050/ UAF in V8 /cve/cve-2026-11051/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11051/ OOB in ANGLE /cve/cve-2026-11052/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11052/ TypeConfusion in GPU /cve/cve-2026-11053/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11053/ LogicError in WebRTC /cve/cve-2026-11054/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11054/ UAF in WebRTC /cve/cve-2026-11055/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11055/ UAF in ANGLE /cve/cve-2026-11056/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11056/ LogicError in SiteIsolatio /cve/cve-2026-11057/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11057/ UninitializedMemory in Skia /cve/cve-2026-11058/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11058/ IntegerOverflow in CredentialProvider /cve/cve-2026-11059/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11059/ UAF in Blink /cve/cve-2026-11060/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11060/ UAF in Media /cve/cve-2026-11061/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11061/ OOB in ANGLE /cve/cve-2026-11062/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11062/ LogicError in Extensions /cve/cve-2026-11063/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11063/ LogicError in WebNN /cve/cve-2026-11064/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11064/ UninitializedMemory in GPU /cve/cve-2026-11065/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11065/ UAF in ANGLE /cve/cve-2026-11066/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11066/ LogicError in ANGLE /cve/cve-2026-11067/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11067/ UninitializedMemory in Daw /cve/cve-2026-11068/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11068/ UAF in WebSockets /cve/cve-2026-11069/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11069/ LogicError in Cast /cve/cve-2026-11070/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11070/ LogicError in Chromoting /cve/cve-2026-11071/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11071/ UAF in Base /cve/cve-2026-11072/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11072/ UAF in WebView /cve/cve-2026-11073/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11073/ UAF in WebGL /cve/cve-2026-11074/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11074/ UAF in WebRTC /cve/cve-2026-11075/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11075/ OOB in V8 /cve/cve-2026-11076/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11076/ TypeConfusion in CSS /cve/cve-2026-11077/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11077/ OOB in Daw /cve/cve-2026-11078/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11078/ LogicError in FileSystem /cve/cve-2026-11079/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11079/ LogicError in Codecs /cve/cve-2026-11080/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11080/ UAF in WebView /cve/cve-2026-11081/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11081/ LogicError in Canvas /cve/cve-2026-11082/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11082/ UAF in GPU /cve/cve-2026-11083/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11083/ LogicError in Password Manager /cve/cve-2026-11084/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11084/ LogicError in Password Manager /cve/cve-2026-11085/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11085/ IntegerOverflow in GPU /cve/cve-2026-11086/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11086/ LogicError in Daw /cve/cve-2026-11087/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11087/ UninitializedMemory in ANGLE /cve/cve-2026-11088/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11088/ IntegerOverflow in ANGLE /cve/cve-2026-11089/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11089/ UninitializedMemory in Media /cve/cve-2026-11090/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11090/ UninitializedMemory in ANGLE /cve/cve-2026-11091/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11091/ LogicError in Daw /cve/cve-2026-11092/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11092/ LogicError in DevTools /cve/cve-2026-11093/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11093/ LogicError in Printing /cve/cve-2026-11094/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11094/ UAF in Codecs /cve/cve-2026-11095/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11095/ LogicError in Codecs /cve/cve-2026-11096/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11096/ OOB in WebRTC /cve/cve-2026-11097/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11097/ LogicError in WebView /cve/cve-2026-11098/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11098/ LogicError in GPU /cve/cve-2026-11099/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11099/ LogicError in Skia /cve/cve-2026-11100/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11100/ UAF in File Input /cve/cve-2026-11101/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11101/ UninitializedMemory in Daw /cve/cve-2026-11102/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11102/ LogicError in Isolated Web Apps /cve/cve-2026-11103/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11103/ LogicError in Installer /cve/cve-2026-11104/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11104/ UninitializedMemory in ANGLE /cve/cve-2026-11105/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11105/ LogicError in WebUI /cve/cve-2026-11106/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11106/ LogicError in Media /cve/cve-2026-11107/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11107/ LogicError in Downloads /cve/cve-2026-11108/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11108/ LogicError in NFC /cve/cve-2026-11109/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11109/ UninitializedMemory in ANGLE /cve/cve-2026-11110/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11110/ UninitializedMemory in ANGLE /cve/cve-2026-11111/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11111/ OOB in ANGLE /cve/cve-2026-11112/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11112/ LogicError in Chromoting /cve/cve-2026-11113/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11113/ LogicError in ANGLE /cve/cve-2026-11114/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11114/ UAF in Device Trust /cve/cve-2026-11115/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11115/ UAF in Updater /cve/cve-2026-11116/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11116/ UAF in Chromoting /cve/cve-2026-11117/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11117/ UAF in Views /cve/cve-2026-11118/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11118/ UAF in WebRTC /cve/cve-2026-11119/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11119/ LogicError in GPU /cve/cve-2026-11120/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11120/ LogicError in Enterprise Reporting /cve/cve-2026-11121/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11121/ LogicError in Skia /cve/cve-2026-11122/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11122/ LogicError in Keyboard /cve/cve-2026-11123/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11123/ UninitializedMemory in ANGLE /cve/cve-2026-11124/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11124/ OOB in Skia /cve/cve-2026-11125/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11125/ UAF in Compositing /cve/cve-2026-11126/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11126/ LogicError in DevTools /cve/cve-2026-11127/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11127/ LogicError in WebAPKs /cve/cve-2026-11128/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11128/ LogicError in Web Share /cve/cve-2026-11129/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11129/ LogicError in Extensions /cve/cve-2026-11130/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11130/ UAF in Media /cve/cve-2026-11131/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11131/ UAF in Autofill /cve/cve-2026-11132/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11132/ LogicError in Paint /cve/cve-2026-11133/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11133/ LogicError in Paint /cve/cve-2026-11134/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11134/ LogicError in Media /cve/cve-2026-11135/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11135/ LogicError in Autofill /cve/cve-2026-11136/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11136/ UAF in Canvas /cve/cve-2026-11137/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11137/ UninitializedMemory in ANGLE /cve/cve-2026-11138/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11138/ UninitializedMemory in ANGLE /cve/cve-2026-11139/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11139/ LogicError in Paint /cve/cve-2026-11140/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11140/ LogicError in Chromecast /cve/cve-2026-11141/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11141/ UninitializedMemory in Audio /cve/cve-2026-11142/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11142/ LogicError in Paint /cve/cve-2026-11143/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11143/ OOB in Extensions /cve/cve-2026-11144/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11144/ UAF in Media /cve/cve-2026-11145/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11145/ Race in Geolocatio /cve/cve-2026-11146/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11146/ LogicError in Chromoting /cve/cve-2026-11147/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11147/ UAF in WebML /cve/cve-2026-11148/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11148/ LogicError in Payments /cve/cve-2026-11149/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11149/ LogicError in Extensions /cve/cve-2026-11150/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11150/ LogicError in XML /cve/cve-2026-11151/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11151/ LogicError in Password Manager /cve/cve-2026-11152/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11152/ LogicError in Daw /cve/cve-2026-11153/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11153/ LogicError in Forms /cve/cve-2026-11154/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11154/ UAF in Daw /cve/cve-2026-11155/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11155/ LogicError in CSS /cve/cve-2026-11156/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11156/ LogicError in CSS /cve/cve-2026-11157/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11157/ LogicError in Accessibility /cve/cve-2026-11158/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11158/ LogicError in Downloads /cve/cve-2026-11159/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11159/ UninitializedMemory in Skia /cve/cve-2026-11160/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11160/ OOB in Input /cve/cve-2026-11161/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11161/ LogicError in DataTransfer /cve/cve-2026-11162/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11162/ LogicError in CSS /cve/cve-2026-11163/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11163/ UAF in Messages /cve/cve-2026-11164/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11164/ UAF in Blink /cve/cve-2026-11165/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11165/ UAF in WebMIDI /cve/cve-2026-11166/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11166/ LogicError in SVG /cve/cve-2026-11167/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11167/ LogicError in WebView /cve/cve-2026-11168/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11168/ LogicError in Extensions /cve/cve-2026-11169/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11169/ LogicError in XML /cve/cve-2026-11170/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11170/ LogicError in Chromoting /cve/cve-2026-11171/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11171/ IntegerOverflow in Blink /cve/cve-2026-11172/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11172/ LogicError in Contact Picker /cve/cve-2026-11173/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11173/ OOB in V8 /cve/cve-2026-11174/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11174/ LogicError in Site Isolatio /cve/cve-2026-11175/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11175/ LogicError in Messages /cve/cve-2026-11176/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11176/ LogicError in Media /cve/cve-2026-11177/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11177/ UAF in Omnibox /cve/cve-2026-11178/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11178/ LogicError in WebView /cve/cve-2026-11179/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11179/ LogicError in ORB /cve/cve-2026-11180/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11180/ LogicError in SVG /cve/cve-2026-11181/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11181/ LogicError in Media Sessio /cve/cve-2026-11182/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11182/ LogicError in SVG /cve/cve-2026-11183/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11183/ OOB in GWP-ASa /cve/cve-2026-11184/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11184/ LogicError in Actor /cve/cve-2026-11185/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11185/ UAF in V8 /cve/cve-2026-11186/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11186/ LogicError in CSS /cve/cve-2026-11187/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11187/ LogicError in Glic /cve/cve-2026-11188/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11188/ UAF in USB /cve/cve-2026-11189/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11189/ LogicError in DevTools /cve/cve-2026-11190/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11190/ LogicError in Extensions /cve/cve-2026-11191/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11191/ OOB in ANGLE /cve/cve-2026-11192/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11192/ LogicError in Password Manager /cve/cve-2026-11193/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11193/ LogicError in Password Manager /cve/cve-2026-11194/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11194/ LogicError in Network /cve/cve-2026-11195/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11195/ LogicError in MHTML /cve/cve-2026-11196/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11196/ TypeConfusion in XML /cve/cve-2026-11197/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11197/ LogicError in Workers /cve/cve-2026-11198/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11198/ LogicError in Codecs /cve/cve-2026-11199/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11199/ LogicError in WebRTC /cve/cve-2026-11200/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11200/ LogicError in WebRTC /cve/cve-2026-11201/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11201/ UAF in ServiceWorker /cve/cve-2026-11202/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11202/ LogicError in Chrome for iOS /cve/cve-2026-11203/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11203/ LogicError in GPU /cve/cve-2026-11204/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11204/ LogicError in Sig /cve/cve-2026-11205/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11205/ LogicError in Chrome for iOS /cve/cve-2026-11206/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11206/ LogicError in ServiceWorker /cve/cve-2026-11207/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11207/ LogicError in Autofill /cve/cve-2026-11208/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11208/ UAF in Codecs /cve/cve-2026-11209/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11209/ LogicError in Passwords /cve/cve-2026-11210/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11210/ LogicError in Safe Browsing /cve/cve-2026-11211/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11211/ IntegerOverflow in V8 /cve/cve-2026-11212/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11212/ LogicError in DevTools /cve/cve-2026-11213/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11213/ LogicError in Reading Mode /cve/cve-2026-11214/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11214/ LogicError in Chrome for iOS /cve/cve-2026-11215/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11215/ LogicError in Cronet /cve/cve-2026-11216/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11216/ LogicError in File Input /cve/cve-2026-11217/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11217/ LogicError in Fenced Frames /cve/cve-2026-11218/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11218/ LogicError in PlatformIntegratio /cve/cve-2026-11219/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11219/ LogicError in Navigatio /cve/cve-2026-11220/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11220/ LogicError in Navigatio /cve/cve-2026-11221/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11221/ LogicError in PointerLock /cve/cve-2026-11222/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11222/ LogicError in Tab Strip /cve/cve-2026-11223/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11223/ LogicError in Network /cve/cve-2026-11224/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11224/ UAF in Chromoting /cve/cve-2026-11225/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11225/ LogicError in WebUI /cve/cve-2026-11226/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11226/ LogicError in PreviewTab /cve/cve-2026-11227/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11227/ LogicError in Tab Hover Cards /cve/cve-2026-11228/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11228/ LogicError in File Input /cve/cve-2026-11229/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11229/ LogicError in Enterprise /cve/cve-2026-11230/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11230/ UAF in Extensions /cve/cve-2026-11231/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11231/ LogicError in Safe Browsing /cve/cve-2026-11232/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11232/ LogicError in TabGroups /cve/cve-2026-11233/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11233/ LogicError in FoldableAPIs /cve/cve-2026-11234/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11234/ LogicError in FoldableAPIs /cve/cve-2026-11235/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11235/ LogicError in Compositing /cve/cve-2026-11236/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11236/ LogicError in Web Bluetooth /cve/cve-2026-11237/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11237/ LogicError in Media /cve/cve-2026-11238/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11238/ LogicError in DevTools /cve/cve-2026-11239/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11239/ LogicError in Extensions /cve/cve-2026-11240/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11240/ LogicError in Loader /cve/cve-2026-11241/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11241/ LogicError in Cast /cve/cve-2026-11242/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11242/ LogicError in Plugins /cve/cve-2026-11243/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11243/ LogicError in Downloads /cve/cve-2026-11244/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11244/ LogicError in WebAuthenticatio /cve/cve-2026-11245/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11245/ LogicError in Payments /cve/cve-2026-11246/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11246/ LogicError in IndexedDB /cve/cve-2026-11247/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11247/ LogicError in CustomTabs /cve/cve-2026-11248/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11248/ LogicError in Google Lens /cve/cve-2026-11249/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11249/ UAF in Network /cve/cve-2026-11250/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11250/ LogicError in DevTools /cve/cve-2026-11251/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11251/ LogicError in Password Manager /cve/cve-2026-11252/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11252/ LogicError in Content Settings /cve/cve-2026-11253/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11253/ Race in Permissions /cve/cve-2026-11254/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11254/ LogicError in Permissions /cve/cve-2026-11255/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11255/ LogicError in Storage Access API /cve/cve-2026-11256/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11256/ OOB in GPU /cve/cve-2026-11257/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11257/ LogicError in Browser /cve/cve-2026-11258/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11258/ LogicError in File System Access /cve/cve-2026-11259/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11259/ LogicError in Cast /cve/cve-2026-11260/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11260/ LogicError in Permissions /cve/cve-2026-11261/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11261/ LogicError in PDF /cve/cve-2026-11262/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11262/ UAF in TabStrip /cve/cve-2026-11263/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11263/ LogicError in WebAuthenticatio /cve/cve-2026-11264/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11264/ LogicError in Content Security Policy /cve/cve-2026-11265/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11265/ LogicError in Autofill /cve/cve-2026-11266/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11266/ LogicError in SafeBrowsing /cve/cve-2026-11267/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11267/ LogicError in Extensions /cve/cve-2026-11268/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11268/ UninitializedMemory in ANGLE /cve/cve-2026-11269/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11269/ LogicError in Extensions /cve/cve-2026-11270/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11270/ LogicError in UI /cve/cve-2026-11271/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11271/ LogicError in Passwords /cve/cve-2026-11272/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11272/ LogicError in Reading List /cve/cve-2026-11273/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11273/ LogicError in Omnibox /cve/cve-2026-11274/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11274/ LogicError in DOM Distiller /cve/cve-2026-11275/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11275/ LogicError in Page Info /cve/cve-2026-11276/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11276/ LogicError in Cast /cve/cve-2026-11277/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11277/ LogicError in Chrome for iOS /cve/cve-2026-11278/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11278/ LogicError in CustomTabs /cve/cve-2026-11279/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11279/ OOB in DevTools /cve/cve-2026-11280/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11280/ LogicError in Sig /cve/cve-2026-11281/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11281/ IntegerOverflow in Chromoting /cve/cve-2026-11282/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11282/ SandboxEscape in Sandbox /cve/cve-2026-11283/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11283/ LogicError in Shortcuts /cve/cve-2026-11284/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11284/ LogicError in PerformanceAPIs /cve/cve-2026-11285/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11285/ LogicError in Chrome for iOS /cve/cve-2026-11286/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11286/ LogicError in Wallet /cve/cve-2026-11287/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11287/ LogicError in Navigatio /cve/cve-2026-11288/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11288/ LogicError in CSS /cve/cve-2026-11289/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11289/ LogicError in Paint /cve/cve-2026-11290/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11290/ IntegerOverflow in WebView /cve/cve-2026-11291/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11291/ LogicError in Android Autofill /cve/cve-2026-11292/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11292/ LogicError in Blink /cve/cve-2026-11293/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11293/ UAF in Input /cve/cve-2026-11294/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11294/ LogicError in Passwords /cve/cve-2026-11295/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11295/ LogicError in WebView /cve/cve-2026-11296/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11296/ LogicError in ImageCapture /cve/cve-2026-11297/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11297/ LogicError in Reader Mode /cve/cve-2026-11298/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11298/ LogicError in Chrome for iOS /cve/cve-2026-11299/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11299/ OOB in Fonts /cve/cve-2026-11300/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11300/ LogicError in Permissions /cve/cve-2026-11301/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11301/ OOB in LiveCaptio /cve/cve-2026-11302/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11302/ LogicError in Chrome for iOS /cve/cve-2026-11303/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11303/ UAF in PDFium /cve/cve-2026-11304/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11304/ UAF in PDFium /cve/cve-2026-11305/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11305/ UAF in PDFium /cve/cve-2026-11306/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11306/ UAF in PDFium /cve/cve-2026-11307/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11307/ UAF in PDFium /cve/cve-2026-11308/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11308/ LogicError in Extensions /cve/cve-2026-11309/ Tue, 02 Jun 2026 00:00:00 +0000 /cve/cve-2026-11309/ LogicError in History /cve/cve-2026-10000/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10000/ UAF in Passwords /cve/cve-2026-10001/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10001/ UAF in PerformanceManager /cve/cve-2026-10002/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10002/ UAF in PDFium /cve/cve-2026-10003/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10003/ UAF in Views /cve/cve-2026-10004/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10004/ LogicError in Passwords /cve/cve-2026-10005/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10005/ UAF in WebAppInstalls /cve/cve-2026-10006/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10006/ Race in WebAudio /cve/cve-2026-10007/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10007/ UAF in SVG /cve/cve-2026-10008/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10008/ UninitializedMemory in GPU /cve/cve-2026-10009/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10009/ IntegerOverflow in Skia /cve/cve-2026-10010/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10010/ LogicError in Input /cve/cve-2026-10011/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10011/ LogicError in Skia /cve/cve-2026-10012/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10012/ UAF in Skia /cve/cve-2026-10013/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10013/ UAF in WebCodecs /cve/cve-2026-10014/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10014/ UAF in WebMIDI /cve/cve-2026-10015/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10015/ IntegerOverflow in WTF /cve/cve-2026-10016/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10016/ UAF in DOM /cve/cve-2026-10017/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10017/ OOB in Headless /cve/cve-2026-10018/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10018/ IntegerOverflow in ANGLE /cve/cve-2026-10019/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10019/ IntegerOverflow in ANGLE /cve/cve-2026-10020/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10020/ LogicError in Skia /cve/cve-2026-10021/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10021/ LogicError in USB /cve/cve-2026-10022/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-10022/ TypeConfusion in V8 /cve/cve-2026-9872/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9872/ OOB in GPU /cve/cve-2026-9873/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9873/ UAF in Network /cve/cve-2026-9874/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9874/ UAF in Daw /cve/cve-2026-9875/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9875/ OOB in WebGL /cve/cve-2026-9876/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9876/ UAF in WebGL /cve/cve-2026-9877/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9877/ UAF in ANGLE /cve/cve-2026-9878/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9878/ UAF in ANGLE /cve/cve-2026-9879/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9879/ OOB in ANGLE /cve/cve-2026-9880/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9880/ LogicError in WebGL /cve/cve-2026-9881/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9881/ UAF in Bluetooth /cve/cve-2026-9882/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9882/ IntegerOverflow in ANGLE /cve/cve-2026-9883/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9883/ UAF in Base /cve/cve-2026-9884/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9884/ UAF in Browser /cve/cve-2026-9885/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9885/ LogicError in UI /cve/cve-2026-9886/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9886/ UAF in Base /cve/cve-2026-9887/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9887/ UAF in Proxy /cve/cve-2026-9888/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9888/ UAF in WebView /cve/cve-2026-9889/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9889/ OOB in Daw /cve/cve-2026-9890/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9890/ UAF in XR /cve/cve-2026-9891/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9891/ UAF in Extensions /cve/cve-2026-9892/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9892/ LogicError in Skia /cve/cve-2026-9893/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9893/ UAF in Skia /cve/cve-2026-9894/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9894/ UAF in GPU /cve/cve-2026-9895/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9895/ OOB in GPU /cve/cve-2026-9896/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9896/ OOB in V8 /cve/cve-2026-9897/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9897/ UAF in DOM /cve/cve-2026-9898/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9898/ LogicError in GPU /cve/cve-2026-9899/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9899/ UAF in ANGLE /cve/cve-2026-9900/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9900/ OOB in ANGLE /cve/cve-2026-9901/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9901/ UAF in ANGLE /cve/cve-2026-9902/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9902/ UAF in Accessibility /cve/cve-2026-9903/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9903/ LogicError in Site Isolatio /cve/cve-2026-9904/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9904/ UAF in ANGLE /cve/cve-2026-9905/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9905/ UAF in Accessibility /cve/cve-2026-9906/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9906/ OOB in GPU /cve/cve-2026-9907/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9907/ OOB in Daw /cve/cve-2026-9908/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9908/ OOB in ANGLE /cve/cve-2026-9909/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9909/ IntegerOverflow in Skia /cve/cve-2026-9910/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9910/ OOB in ANGLE /cve/cve-2026-9911/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9911/ IntegerOverflow in ANGLE /cve/cve-2026-9912/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9912/ LogicError in GPU /cve/cve-2026-9913/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9913/ LogicError in ANGLE /cve/cve-2026-9914/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9914/ LogicError in ANGLE /cve/cve-2026-9915/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9915/ OOB in ANGLE /cve/cve-2026-9916/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9916/ OOB in ANGLE /cve/cve-2026-9917/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9917/ UninitializedMemory in WebGL /cve/cve-2026-9918/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9918/ LogicError in Tint /cve/cve-2026-9919/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9919/ OOB in WebGL /cve/cve-2026-9920/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9920/ UninitializedMemory in GPU /cve/cve-2026-9921/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9921/ UninitializedMemory in WebGL /cve/cve-2026-9922/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9922/ UAF in GPU /cve/cve-2026-9923/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9923/ UAF in Skia /cve/cve-2026-9924/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9924/ OOB in ANGLE /cve/cve-2026-9925/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9925/ UAF in ANGLE /cve/cve-2026-9926/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9926/ OOB in ANGLE /cve/cve-2026-9927/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9927/ UAF in ANGLE /cve/cve-2026-9928/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9928/ OOB in ANGLE /cve/cve-2026-9929/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9929/ LogicError in WebGL /cve/cve-2026-9930/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9930/ OOB in Daw /cve/cve-2026-9931/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9931/ UAF in GPU /cve/cve-2026-9932/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9932/ UAF in ANGLE /cve/cve-2026-9933/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9933/ UAF in Input /cve/cve-2026-9934/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9934/ UAF in Aura /cve/cve-2026-9935/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9935/ UninitializedMemory in ANGLE /cve/cve-2026-9936/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9936/ UAF in GFX /cve/cve-2026-9937/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9937/ UAF in UI /cve/cve-2026-9938/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9938/ LogicError in V8 /cve/cve-2026-9939/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9939/ OOB in WebCodecs /cve/cve-2026-9940/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9940/ OOB in ANGLE /cve/cve-2026-9941/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9941/ UAF in ANGLE /cve/cve-2026-9942/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9942/ UninitializedMemory in ANGLE /cve/cve-2026-9943/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9943/ OOB in WebGL /cve/cve-2026-9944/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9944/ UninitializedMemory in ANGLE /cve/cve-2026-9945/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9945/ UAF in Media /cve/cve-2026-9946/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9946/ UAF in ANGLE /cve/cve-2026-9947/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9947/ UAF in XML /cve/cve-2026-9948/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9948/ UAF in Views /cve/cve-2026-9949/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9949/ UAF in Core /cve/cve-2026-9950/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9950/ LogicError in Chromium /cve/cve-2026-9951/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9951/ UAF in UI /cve/cve-2026-9952/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9952/ UAF in WebAudio /cve/cve-2026-9953/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9953/ OOB in ANGLE /cve/cve-2026-9954/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9954/ UAF in TabStrip /cve/cve-2026-9955/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9955/ LogicError in Chromium /cve/cve-2026-9956/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9956/ UAF in Chromium /cve/cve-2026-9957/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9957/ UAF in PDF /cve/cve-2026-9958/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9958/ UAF in PDFium /cve/cve-2026-9959/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9959/ Race in WebRTC /cve/cve-2026-9960/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9960/ IntegerOverflow in PDFium /cve/cve-2026-9961/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9961/ UAF in SurfaceCapture /cve/cve-2026-9962/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9962/ UAF in WebRTC /cve/cve-2026-9963/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9963/ UninitializedMemory in Chromium /cve/cve-2026-9964/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9964/ UAF in Bluetooth /cve/cve-2026-9965/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9965/ OOB in ANGLE /cve/cve-2026-9966/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9966/ IntegerOverflow in XML /cve/cve-2026-9967/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9967/ OOB in GPU /cve/cve-2026-9968/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9968/ IntegerOverflow in V8 /cve/cve-2026-9969/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9969/ LogicError in ANGLE /cve/cve-2026-9970/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9970/ UAF in WebGL /cve/cve-2026-9971/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9971/ LogicError in Chromium /cve/cve-2026-9972/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9972/ UninitializedMemory in Gamepad /cve/cve-2026-9973/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9973/ OOB in V8 /cve/cve-2026-9974/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9974/ OOB in GPU /cve/cve-2026-9975/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9975/ OOB in ANGLE /cve/cve-2026-9976/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9976/ LogicError in USB /cve/cve-2026-9977/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9977/ LogicError in WebShare /cve/cve-2026-9978/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9978/ UAF in Glic /cve/cve-2026-9979/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9979/ LogicError in Input /cve/cve-2026-9980/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9980/ LogicError in Printing /cve/cve-2026-9981/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9981/ LogicError in Skia /cve/cve-2026-9982/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9982/ LogicError in ANGLE /cve/cve-2026-9983/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9983/ TypeConfusion in Skia /cve/cve-2026-9984/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9984/ UAF in UI /cve/cve-2026-9985/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9985/ LogicError in Media /cve/cve-2026-9986/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9986/ LogicError in OptimizationGuide /cve/cve-2026-9987/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9987/ LogicError in WebAppInstalls /cve/cve-2026-9988/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9988/ UAF in WebRTC /cve/cve-2026-9989/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9989/ LogicError in Media /cve/cve-2026-9990/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9990/ UAF in WebAppInstalls /cve/cve-2026-9991/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9991/ LogicError in Media /cve/cve-2026-9992/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9992/ UAF in Network /cve/cve-2026-9993/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9993/ UAF in Views /cve/cve-2026-9994/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9994/ UAF in Core /cve/cve-2026-9995/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9995/ UAF in WebXR /cve/cve-2026-9996/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9996/ OOB in WebRTC /cve/cve-2026-9997/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9997/ UAF in Input /cve/cve-2026-9998/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9998/ IntegerOverflow in Skia /cve/cve-2026-9999/ Wed, 27 May 2026 00:00:00 +0000 /cve/cve-2026-9999/ LogicError in ANGLE /cve/cve-2026-8945/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8945/ SandboxEscape in Core /cve/cve-2026-8946/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8946/ LogicError in Media /cve/cve-2026-8947/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8947/ UAF in DOM /cve/cve-2026-8948/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8948/ CrossOrigin in Networking /cve/cve-2026-8949/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8949/ IntegerOverflow in Core /cve/cve-2026-8950/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8950/ CrossOrigin in Networking /cve/cve-2026-8951/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8951/ LogicError in Core /cve/cve-2026-8952/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8952/ LogicError in Toolkit /cve/cve-2026-8953/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8953/ UAF in Core /cve/cve-2026-8954/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8954/ IntegerOverflow in DOM /cve/cve-2026-8955/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8955/ LogicError in DOM /cve/cve-2026-8956/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8956/ IntegerOverflow in Core /cve/cve-2026-8957/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8957/ LogicError in Toolkit /cve/cve-2026-8958/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8958/ SandboxEscape in Security/NSS /cve/cve-2026-8959/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8959/ SandboxEscape in Widget /cve/cve-2026-8960/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8960/ LogicError in Core /cve/cve-2026-8961/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8961/ LogicError in Core /cve/cve-2026-8962/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8962/ LogicError in Networking /cve/cve-2026-8963/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8963/ LogicError in DOM /cve/cve-2026-8964/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8964/ LogicError in Toolkit /cve/cve-2026-8965/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8965/ LogicError in DOM /cve/cve-2026-8966/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8966/ LogicError in Toolkit /cve/cve-2026-8967/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8967/ LogicError in DOM /cve/cve-2026-8968/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8968/ LogicError in DOM /cve/cve-2026-8969/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8969/ LogicError in DOM /cve/cve-2026-8970/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8970/ LogicError in Toolkit /cve/cve-2026-8971/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8971/ CrossOrigin in Core /cve/cve-2026-8972/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8972/ LogicError in DOM /cve/cve-2026-8973/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8973/ MemoryCorruption in DOM /cve/cve-2026-8974/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8974/ MemoryCorruption in Networking /cve/cve-2026-8975/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-8975/ MemoryCorruption in Networking /cve/cve-2026-9110/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9110/ LogicError in UI /cve/cve-2026-9111/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9111/ UAF in WebRTC /cve/cve-2026-9112/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9112/ UAF in GPU /cve/cve-2026-9113/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9113/ OOB in GPU /cve/cve-2026-9114/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9114/ UAF in QUIC /cve/cve-2026-9115/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9115/ LogicError in Service Worker /cve/cve-2026-9116/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9116/ LogicError in ServiceWorker /cve/cve-2026-9117/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9117/ TypeConfusion in GFX /cve/cve-2026-9118/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9118/ UAF in XR /cve/cve-2026-9119/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9119/ OOB in WebRTC /cve/cve-2026-9120/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9120/ UAF in WebRTC /cve/cve-2026-9121/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9121/ OOB in GPU /cve/cve-2026-9122/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9122/ OOB in GPU /cve/cve-2026-9123/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9123/ OOB in Chromecast /cve/cve-2026-9124/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9124/ LogicError in Input /cve/cve-2026-9126/ Tue, 19 May 2026 00:00:00 +0000 /cve/cve-2026-9126/ UAF in DOM /cve/cve-2026-8388/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8388/ LogicError in SpiderMonkey /cve/cve-2026-8389/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8389/ LogicError in SpiderMonkey /cve/cve-2026-8390/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8390/ UAF in SpiderMonkey /cve/cve-2026-8391/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8391/ LogicError in SpiderMonkey /cve/cve-2026-8401/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8401/ SandboxEscape in DOM /cve/cve-2026-8509/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8509/ OOB in WebML /cve/cve-2026-8510/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8510/ IntegerOverflow in Skia /cve/cve-2026-8511/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8511/ UAF in UI /cve/cve-2026-8512/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8512/ UAF in FileSystem /cve/cve-2026-8513/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8513/ UAF in Input /cve/cve-2026-8514/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8514/ UAF in Aura /cve/cve-2026-8515/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8515/ UAF in HID /cve/cve-2026-8516/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8516/ LogicError in DataTransfer /cve/cve-2026-8517/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8517/ LogicError in WebShare /cve/cve-2026-8518/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8518/ UAF in Blink /cve/cve-2026-8519/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8519/ IntegerOverflow in ANGLE /cve/cve-2026-8520/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8520/ Race in Payments /cve/cve-2026-8521/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8521/ UAF in Tab Groups /cve/cve-2026-8522/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8522/ UAF in Downloads /cve/cve-2026-8523/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8523/ UAF in Mojo /cve/cve-2026-8524/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8524/ OOB in WebAudio /cve/cve-2026-8525/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8525/ OOB in ANGLE /cve/cve-2026-8526/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8526/ OOB in WebRTC /cve/cve-2026-8527/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8527/ LogicError in Downloads /cve/cve-2026-8528/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8528/ LogicError in SiteIsolatio /cve/cve-2026-8529/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8529/ OOB in Codecs /cve/cve-2026-8530/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8530/ UAF in Network /cve/cve-2026-8531/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8531/ OOB in WebML /cve/cve-2026-8532/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8532/ IntegerOverflow in XML /cve/cve-2026-8533/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8533/ UAF in Accessibility /cve/cve-2026-8534/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8534/ IntegerOverflow in GPU /cve/cve-2026-8535/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8535/ OOB in Media /cve/cve-2026-8536/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8536/ LogicError in ReadingMode /cve/cve-2026-8537/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8537/ LogicError in ViewTransitions /cve/cve-2026-8538/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8538/ LogicError in GPU /cve/cve-2026-8539/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8539/ LogicError in SanitizerAPI /cve/cve-2026-8540/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8540/ TypeConfusion in V8 /cve/cve-2026-8541/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8541/ OOB in UI /cve/cve-2026-8542/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8542/ UAF in Core /cve/cve-2026-8543/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8543/ OOB in FileSystem /cve/cve-2026-8544/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8544/ UAF in Media /cve/cve-2026-8545/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8545/ LogicError in Compositing /cve/cve-2026-8546/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8546/ OOB in GPU /cve/cve-2026-8547/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8547/ LogicError in Passwords /cve/cve-2026-8548/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8548/ OOB in Media /cve/cve-2026-8549/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8549/ UAF in Media /cve/cve-2026-8550/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8550/ UAF in Google Lens /cve/cve-2026-8551/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8551/ UAF in Downloads /cve/cve-2026-8552/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8552/ OOB in GPU /cve/cve-2026-8553/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8553/ UAF in GPU /cve/cve-2026-8554/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8554/ TypeConfusion in ANGLE /cve/cve-2026-8555/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8555/ UAF in GTK /cve/cve-2026-8556/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8556/ LogicError in ANGLE /cve/cve-2026-8557/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8557/ UAF in Accessibility /cve/cve-2026-8558/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8558/ OOB in Fonts /cve/cve-2026-8559/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8559/ IntegerOverflow in Internationalizatio /cve/cve-2026-8560/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8560/ OOB in SwiftShader /cve/cve-2026-8561/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8561/ LogicError in Fullscree /cve/cve-2026-8562/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8562/ LogicError in Navigatio /cve/cve-2026-8563/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8563/ SandboxEscape in IFrame Sandbox /cve/cve-2026-8564/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8564/ LogicError in Downloads /cve/cve-2026-8565/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8565/ LogicError in Downloads /cve/cve-2026-8566/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8566/ LogicError in Payments /cve/cve-2026-8567/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8567/ IntegerOverflow in ANGLE /cve/cve-2026-8569/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8569/ OOB in Codecs /cve/cve-2026-8570/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8570/ TypeConfusion in V8 /cve/cve-2026-8571/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8571/ LogicError in GPU /cve/cve-2026-8572/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8572/ LogicError in Network /cve/cve-2026-8573/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8573/ IntegerOverflow in Codecs /cve/cve-2026-8574/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8574/ UAF in Core /cve/cve-2026-8575/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8575/ UAF in UI /cve/cve-2026-8576/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8576/ CrossOrigin in CORS /cve/cve-2026-8577/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8577/ IntegerOverflow in Fonts /cve/cve-2026-8578/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8578/ OOB in GPU /cve/cve-2026-8579/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8579/ LogicError in Skia /cve/cve-2026-8580/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8580/ UAF in Mojo /cve/cve-2026-8581/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8581/ UAF in GPU /cve/cve-2026-8582/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8582/ LogicError in Daw /cve/cve-2026-8583/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8583/ LogicError in WebXR /cve/cve-2026-8584/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8584/ LogicError in Views /cve/cve-2026-8585/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8585/ LogicError in Media /cve/cve-2026-8586/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8586/ LogicError in Chromoting /cve/cve-2026-8587/ Tue, 12 May 2026 00:00:00 +0000 /cve/cve-2026-8587/ UAF in Extensions /cve/cve-2026-28847/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28847/ OOB in JSC /cve/cve-2026-28883/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28883/ UAF in WebKit /cve/cve-2026-28901/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28901/ UAF in JSC /cve/cve-2026-28902/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28902/ Race in JSC /cve/cve-2026-28903/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28903/ TypeConfusion in JSC /cve/cve-2026-28904/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28904/ IntegerOverflow in JSC /cve/cve-2026-28905/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28905/ TypeConfusion in WebKit /cve/cve-2026-28907/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28907/ Bypass in WebCore /cve/cve-2026-28913/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28913/ OOB in WebKit /cve/cve-2026-28917/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28917/ OOB in WebKit /cve/cve-2026-28942/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28942/ UAF in WebCore /cve/cve-2026-28944/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28944/ LogicError in WebCore /cve/cve-2026-28946/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28946/ UAF in WebCore /cve/cve-2026-28947/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28947/ UAF in JSC /cve/cve-2026-28953/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28953/ LogicError in WebKit /cve/cve-2026-28955/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28955/ UAF in WebCore /cve/cve-2026-28958/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28958/ CrossOrigin in WebCore /cve/cve-2026-28962/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28962/ Bypass in WebKit /cve/cve-2026-28971/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28971/ Bypass in WebKit /cve/cve-2026-28984/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-28984/ TypeConfusion in JSC /cve/cve-2026-43658/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-43658/ UAF in JSC /cve/cve-2026-43660/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-43660/ Bypass in WebCore /cve/cve-2026-43670/ Mon, 11 May 2026 00:00:00 +0000 /cve/cve-2026-43670/ CSP Bypass in WebKit /cve/cve-2026-8090/ Thu, 07 May 2026 00:00:00 +0000 /cve/cve-2026-8090/ UAF in DOM /cve/cve-2026-8092/ Thu, 07 May 2026 00:00:00 +0000 /cve/cve-2026-8092/ MemoryCorruption in Graphics /cve/cve-2026-8093/ Thu, 07 May 2026 00:00:00 +0000 /cve/cve-2026-8093/ MemoryCorruption in Core /cve/cve-2026-7896/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7896/ IntegerOverflow in Blink /cve/cve-2026-7897/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7897/ UAF in Mobile /cve/cve-2026-7898/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7898/ UAF in Chromoting /cve/cve-2026-7899/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7899/ OOB in V8 /cve/cve-2026-7900/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7900/ OOB in ANGLE /cve/cve-2026-7901/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7901/ UAF in ANGLE /cve/cve-2026-7902/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7902/ OOB in V8 /cve/cve-2026-7903/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7903/ IntegerOverflow in ANGLE /cve/cve-2026-7904/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7904/ OOB in Fonts /cve/cve-2026-7905/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7905/ LogicError in Media /cve/cve-2026-7906/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7906/ UAF in SVG /cve/cve-2026-7907/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7907/ UAF in DOM /cve/cve-2026-7908/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7908/ UAF in Fullscree /cve/cve-2026-7909/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7909/ LogicError in ServiceWorker /cve/cve-2026-7910/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7910/ UAF in Views /cve/cve-2026-7911/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7911/ UAF in Aura /cve/cve-2026-7912/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7912/ IntegerOverflow in GPU /cve/cve-2026-7913/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7913/ LogicError in DevTools /cve/cve-2026-7914/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7914/ TypeConfusion in Accessibility /cve/cve-2026-7915/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7915/ LogicError in DevTools /cve/cve-2026-7916/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7916/ LogicError in InterestGroups /cve/cve-2026-7917/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7917/ UAF in Fullscree /cve/cve-2026-7918/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7918/ UAF in GPU /cve/cve-2026-7919/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7919/ UAF in Aura /cve/cve-2026-7920/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7920/ UAF in Skia /cve/cve-2026-7921/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7921/ UAF in Passwords /cve/cve-2026-7922/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7922/ UAF in ServiceWorker /cve/cve-2026-7923/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7923/ OOB in Skia /cve/cve-2026-7924/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7924/ UninitializedMemory in Daw /cve/cve-2026-7925/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7925/ UAF in Chromoting /cve/cve-2026-7926/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7926/ UAF in PresentationAPI /cve/cve-2026-7927/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7927/ TypeConfusion in Runtime /cve/cve-2026-7928/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7928/ UAF in WebRTC /cve/cve-2026-7929/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7929/ UAF in MediaRecording /cve/cve-2026-7931/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7931/ LogicError in Chromium /cve/cve-2026-7932/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7932/ LogicError in Downloads /cve/cve-2026-7933/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7933/ OOB in WebCodecs /cve/cve-2026-7934/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7934/ LogicError in Popup Blocker /cve/cve-2026-7935/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7935/ LogicError in Speech /cve/cve-2026-7937/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7937/ LogicError in DevTools /cve/cve-2026-7938/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7938/ UAF in CSS /cve/cve-2026-7939/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7939/ LogicError in SanitizerAPI /cve/cve-2026-7940/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7940/ UAF in V8 /cve/cve-2026-7941/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7941/ LogicError in Mobile /cve/cve-2026-7942/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7942/ IntegerOverflow in ANGLE /cve/cve-2026-7943/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7943/ LogicError in ANGLE /cve/cve-2026-7944/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7944/ LogicError in Persistent Cache /cve/cve-2026-7945/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7945/ LogicError in COOP /cve/cve-2026-7946/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7946/ LogicError in WebUI /cve/cve-2026-7947/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7947/ LogicError in Network /cve/cve-2026-7948/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7948/ Race in Chromoting /cve/cve-2026-7949/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7949/ OOB in Skia /cve/cve-2026-7950/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7950/ OOB in GFX /cve/cve-2026-7951/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7951/ OOB in WebRTC /cve/cve-2026-7952/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7952/ LogicError in Extensions /cve/cve-2026-7953/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7953/ LogicError in Omnibox /cve/cve-2026-7954/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7954/ Race in Shared Storage /cve/cve-2026-7955/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7955/ UninitializedMemory in GPU /cve/cve-2026-7956/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7956/ UAF in Navigatio /cve/cve-2026-7957/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7957/ OOB in Media /cve/cve-2026-7958/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7958/ LogicError in ServiceWorker /cve/cve-2026-7959/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7959/ LogicError in Navigatio /cve/cve-2026-7960/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7960/ Race in Speech /cve/cve-2026-7961/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7961/ LogicError in Permissions /cve/cve-2026-7962/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7962/ LogicError in DirectSockets /cve/cve-2026-7963/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7963/ LogicError in ServiceWorker /cve/cve-2026-7964/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7964/ LogicError in FileSystem /cve/cve-2026-7965/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7965/ LogicError in DevTools /cve/cve-2026-7966/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7966/ LogicError in SiteIsolatio /cve/cve-2026-7967/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7967/ LogicError in Navigatio /cve/cve-2026-7968/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7968/ CrossOrigin in CORS /cve/cve-2026-7969/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7969/ IntegerOverflow in Network /cve/cve-2026-7970/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7970/ UAF in TopChrome /cve/cve-2026-7971/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7971/ LogicError in ORB /cve/cve-2026-7972/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7972/ UninitializedMemory in GPU /cve/cve-2026-7973/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7973/ IntegerOverflow in Daw /cve/cve-2026-7974/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7974/ UAF in Blink /cve/cve-2026-7975/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7975/ UAF in DevTools /cve/cve-2026-7976/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7976/ UAF in Views /cve/cve-2026-7977/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7977/ LogicError in Canvas /cve/cve-2026-7978/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7978/ LogicError in Companio /cve/cve-2026-7979/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7979/ LogicError in Media /cve/cve-2026-7980/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7980/ UAF in WebAudio /cve/cve-2026-7981/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7981/ OOB in Codecs /cve/cve-2026-7982/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7982/ UninitializedMemory in WebCodecs /cve/cve-2026-7983/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7983/ OOB in Daw /cve/cve-2026-7984/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7984/ UAF in ReadingMode /cve/cve-2026-7985/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7985/ UAF in GPU /cve/cve-2026-7986/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7986/ LogicError in Autofill /cve/cve-2026-7987/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7987/ UAF in WebRTC /cve/cve-2026-7988/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7988/ TypeConfusion in WebRTC /cve/cve-2026-7989/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7989/ LogicError in DataTransfer /cve/cve-2026-7990/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7990/ LogicError in Updater /cve/cve-2026-7991/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7991/ UAF in UI /cve/cve-2026-7992/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7992/ LogicError in UI /cve/cve-2026-7993/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7993/ LogicError in Payments /cve/cve-2026-7994/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7994/ LogicError in Chromoting /cve/cve-2026-7995/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7995/ OOB in AdFilter /cve/cve-2026-7996/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7996/ LogicError in SSL /cve/cve-2026-7997/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7997/ LogicError in Updater /cve/cve-2026-7998/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7998/ LogicError in Dialog /cve/cve-2026-7999/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-7999/ LogicError in V8 /cve/cve-2026-8000/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8000/ LogicError in ChromeDriver /cve/cve-2026-8001/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8001/ UAF in Printing /cve/cve-2026-8002/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8002/ UAF in Audio /cve/cve-2026-8003/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8003/ LogicError in TabGroups /cve/cve-2026-8004/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8004/ LogicError in DevTools /cve/cve-2026-8005/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8005/ LogicError in Cast /cve/cve-2026-8006/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8006/ LogicError in DevTools /cve/cve-2026-8007/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8007/ LogicError in Cast /cve/cve-2026-8008/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8008/ LogicError in DevTools /cve/cve-2026-8009/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8009/ LogicError in Cast /cve/cve-2026-8010/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8010/ LogicError in SiteIsolatio /cve/cve-2026-8011/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8011/ LogicError in Search /cve/cve-2026-8012/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8012/ LogicError in MHTML /cve/cve-2026-8013/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8013/ LogicError in FedCM /cve/cve-2026-8014/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8014/ LogicError in Preload /cve/cve-2026-8015/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8015/ LogicError in Media /cve/cve-2026-8016/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8016/ UAF in WebRTC /cve/cve-2026-8017/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8017/ LogicError in Media /cve/cve-2026-8018/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8018/ LogicError in DevTools /cve/cve-2026-8019/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8019/ LogicError in WebApp /cve/cve-2026-8020/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8020/ UninitializedMemory in GPU /cve/cve-2026-8021/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8021/ LogicError in UI /cve/cve-2026-8022/ Tue, 05 May 2026 00:00:00 +0000 /cve/cve-2026-8022/ LogicError in MHTML /cve/cve-2026-7320/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7320/ LogicError in DOM /cve/cve-2026-7322/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7322/ MemoryCorruption in Core /cve/cve-2026-7323/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7323/ MemoryCorruption in Layout /cve/cve-2026-7324/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7324/ MemoryCorruption in Core /cve/cve-2026-7333/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7333/ UAF in GPU /cve/cve-2026-7334/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7334/ UAF in Views /cve/cve-2026-7335/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7335/ UAF in Chromium /cve/cve-2026-7336/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7336/ UAF in WebRTC /cve/cve-2026-7337/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7337/ TypeConfusion in V8 /cve/cve-2026-7338/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7338/ UAF in Cast /cve/cve-2026-7339/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7339/ OOB in WebRTC /cve/cve-2026-7340/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7340/ IntegerOverflow in ANGLE /cve/cve-2026-7341/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7341/ UAF in WebRTC /cve/cve-2026-7342/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7342/ UAF in WebView /cve/cve-2026-7343/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7343/ UAF in Views /cve/cve-2026-7344/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7344/ UAF in Accessibility /cve/cve-2026-7345/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7345/ LogicError in Feedback /cve/cve-2026-7346/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7346/ LogicError in Tint /cve/cve-2026-7347/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7347/ UAF in Chromoting /cve/cve-2026-7348/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7348/ UAF in Codecs /cve/cve-2026-7349/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7349/ UAF in Cast /cve/cve-2026-7350/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7350/ UAF in WebMIDI /cve/cve-2026-7351/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7351/ Race in MHTML /cve/cve-2026-7352/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7352/ UAF in Media /cve/cve-2026-7353/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7353/ OOB in Skia /cve/cve-2026-7354/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7354/ OOB in Angle /cve/cve-2026-7355/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7355/ UAF in Media /cve/cve-2026-7356/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7356/ UAF in Navigatio /cve/cve-2026-7357/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7357/ UAF in GPU /cve/cve-2026-7358/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7358/ UAF in Animatio /cve/cve-2026-7359/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7359/ UAF in ANGLE /cve/cve-2026-7360/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7360/ LogicError in Compositing /cve/cve-2026-7361/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7361/ UAF in Chromium /cve/cve-2026-7363/ Tue, 28 Apr 2026 00:00:00 +0000 /cve/cve-2026-7363/ UAF in Canvas /cve/cve-2026-6919/ Wed, 22 Apr 2026 00:00:00 +0000 /cve/cve-2026-6919/ UAF in DevTools /cve/cve-2026-6920/ Wed, 22 Apr 2026 00:00:00 +0000 /cve/cve-2026-6920/ OOB in GPU /cve/cve-2026-6921/ Wed, 22 Apr 2026 00:00:00 +0000 /cve/cve-2026-6921/ Race in GPU /cve/cve-2026-6746/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6746/ UAF in DOM /cve/cve-2026-6747/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6747/ UAF in DOM /cve/cve-2026-6748/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6748/ UninitializedMemory in DOM /cve/cve-2026-6749/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6749/ UninitializedMemory in DOM /cve/cve-2026-6750/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6750/ LogicError in DOM /cve/cve-2026-6751/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6751/ UninitializedMemory in DOM /cve/cve-2026-6752/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6752/ LogicError in Core /cve/cve-2026-6753/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6753/ LogicError in Core /cve/cve-2026-6754/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6754/ UAF in DOM /cve/cve-2026-6755/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6755/ LogicError in DOM /cve/cve-2026-6756/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6756/ LogicError in Core /cve/cve-2026-6757/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6757/ LogicError in SpiderMonkey /cve/cve-2026-6758/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6758/ UAF in SpiderMonkey /cve/cve-2026-6759/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6759/ UAF in Networking /cve/cve-2026-6760/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6760/ LogicError in DOM /cve/cve-2026-6761/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6761/ LogicError in DOM /cve/cve-2026-6762/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6762/ LogicError in Core /cve/cve-2026-6763/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6763/ LogicError in Toolkit /cve/cve-2026-6764/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6764/ LogicError in DOM /cve/cve-2026-6765/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6765/ LogicError in Toolkit /cve/cve-2026-6766/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6766/ LogicError in Core /cve/cve-2026-6767/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6767/ LogicError in Core /cve/cve-2026-6768/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6768/ LogicError in Networking /cve/cve-2026-6769/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6769/ LogicError in Core /cve/cve-2026-6770/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6770/ LogicError in DOM /cve/cve-2026-6771/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6771/ LogicError in DOM /cve/cve-2026-6772/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6772/ LogicError in Core /cve/cve-2026-6773/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6773/ IntegerOverflow in Core /cve/cve-2026-6774/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6774/ LogicError in DOM /cve/cve-2026-6775/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6775/ LogicError in DOM /cve/cve-2026-6776/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6776/ LogicError in DOM /cve/cve-2026-6777/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6777/ LogicError in Networking /cve/cve-2026-6778/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6778/ LogicError in DOM /cve/cve-2026-6779/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6779/ LogicError in SpiderMonkey /cve/cve-2026-6780/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6780/ LogicError in Core /cve/cve-2026-6781/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6781/ LogicError in DOM /cve/cve-2026-6782/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6782/ LogicError in Toolkit /cve/cve-2026-6783/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6783/ IntegerOverflow in DOM /cve/cve-2026-6784/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6784/ MemoryCorruption in DOM /cve/cve-2026-6785/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6785/ MemoryCorruption in Core /cve/cve-2026-6786/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-6786/ MemoryCorruption in Graphics /cve/cve-2026-7321/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-7321/ SandboxEscape in DOM /cve/cve-2026-8091/ Tue, 21 Apr 2026 00:00:00 +0000 /cve/cve-2026-8091/ LogicError in Core /cve/cve-2026-6296/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6296/ OOB in ANGLE /cve/cve-2026-6297/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6297/ UAF in Proxy /cve/cve-2026-6298/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6298/ OOB in Skia /cve/cve-2026-6299/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6299/ UAF in Prerender /cve/cve-2026-6300/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6300/ UAF in CSS /cve/cve-2026-6301/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6301/ TypeConfusion in Turbofa /cve/cve-2026-6302/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6302/ UAF in Video /cve/cve-2026-6303/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6303/ UAF in Codecs /cve/cve-2026-6304/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6304/ UAF in Graphite /cve/cve-2026-6305/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6305/ OOB in PDFium /cve/cve-2026-6306/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6306/ OOB in PDFium /cve/cve-2026-6307/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6307/ TypeConfusion in Turbofa /cve/cve-2026-6308/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6308/ OOB in Media /cve/cve-2026-6309/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6309/ UAF in Viz /cve/cve-2026-6310/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6310/ UAF in Daw /cve/cve-2026-6311/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6311/ UninitializedMemory in Accessibility /cve/cve-2026-6312/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6312/ LogicError in Passwords /cve/cve-2026-6313/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6313/ CrossOrigin in CORS /cve/cve-2026-6314/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6314/ OOB in GPU /cve/cve-2026-6315/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6315/ UAF in Permissions /cve/cve-2026-6316/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6316/ UAF in Forms /cve/cve-2026-6317/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6317/ UAF in Cast /cve/cve-2026-6318/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6318/ UAF in Codecs /cve/cve-2026-6319/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6319/ UAF in Payments /cve/cve-2026-6358/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6358/ UAF in XR /cve/cve-2026-6359/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6359/ UAF in Video /cve/cve-2026-6360/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6360/ UAF in FileSystem /cve/cve-2026-6361/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6361/ OOB in PDFium /cve/cve-2026-6362/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6362/ UAF in Codecs /cve/cve-2026-6363/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6363/ TypeConfusion in V8 /cve/cve-2026-6364/ Wed, 15 Apr 2026 00:00:00 +0000 /cve/cve-2026-6364/ OOB in Skia /cve/cve-2026-5731/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5731/ MemoryCorruption in DOM /cve/cve-2026-5732/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5732/ IntegerOverflow in Graphics /cve/cve-2026-5733/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5733/ LogicError in Graphics /cve/cve-2026-5734/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5734/ MemoryCorruption in Networking /cve/cve-2026-5735/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5735/ MemoryCorruption in DOM /cve/cve-2026-5858/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5858/ OOB in WebML /cve/cve-2026-5859/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5859/ IntegerOverflow in WebML /cve/cve-2026-5860/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5860/ UAF in WebRTC /cve/cve-2026-5861/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5861/ UAF in V8 /cve/cve-2026-5862/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5862/ LogicError in V8 /cve/cve-2026-5863/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5863/ LogicError in V8 /cve/cve-2026-5864/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5864/ OOB in WebAudio /cve/cve-2026-5865/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5865/ TypeConfusion in V8 /cve/cve-2026-5866/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5866/ UAF in Media /cve/cve-2026-5867/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5867/ OOB in WebML /cve/cve-2026-5868/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5868/ OOB in ANGLE /cve/cve-2026-5869/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5869/ OOB in WebML /cve/cve-2026-5870/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5870/ IntegerOverflow in Skia /cve/cve-2026-5871/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5871/ TypeConfusion in V8 /cve/cve-2026-5872/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5872/ UAF in Blink /cve/cve-2026-5873/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5873/ OOB in V8 /cve/cve-2026-5874/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5874/ UAF in PrivateAI /cve/cve-2026-5875/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5875/ LogicError in Blink /cve/cve-2026-5876/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5876/ LogicError in Navigatio /cve/cve-2026-5877/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5877/ UAF in Navigatio /cve/cve-2026-5878/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5878/ LogicError in Blink /cve/cve-2026-5879/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5879/ LogicError in ANGLE /cve/cve-2026-5880/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5880/ LogicError in Chromium /cve/cve-2026-5881/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5881/ LogicError in LocalNetworkAccess /cve/cve-2026-5882/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5882/ LogicError in Fullscree /cve/cve-2026-5883/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5883/ UAF in Media /cve/cve-2026-5884/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5884/ LogicError in Media /cve/cve-2026-5885/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5885/ LogicError in WebML /cve/cve-2026-5886/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5886/ OOB in WebAudio /cve/cve-2026-5887/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5887/ LogicError in Downloads /cve/cve-2026-5888/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5888/ UninitializedMemory in WebCodecs /cve/cve-2026-5889/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5889/ LogicError in PDFium /cve/cve-2026-5890/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5890/ Race in WebCodecs /cve/cve-2026-5891/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5891/ LogicError in Chromium /cve/cve-2026-5892/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5892/ LogicError in PWAs /cve/cve-2026-5893/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5893/ Race in V8 /cve/cve-2026-5894/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5894/ LogicError in PDF /cve/cve-2026-5895/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5895/ LogicError in Omnibox /cve/cve-2026-5896/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5896/ LogicError in Audio /cve/cve-2026-5897/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5897/ LogicError in Downloads /cve/cve-2026-5898/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5898/ LogicError in Omnibox /cve/cve-2026-5899/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5899/ LogicError in History Navigatio /cve/cve-2026-5900/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5900/ LogicError in Downloads /cve/cve-2026-5901/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5901/ LogicError in DevTools /cve/cve-2026-5902/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5902/ Race in Media /cve/cve-2026-5903/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5903/ SandboxEscape in IFrameSandbox /cve/cve-2026-5905/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5905/ LogicError in Permissions /cve/cve-2026-5906/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5906/ LogicError in Omnibox /cve/cve-2026-5907/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5907/ LogicError in Media /cve/cve-2026-5908/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5908/ IntegerOverflow in Media /cve/cve-2026-5909/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5909/ IntegerOverflow in Media /cve/cve-2026-5910/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5910/ IntegerOverflow in Media /cve/cve-2026-5911/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5911/ LogicError in ServiceWorkers /cve/cve-2026-5912/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5912/ IntegerOverflow in WebRTC /cve/cve-2026-5913/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5913/ OOB in Blink /cve/cve-2026-5914/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5914/ TypeConfusion in CSS /cve/cve-2026-5915/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5915/ LogicError in WebML /cve/cve-2026-5918/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5918/ LogicError in Navigatio /cve/cve-2026-5919/ Tue, 07 Apr 2026 00:00:00 +0000 /cve/cve-2026-5919/ LogicError in WebSockets /cve/cve-2026-5272/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5272/ OOB in GPU /cve/cve-2026-5273/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5273/ UAF in CSS /cve/cve-2026-5274/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5274/ IntegerOverflow in Codecs /cve/cve-2026-5275/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5275/ OOB in ANGLE /cve/cve-2026-5276/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5276/ LogicError in WebUSB /cve/cve-2026-5277/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5277/ IntegerOverflow in ANGLE /cve/cve-2026-5278/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5278/ UAF in Web MIDI /cve/cve-2026-5279/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5279/ LogicError in V8 /cve/cve-2026-5280/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5280/ UAF in WebCodecs /cve/cve-2026-5281/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5281/ UAF in Daw /cve/cve-2026-5282/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5282/ OOB in WebCodecs /cve/cve-2026-5283/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5283/ LogicError in ANGLE /cve/cve-2026-5284/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5284/ UAF in Daw /cve/cve-2026-5285/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5285/ UAF in WebGL /cve/cve-2026-5286/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5286/ UAF in Daw /cve/cve-2026-5287/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5287/ UAF in PDF /cve/cve-2026-5288/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5288/ UAF in WebView /cve/cve-2026-5289/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5289/ UAF in Navigatio /cve/cve-2026-5290/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5290/ UAF in Compositing /cve/cve-2026-5291/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5291/ LogicError in WebGL /cve/cve-2026-5292/ Tue, 31 Mar 2026 00:00:00 +0000 /cve/cve-2026-5292/ OOB in WebCodecs /cve/cve-2025-59375/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2025-59375/ LogicError in Core /cve/cve-2026-20664/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-20664/ UAF in JSC /cve/cve-2026-20665/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-20665/ Bypass in WebCore /cve/cve-2026-20691/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-20691/ LogicError in WebKit /cve/cve-2026-28857/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-28857/ Race in JSC /cve/cve-2026-28859/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-28859/ OOB in WebKit /cve/cve-2026-28861/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-28861/ CrossOrigin in WebCore /cve/cve-2026-28871/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-28871/ LogicError in WebCore /cve/cve-2026-4684/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4684/ UAF in Graphics /cve/cve-2026-4685/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4685/ LogicError in Graphics /cve/cve-2026-4686/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4686/ LogicError in Graphics /cve/cve-2026-4687/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4687/ SandboxEscape in Toolkit /cve/cve-2026-4688/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4688/ UAF in DOM /cve/cve-2026-4689/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4689/ IntegerOverflow in Core /cve/cve-2026-4690/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4690/ IntegerOverflow in Core /cve/cve-2026-4691/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4691/ UAF in DOM /cve/cve-2026-4692/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4692/ SandboxEscape in Core /cve/cve-2026-4693/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4693/ LogicError in DOM /cve/cve-2026-4694/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4694/ IntegerOverflow in Graphics /cve/cve-2026-4695/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4695/ LogicError in DOM /cve/cve-2026-4696/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4696/ UAF in Layout /cve/cve-2026-4697/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4697/ LogicError in Core /cve/cve-2026-4698/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4698/ LogicError in SpiderMonkey /cve/cve-2026-4699/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4699/ LogicError in Graphics /cve/cve-2026-4700/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4700/ LogicError in DOM /cve/cve-2026-4701/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4701/ UAF in SpiderMonkey /cve/cve-2026-4702/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4702/ LogicError in SpiderMonkey /cve/cve-2026-4704/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4704/ LogicError in DOM /cve/cve-2026-4705/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4705/ LogicError in Core /cve/cve-2026-4706/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4706/ LogicError in Graphics /cve/cve-2026-4707/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4707/ LogicError in Graphics /cve/cve-2026-4708/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4708/ LogicError in Graphics /cve/cve-2026-4709/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4709/ LogicError in DOM /cve/cve-2026-4710/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4710/ LogicError in DOM /cve/cve-2026-4711/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4711/ UAF in Widget /cve/cve-2026-4712/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4712/ LogicError in Widget /cve/cve-2026-4713/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4713/ LogicError in DOM /cve/cve-2026-4714/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4714/ LogicError in DOM /cve/cve-2026-4715/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4715/ UninitializedMemory in Graphics /cve/cve-2026-4716/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4716/ UninitializedMemory in SpiderMonkey /cve/cve-2026-4717/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4717/ LogicError in Core /cve/cve-2026-4718/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4718/ LogicError in Core /cve/cve-2026-4719/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4719/ LogicError in Graphics /cve/cve-2026-4720/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4720/ MemoryCorruption in Toolkit /cve/cve-2026-4721/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4721/ MemoryCorruption in SpiderMonkey /cve/cve-2026-4722/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4722/ LogicError in DOM /cve/cve-2026-4723/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4723/ UAF in SpiderMonkey /cve/cve-2026-4724/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4724/ LogicError in DOM /cve/cve-2026-4725/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4725/ UAF in Graphics /cve/cve-2026-4726/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4726/ LogicError in Core /cve/cve-2026-4727/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4727/ LogicError in Core /cve/cve-2026-4728/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4728/ LogicError in Core /cve/cve-2026-4729/ Tue, 24 Mar 2026 00:00:00 +0000 /cve/cve-2026-4729/ MemoryCorruption in DOM /cve/cve-2026-4673/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4673/ OOB in WebAudio /cve/cve-2026-4674/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4674/ OOB in CSS /cve/cve-2026-4675/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4675/ OOB in WebGL /cve/cve-2026-4676/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4676/ UAF in Daw /cve/cve-2026-4677/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4677/ OOB in WebAudio /cve/cve-2026-4678/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4678/ UAF in WebGPU /cve/cve-2026-4679/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4679/ IntegerOverflow in Fonts /cve/cve-2026-4680/ Mon, 23 Mar 2026 00:00:00 +0000 /cve/cve-2026-4680/ UAF in FedCM /cve/cve-2026-4439/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4439/ OOB in WebGL /cve/cve-2026-4440/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4440/ OOB in WebGL /cve/cve-2026-4441/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4441/ UAF in Base /cve/cve-2026-4442/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4442/ OOB in CSS /cve/cve-2026-4443/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4443/ OOB in WebAudio /cve/cve-2026-4444/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4444/ OOB in WebRTC /cve/cve-2026-4445/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4445/ UAF in WebRTC /cve/cve-2026-4446/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4446/ UAF in WebRTC /cve/cve-2026-4447/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4447/ LogicError in V8 /cve/cve-2026-4448/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4448/ OOB in ANGLE /cve/cve-2026-4449/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4449/ UAF in Blink /cve/cve-2026-4450/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4450/ OOB in V8 /cve/cve-2026-4451/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4451/ LogicError in Navigatio /cve/cve-2026-4452/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4452/ IntegerOverflow in ANGLE /cve/cve-2026-4453/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4453/ IntegerOverflow in Daw /cve/cve-2026-4454/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4454/ UAF in Network /cve/cve-2026-4455/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4455/ OOB in PDFium /cve/cve-2026-4456/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4456/ UAF in Digital Credentials API /cve/cve-2026-4457/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4457/ TypeConfusion in V8 /cve/cve-2026-4458/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4458/ UAF in Extensions /cve/cve-2026-4459/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4459/ OOB in WebAudio /cve/cve-2026-4460/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4460/ OOB in Skia /cve/cve-2026-4461/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4461/ LogicError in V8 /cve/cve-2026-4462/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4462/ OOB in Blink /cve/cve-2026-4463/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4463/ OOB in WebRTC /cve/cve-2026-4464/ Wed, 18 Mar 2026 00:00:00 +0000 /cve/cve-2026-4464/ IntegerOverflow in ANGLE /cve/cve-2026-20643/ Tue, 17 Mar 2026 00:00:00 +0000 /cve/cve-2026-20643/ CrossOrigin in WebCore /cve/cve-2026-3909/ Fri, 13 Mar 2026 00:00:00 +0000 /cve/cve-2026-3909/ OOB in Skia /cve/cve-2026-3910/ Thu, 12 Mar 2026 00:00:00 +0000 /cve/cve-2026-3910/ LogicError in V8 /cve/cve-2026-3845/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3845/ OOB in DOM /cve/cve-2026-3846/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3846/ CrossOrigin in Layout /cve/cve-2026-3847/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3847/ MemoryCorruption in DOM /cve/cve-2026-3913/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3913/ OOB in WebML /cve/cve-2026-3914/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3914/ IntegerOverflow in WebML /cve/cve-2026-3915/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3915/ OOB in WebML /cve/cve-2026-3916/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3916/ OOB in Web Speech /cve/cve-2026-3917/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3917/ UAF in Agents /cve/cve-2026-3918/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3918/ UAF in WebMCP /cve/cve-2026-3919/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3919/ UAF in Extensions /cve/cve-2026-3920/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3920/ OOB in WebML /cve/cve-2026-3921/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3921/ UAF in TextEncoding /cve/cve-2026-3922/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3922/ UAF in MediaStream /cve/cve-2026-3923/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3923/ UAF in WebMIDI /cve/cve-2026-3924/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3924/ UAF in WindowDialog /cve/cve-2026-3925/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3925/ LogicError in LookalikeChecks /cve/cve-2026-3926/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3926/ OOB in V8 /cve/cve-2026-3927/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3927/ LogicError in PictureInPicture /cve/cve-2026-3928/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3928/ LogicError in Extensions /cve/cve-2026-3929/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3929/ LogicError in ResourceTiming /cve/cve-2026-3930/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3930/ LogicError in Navigatio /cve/cve-2026-3931/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3931/ OOB in Skia /cve/cve-2026-3932/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3932/ LogicError in PDF /cve/cve-2026-3934/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3934/ LogicError in ChromeDriver /cve/cve-2026-3935/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3935/ LogicError in WebAppInstalls /cve/cve-2026-3936/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3936/ UAF in WebView /cve/cve-2026-3937/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3937/ LogicError in Downloads /cve/cve-2026-3938/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3938/ LogicError in Clipboard /cve/cve-2026-3939/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3939/ LogicError in PDF /cve/cve-2026-3940/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3940/ LogicError in DevTools /cve/cve-2026-3941/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3941/ LogicError in DevTools /cve/cve-2026-3942/ Tue, 10 Mar 2026 00:00:00 +0000 /cve/cve-2026-3942/ LogicError in PictureInPicture /cve/cve-2026-3536/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3536/ IntegerOverflow in ANGLE /cve/cve-2026-3537/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3537/ LogicError in PowerVR /cve/cve-2026-3538/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3538/ IntegerOverflow in Skia /cve/cve-2026-3540/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3540/ LogicError in WebAudio /cve/cve-2026-3541/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3541/ LogicError in CSS /cve/cve-2026-3542/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3542/ LogicError in WebAssembly /cve/cve-2026-3543/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3543/ LogicError in V8 /cve/cve-2026-3544/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3544/ OOB in WebCodecs /cve/cve-2026-3545/ Tue, 03 Mar 2026 00:00:00 +0000 /cve/cve-2026-3545/ LogicError in Navigatio /cve/cve-2026-2757/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2757/ LogicError in DOM /cve/cve-2026-2758/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2758/ UAF in Core /cve/cve-2026-2759/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2759/ LogicError in ImageLib /cve/cve-2026-2760/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2760/ SandboxEscape in Graphics /cve/cve-2026-2761/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2761/ SandboxEscape in Graphics /cve/cve-2026-2762/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2762/ IntegerOverflow in SpiderMonkey /cve/cve-2026-2763/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2763/ UAF in SpiderMonkey /cve/cve-2026-2764/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2764/ UAF in SpiderMonkey /cve/cve-2026-2765/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2765/ UAF in SpiderMonkey /cve/cve-2026-2766/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2766/ UAF in SpiderMonkey /cve/cve-2026-2767/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2767/ UAF in SpiderMonkey /cve/cve-2026-2768/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2768/ SandboxEscape in DOM /cve/cve-2026-2769/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2769/ UAF in DOM /cve/cve-2026-2770/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2770/ UAF in DOM /cve/cve-2026-2771/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2771/ LogicError in DOM /cve/cve-2026-2772/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2772/ UAF in Toolkit /cve/cve-2026-2773/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2773/ LogicError in DOM /cve/cve-2026-2774/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2774/ IntegerOverflow in DOM /cve/cve-2026-2775/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2775/ LogicError in Core /cve/cve-2026-2776/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2776/ SandboxEscape in Toolkit /cve/cve-2026-2777/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2777/ LogicError in Core /cve/cve-2026-2778/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2778/ SandboxEscape in DOM /cve/cve-2026-2779/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2779/ LogicError in Core /cve/cve-2026-2780/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2780/ LogicError in Core /cve/cve-2026-2781/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2781/ IntegerOverflow in Core /cve/cve-2026-2782/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2782/ LogicError in Core /cve/cve-2026-2783/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2783/ LogicError in SpiderMonkey /cve/cve-2026-2784/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2784/ LogicError in DOM /cve/cve-2026-2785/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2785/ LogicError in SpiderMonkey /cve/cve-2026-2786/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2786/ UAF in SpiderMonkey /cve/cve-2026-2787/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2787/ UAF in Toolkit /cve/cve-2026-2788/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2788/ LogicError in DOM /cve/cve-2026-2789/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2789/ UAF in ImageLib /cve/cve-2026-2790/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2790/ CrossOrigin in Core /cve/cve-2026-2791/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2791/ LogicError in Networking /cve/cve-2026-2792/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2792/ MemoryCorruption in Core /cve/cve-2026-2793/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2793/ MemoryCorruption in DOM /cve/cve-2026-2794/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2794/ UninitializedMemory in DOM /cve/cve-2026-2795/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2795/ UAF in SpiderMonkey /cve/cve-2026-2796/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2796/ LogicError in SpiderMonkey /cve/cve-2026-2797/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2797/ UAF in SpiderMonkey /cve/cve-2026-2798/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2798/ UAF in DOM /cve/cve-2026-2799/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2799/ UAF in DOM /cve/cve-2026-2800/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2800/ LogicError in Core /cve/cve-2026-2801/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2801/ LogicError in SpiderMonkey /cve/cve-2026-2802/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2802/ Race in SpiderMonkey /cve/cve-2026-2803/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2803/ LogicError in Toolkit /cve/cve-2026-2804/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2804/ UAF in SpiderMonkey /cve/cve-2026-2805/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2805/ LogicError in DOM /cve/cve-2026-2806/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2806/ UninitializedMemory in Graphics /cve/cve-2026-2807/ Tue, 24 Feb 2026 00:00:00 +0000 /cve/cve-2026-2807/ MemoryCorruption in Core /cve/cve-2026-3061/ Mon, 23 Feb 2026 00:00:00 +0000 /cve/cve-2026-3061/ OOB in Media /cve/cve-2026-3062/ Mon, 23 Feb 2026 00:00:00 +0000 /cve/cve-2026-3062/ OOB in Tint /cve/cve-2026-3063/ Mon, 23 Feb 2026 00:00:00 +0000 /cve/cve-2026-3063/ LogicError in DevTools /cve/cve-2026-2648/ Wed, 18 Feb 2026 00:00:00 +0000 /cve/cve-2026-2648/ OOB in PDFium /cve/cve-2026-2649/ Wed, 18 Feb 2026 00:00:00 +0000 /cve/cve-2026-2649/ IntegerOverflow in V8 /cve/cve-2026-2650/ Wed, 18 Feb 2026 00:00:00 +0000 /cve/cve-2026-2650/ OOB in Media /cve/cve-2026-2447/ Mon, 16 Feb 2026 00:00:00 +0000 /cve/cve-2026-2447/ OOB in Media /cve/cve-2026-2441/ Fri, 13 Feb 2026 00:00:00 +0000 /cve/cve-2026-2441/ UAF in CSS /cve/cve-2026-20608/ Wed, 11 Feb 2026 00:00:00 +0000 /cve/cve-2026-20608/ LogicError in JSC /cve/cve-2026-20635/ Wed, 11 Feb 2026 00:00:00 +0000 /cve/cve-2026-20635/ LogicError in WebKit /cve/cve-2026-20636/ Wed, 11 Feb 2026 00:00:00 +0000 /cve/cve-2026-20636/ LogicError in WebKit /cve/cve-2026-20644/ Wed, 11 Feb 2026 00:00:00 +0000 /cve/cve-2026-20644/ TypeConfusion in JSC /cve/cve-2026-20652/ Wed, 11 Feb 2026 00:00:00 +0000 /cve/cve-2026-20652/ IntegerOverflow in WebCore /cve/cve-2026-20676/ Wed, 11 Feb 2026 00:00:00 +0000 /cve/cve-2026-20676/ CrossOrigin in WebCore /cve/cve-2026-2313/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2313/ UAF in CSS /cve/cve-2026-2314/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2314/ OOB in Codecs /cve/cve-2026-2315/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2315/ LogicError in WebGPU /cve/cve-2026-2316/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2316/ LogicError in Frames /cve/cve-2026-2317/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2317/ LogicError in Animatio /cve/cve-2026-2318/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2318/ LogicError in PictureInPicture /cve/cve-2026-2319/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2319/ Race in DevTools /cve/cve-2026-2320/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2320/ LogicError in File input /cve/cve-2026-2321/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2321/ UAF in Ozone /cve/cve-2026-2322/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2322/ LogicError in File input /cve/cve-2026-2323/ Tue, 10 Feb 2026 00:00:00 +0000 /cve/cve-2026-2323/ LogicError in Downloads /cve/cve-2026-1861/ Tue, 03 Feb 2026 00:00:00 +0000 /cve/cve-2026-1861/ OOB in Chromium /cve/cve-2026-1862/ Tue, 03 Feb 2026 00:00:00 +0000 /cve/cve-2026-1862/ TypeConfusion in V8 /cve/cve-2026-1504/ Tue, 27 Jan 2026 00:00:00 +0000 /cve/cve-2026-1504/ LogicError in Background Fetch API /cve/cve-2026-24868/ Tue, 27 Jan 2026 00:00:00 +0000 /cve/cve-2026-24868/ LogicError in Core /cve/cve-2026-24869/ Tue, 27 Jan 2026 00:00:00 +0000 /cve/cve-2026-24869/ UAF in Layout /cve/cve-2026-1220/ Tue, 20 Jan 2026 00:00:00 +0000 /cve/cve-2026-1220/ Race in V8 /cve/cve-2026-0877/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0877/ LogicError in Networking /cve/cve-2026-0878/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0878/ SandboxEscape in Graphics /cve/cve-2026-0879/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0879/ SandboxEscape in Graphics /cve/cve-2026-0880/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0880/ IntegerOverflow in Graphics /cve/cve-2026-0881/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0881/ SandboxEscape in Core /cve/cve-2026-0882/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0882/ UAF in DOM /cve/cve-2026-0883/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0883/ LogicError in Core /cve/cve-2026-0884/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0884/ UAF in SpiderMonkey /cve/cve-2026-0885/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0885/ UAF in SpiderMonkey /cve/cve-2026-0886/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0886/ LogicError in Graphics /cve/cve-2026-0887/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0887/ LogicError in Toolkit /cve/cve-2026-0888/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0888/ LogicError in DOM /cve/cve-2026-0889/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0889/ LogicError in DOM /cve/cve-2026-0890/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0890/ LogicError in DOM /cve/cve-2026-0891/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0891/ MemoryCorruption in Core /cve/cve-2026-0892/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0892/ MemoryCorruption in Core /cve/cve-2026-0899/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0899/ OOB in V8 /cve/cve-2026-0900/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0900/ LogicError in V8 /cve/cve-2026-0901/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0901/ LogicError in Blink /cve/cve-2026-0902/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0902/ LogicError in V8 /cve/cve-2026-0903/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0903/ LogicError in Downloads /cve/cve-2026-0904/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0904/ LogicError in Digital Credentials /cve/cve-2026-0905/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0905/ LogicError in Network /cve/cve-2026-0906/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0906/ LogicError in Chromium /cve/cve-2026-0907/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0907/ LogicError in Split View /cve/cve-2026-0908/ Tue, 13 Jan 2026 00:00:00 +0000 /cve/cve-2026-0908/ UAF in ANGLE /cve/cve-2026-0628/ Tue, 06 Jan 2026 00:00:00 +0000 /cve/cve-2026-0628/ LogicError in WebView tag /cve/cve-2025-14860/ Thu, 18 Dec 2025 00:00:00 +0000 /cve/cve-2025-14860/ UAF in Layout /cve/cve-2025-14861/ Thu, 18 Dec 2025 00:00:00 +0000 /cve/cve-2025-14861/ MemoryCorruption in Graphics /cve/cve-2025-14765/ Tue, 16 Dec 2025 00:00:00 +0000 /cve/cve-2025-14765/ UAF in WebGPU /cve/cve-2025-14766/ Tue, 16 Dec 2025 00:00:00 +0000 /cve/cve-2025-14766/ OOB in V8 /cve/cve-2025-14174/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-14174/ LogicError in WebKit /cve/cve-2025-43501/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-43501/ IntegerOverflow in WTF /cve/cve-2025-43529/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-43529/ UAF in JSC /cve/cve-2025-43531/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-43531/ Race in bmalloc /cve/cve-2025-43535/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-43535/ TypeConfusion in JSC /cve/cve-2025-43536/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-43536/ UAF in JSC /cve/cve-2025-43541/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-43541/ TypeConfusion in JSC /cve/cve-2025-46282/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-46282/ Bypass in WebKit /cve/cve-2025-46298/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-46298/ TypeConfusion in JSC /cve/cve-2025-46299/ Fri, 12 Dec 2025 00:00:00 +0000 /cve/cve-2025-46299/ LogicError in WebKit /cve/cve-2025-14372/ Wed, 10 Dec 2025 00:00:00 +0000 /cve/cve-2025-14372/ UAF in Password Manager /cve/cve-2025-14373/ Wed, 10 Dec 2025 00:00:00 +0000 /cve/cve-2025-14373/ LogicError in Toolbar /cve/cve-2025-14321/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14321/ UAF in DOM /cve/cve-2025-14322/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14322/ SandboxEscape in DOM /cve/cve-2025-14323/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14323/ LogicError in ImageLib /cve/cve-2025-14324/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14324/ LogicError in SpiderMonkey /cve/cve-2025-14325/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14325/ LogicError in SpiderMonkey /cve/cve-2025-14326/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14326/ UAF in DOM /cve/cve-2025-14327/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14327/ LogicError in Toolkit /cve/cve-2025-14328/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14328/ LogicError in Core /cve/cve-2025-14329/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14329/ LogicError in Core /cve/cve-2025-14330/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14330/ LogicError in SpiderMonkey /cve/cve-2025-14331/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14331/ CrossOrigin in Toolkit /cve/cve-2025-14332/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14332/ MemoryCorruption in Core /cve/cve-2025-14333/ Tue, 09 Dec 2025 00:00:00 +0000 /cve/cve-2025-14333/ MemoryCorruption in Networking /cve/cve-2025-13630/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13630/ TypeConfusion in V8 /cve/cve-2025-13631/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13631/ LogicError in Google Updater /cve/cve-2025-13632/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13632/ LogicError in DevTools /cve/cve-2025-13633/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13633/ UAF in Digital Credentials /cve/cve-2025-13634/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13634/ LogicError in Downloads /cve/cve-2025-13635/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13635/ LogicError in Downloads /cve/cve-2025-13636/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13636/ LogicError in Split View /cve/cve-2025-13637/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13637/ LogicError in Downloads /cve/cve-2025-13638/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13638/ UAF in Media Stream /cve/cve-2025-13639/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13639/ LogicError in WebRTC /cve/cve-2025-13640/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13640/ LogicError in Passwords /cve/cve-2025-13720/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13720/ LogicError in Loader /cve/cve-2025-13721/ Tue, 02 Dec 2025 00:00:00 +0000 /cve/cve-2025-13721/ Race in V8 /cve/cve-2025-13223/ Mon, 17 Nov 2025 00:00:00 +0000 /cve/cve-2025-13223/ TypeConfusion in V8 /cve/cve-2025-13224/ Mon, 17 Nov 2025 00:00:00 +0000 /cve/cve-2025-13224/ TypeConfusion in V8 /cve/cve-2025-13012/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13012/ Race in Graphics /cve/cve-2025-13013/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13013/ LogicError in Networking /cve/cve-2025-13014/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13014/ UAF in Graphics /cve/cve-2025-13015/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13015/ LogicError in Core /cve/cve-2025-13016/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13016/ LogicError in SpiderMonkey /cve/cve-2025-13017/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13017/ CrossOrigin in DOM /cve/cve-2025-13018/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13018/ LogicError in DOM /cve/cve-2025-13019/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13019/ CrossOrigin in DOM /cve/cve-2025-13020/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13020/ UAF in DOM /cve/cve-2025-13021/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13021/ LogicError in Core /cve/cve-2025-13022/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13022/ LogicError in Core /cve/cve-2025-13023/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13023/ SandboxEscape in DOM /cve/cve-2025-13024/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13024/ LogicError in SpiderMonkey /cve/cve-2025-13025/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13025/ LogicError in DOM /cve/cve-2025-13026/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13026/ SandboxEscape in DOM /cve/cve-2025-13027/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13027/ MemoryCorruption in SpiderMonkey /cve/cve-2025-13042/ Tue, 11 Nov 2025 00:00:00 +0000 /cve/cve-2025-13042/ LogicError in V8 /cve/cve-2025-12725/ Wed, 05 Nov 2025 00:00:00 +0000 /cve/cve-2025-12725/ OOB in WebGPU /cve/cve-2025-12726/ Wed, 05 Nov 2025 00:00:00 +0000 /cve/cve-2025-12726/ LogicError in Views /cve/cve-2025-12727/ Wed, 05 Nov 2025 00:00:00 +0000 /cve/cve-2025-12727/ LogicError in V8 /cve/cve-2025-12728/ Wed, 05 Nov 2025 00:00:00 +0000 /cve/cve-2025-12728/ LogicError in Omnibox /cve/cve-2025-12729/ Wed, 05 Nov 2025 00:00:00 +0000 /cve/cve-2025-12729/ LogicError in Omnibox /cve/cve-2025-43511/ Wed, 05 Nov 2025 00:00:00 +0000 /cve/cve-2025-43511/ UAF in WebCore /cve/cve-2025-43392/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43392/ CrossOrigin in WebCore /cve/cve-2025-43421/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43421/ OOB in JSC /cve/cve-2025-43425/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43425/ LogicError in JSC /cve/cve-2025-43427/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43427/ OOB in JSC /cve/cve-2025-43429/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43429/ IntegerOverflow in JSC /cve/cve-2025-43430/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43430/ LogicError in JSC /cve/cve-2025-43431/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43431/ UAF in JSC /cve/cve-2025-43432/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43432/ UAF in JSC /cve/cve-2025-43433/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43433/ LogicError in WebKit /cve/cve-2025-43434/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43434/ UAF in JSC /cve/cve-2025-43435/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43435/ UAF in WebCore /cve/cve-2025-43438/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43438/ TypeConfusion in JSC /cve/cve-2025-43440/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43440/ LogicError in JSC /cve/cve-2025-43441/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43441/ LogicError in JSC /cve/cve-2025-43443/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43443/ LogicError in WebKit /cve/cve-2025-43457/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43457/ UAF in JSC /cve/cve-2025-43458/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43458/ LogicError in WebKit /cve/cve-2025-43480/ Mon, 03 Nov 2025 00:00:00 +0000 /cve/cve-2025-43480/ CrossOrigin in WebCore /cve/cve-2025-12036/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12036/ LogicError in V8 /cve/cve-2025-12380/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12380/ UAF in DOM /cve/cve-2025-12428/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12428/ TypeConfusion in V8 /cve/cve-2025-12429/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12429/ LogicError in V8 /cve/cve-2025-12430/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12430/ LogicError in Media /cve/cve-2025-12431/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12431/ LogicError in Extensions /cve/cve-2025-12432/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12432/ Race in V8 /cve/cve-2025-12433/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12433/ LogicError in V8 /cve/cve-2025-12434/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12434/ Race in Storage /cve/cve-2025-12435/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12435/ LogicError in Omnibox /cve/cve-2025-12436/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12436/ LogicError in Extensions /cve/cve-2025-12437/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12437/ UAF in PageInfo /cve/cve-2025-12438/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12438/ UAF in Ozone /cve/cve-2025-12439/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12439/ LogicError in App-Bound Encryptio /cve/cve-2025-12440/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12440/ LogicError in Autofill /cve/cve-2025-12441/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12441/ OOB in V8 /cve/cve-2025-12443/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12443/ OOB in WebXR /cve/cve-2025-12444/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12444/ LogicError in Fullscreen UI /cve/cve-2025-12445/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12445/ LogicError in Extensions /cve/cve-2025-12446/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12446/ LogicError in SplitView /cve/cve-2025-12447/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-12447/ LogicError in Omnibox /cve/cve-2025-13226/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-13226/ TypeConfusion in V8 /cve/cve-2025-13227/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-13227/ TypeConfusion in V8 /cve/cve-2025-13228/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-13228/ TypeConfusion in V8 /cve/cve-2025-13229/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-13229/ TypeConfusion in V8 /cve/cve-2025-13230/ Tue, 28 Oct 2025 00:00:00 +0000 /cve/cve-2025-13230/ TypeConfusion in V8 /cve/cve-2025-11708/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11708/ UAF in DOM /cve/cve-2025-11709/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11709/ OOB in DOM /cve/cve-2025-11710/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11710/ LogicError in DOM /cve/cve-2025-11711/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11711/ LogicError in SpiderMonkey /cve/cve-2025-11712/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11712/ LogicError in DOM /cve/cve-2025-11713/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11713/ LogicError in Core /cve/cve-2025-11714/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11714/ MemoryCorruption in Core /cve/cve-2025-11715/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11715/ MemoryCorruption in DOM /cve/cve-2025-11716/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11716/ SandboxEscape in Networking /cve/cve-2025-11717/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11717/ LogicError in Core /cve/cve-2025-11718/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11718/ LogicError in Core /cve/cve-2025-11719/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11719/ UAF in Toolkit /cve/cve-2025-11720/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11720/ LogicError in Core /cve/cve-2025-11721/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11721/ MemoryCorruption in Toolkit /cve/cve-2025-11756/ Tue, 14 Oct 2025 00:00:00 +0000 /cve/cve-2025-11756/ UAF in Safe Browsing /cve/cve-2025-11211/ Tue, 07 Oct 2025 00:00:00 +0000 /cve/cve-2025-11211/ OOB in Media /cve/cve-2025-11458/ Tue, 07 Oct 2025 00:00:00 +0000 /cve/cve-2025-11458/ OOB in Sync /cve/cve-2025-11460/ Tue, 07 Oct 2025 00:00:00 +0000 /cve/cve-2025-11460/ UAF in Storage /cve/cve-2025-11152/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11152/ IntegerOverflow in DOM /cve/cve-2025-11153/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11153/ LogicError in SpiderMonkey /cve/cve-2025-11205/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11205/ OOB in WebGPU /cve/cve-2025-11206/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11206/ OOB in Video /cve/cve-2025-11207/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11207/ LogicError in Storage /cve/cve-2025-11208/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11208/ LogicError in Media /cve/cve-2025-11209/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11209/ LogicError in Omnibox /cve/cve-2025-11210/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11210/ LogicError in Tab /cve/cve-2025-11212/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11212/ LogicError in Media /cve/cve-2025-11213/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11213/ LogicError in Omnibox /cve/cve-2025-11215/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11215/ LogicError in V8 /cve/cve-2025-11216/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11216/ LogicError in Storage /cve/cve-2025-11219/ Tue, 30 Sep 2025 00:00:00 +0000 /cve/cve-2025-11219/ UAF in V8 /cve/cve-2025-10890/ Tue, 23 Sep 2025 00:00:00 +0000 /cve/cve-2025-10890/ LogicError in V8 /cve/cve-2025-10891/ Tue, 23 Sep 2025 00:00:00 +0000 /cve/cve-2025-10891/ IntegerOverflow in V8 /cve/cve-2025-10892/ Tue, 23 Sep 2025 00:00:00 +0000 /cve/cve-2025-10892/ IntegerOverflow in V8 /cve/cve-2025-10500/ Wed, 17 Sep 2025 00:00:00 +0000 /cve/cve-2025-10500/ UAF in Daw /cve/cve-2025-10501/ Wed, 17 Sep 2025 00:00:00 +0000 /cve/cve-2025-10501/ UAF in WebRTC /cve/cve-2025-10502/ Wed, 17 Sep 2025 00:00:00 +0000 /cve/cve-2025-10502/ OOB in ANGLE /cve/cve-2025-10585/ Wed, 17 Sep 2025 00:00:00 +0000 /cve/cve-2025-10585/ TypeConfusion in V8 /cve/cve-2025-10527/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10527/ UAF in Graphics /cve/cve-2025-10528/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10528/ SandboxEscape in Graphics /cve/cve-2025-10529/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10529/ CrossOrigin in DOM /cve/cve-2025-10530/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10530/ LogicError in Core /cve/cve-2025-10531/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10531/ LogicError in Core /cve/cve-2025-10532/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10532/ LogicError in SpiderMonkey /cve/cve-2025-10533/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10533/ IntegerOverflow in Graphics /cve/cve-2025-10534/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10534/ LogicError in Core /cve/cve-2025-10535/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10535/ LogicError in Core /cve/cve-2025-10536/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10536/ LogicError in Networking /cve/cve-2025-10537/ Tue, 16 Sep 2025 00:00:00 +0000 /cve/cve-2025-10537/ MemoryCorruption in DOM /cve/cve-2025-43272/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43272/ OOB in WebCore /cve/cve-2025-43342/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43342/ TypeConfusion in JSC /cve/cve-2025-43343/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43343/ TypeConfusion in JSC /cve/cve-2025-43356/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43356/ LogicError in WebKit /cve/cve-2025-43368/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43368/ UAF in WebKit /cve/cve-2025-43376/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43376/ LogicError in WebCore /cve/cve-2025-43419/ Mon, 15 Sep 2025 00:00:00 +0000 /cve/cve-2025-43419/ Other in WebKit /cve/cve-2025-10200/ Tue, 09 Sep 2025 00:00:00 +0000 /cve/cve-2025-10200/ UAF in Serviceworker /cve/cve-2025-10201/ Tue, 09 Sep 2025 00:00:00 +0000 /cve/cve-2025-10201/ LogicError in Mojo /cve/cve-2025-12905/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12905/ LogicError in Downloads /cve/cve-2025-12906/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12906/ LogicError in Permissions /cve/cve-2025-12907/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12907/ LogicError in Devtools /cve/cve-2025-12908/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12908/ LogicError in Downloads /cve/cve-2025-12909/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12909/ LogicError in Devtools /cve/cve-2025-12910/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12910/ LogicError in Passkeys /cve/cve-2025-12911/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-12911/ LogicError in Permissions /cve/cve-2025-13107/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-13107/ LogicError in Compositing /cve/cve-2025-9865/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-9865/ LogicError in Toolbar /cve/cve-2025-9866/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-9866/ LogicError in Extensions /cve/cve-2025-9867/ Tue, 02 Sep 2025 00:00:00 +0000 /cve/cve-2025-9867/ LogicError in Downloads /cve/cve-2025-9478/ Tue, 26 Aug 2025 00:00:00 +0000 /cve/cve-2025-9478/ UAF in ANGLE /cve/cve-2025-9132/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9132/ OOB in V8 /cve/cve-2025-9179/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9179/ MemoryCorruption in DOM /cve/cve-2025-9180/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9180/ CrossOrigin in DOM /cve/cve-2025-9181/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9181/ UninitializedMemory in SpiderMonkey /cve/cve-2025-9182/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9182/ LogicError in Graphics /cve/cve-2025-9183/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9183/ LogicError in Core /cve/cve-2025-9184/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9184/ MemoryCorruption in Core /cve/cve-2025-9185/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9185/ MemoryCorruption in SpiderMonkey /cve/cve-2025-9186/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9186/ LogicError in Core /cve/cve-2025-9187/ Tue, 19 Aug 2025 00:00:00 +0000 /cve/cve-2025-9187/ MemoryCorruption in SpiderMonkey /cve/cve-2025-8879/ Tue, 12 Aug 2025 00:00:00 +0000 /cve/cve-2025-8879/ OOB in Chromium /cve/cve-2025-8880/ Tue, 12 Aug 2025 00:00:00 +0000 /cve/cve-2025-8880/ Race in V8 /cve/cve-2025-8881/ Tue, 12 Aug 2025 00:00:00 +0000 /cve/cve-2025-8881/ LogicError in File Picker /cve/cve-2025-8882/ Tue, 12 Aug 2025 00:00:00 +0000 /cve/cve-2025-8882/ UAF in Aura /cve/cve-2025-8901/ Tue, 12 Aug 2025 00:00:00 +0000 /cve/cve-2025-8901/ OOB in ANGLE /cve/cve-2025-13992/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-13992/ LogicError in Navigation and Loading /cve/cve-2025-8576/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8576/ UAF in Extensions /cve/cve-2025-8577/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8577/ LogicError in Picture In Picture /cve/cve-2025-8578/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8578/ UAF in Cast /cve/cve-2025-8579/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8579/ LogicError in Gemini Live in Chrome /cve/cve-2025-8580/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8580/ LogicError in Filesystems /cve/cve-2025-8581/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8581/ LogicError in Extensions /cve/cve-2025-8582/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8582/ LogicError in DOM /cve/cve-2025-8583/ Tue, 05 Aug 2025 00:00:00 +0000 /cve/cve-2025-8583/ LogicError in Permissions /cve/cve-2025-31273/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-31273/ OOB in JSC /cve/cve-2025-31277/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-31277/ TypeConfusion in JSC /cve/cve-2025-31278/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-31278/ TypeConfusion in JSC /cve/cve-2025-43211/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43211/ LogicError in JSC /cve/cve-2025-43212/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43212/ LogicError in JSC /cve/cve-2025-43213/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43213/ LogicError in JSC /cve/cve-2025-43214/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43214/ IntegerOverflow in JSC /cve/cve-2025-43216/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43216/ UAF in WebCore /cve/cve-2025-43227/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43227/ Bypass in WTF /cve/cve-2025-43228/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43228/ Bypass in WebKit /cve/cve-2025-43229/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43229/ CrossOrigin in WebKit /cve/cve-2025-43240/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43240/ CrossOrigin in WebKit /cve/cve-2025-43265/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-43265/ OOB in JSC /cve/cve-2025-8292/ Tue, 29 Jul 2025 00:00:00 +0000 /cve/cve-2025-8292/ UAF in Media Stream /cve/cve-2025-8010/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8010/ TypeConfusion in V8 /cve/cve-2025-8011/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8011/ TypeConfusion in V8 /cve/cve-2025-8027/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8027/ LogicError in SpiderMonkey /cve/cve-2025-8028/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8028/ LogicError in SpiderMonkey /cve/cve-2025-8029/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8029/ LogicError in DOM /cve/cve-2025-8030/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8030/ LogicError in Core /cve/cve-2025-8031/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8031/ LogicError in DOM /cve/cve-2025-8032/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8032/ LogicError in DOM /cve/cve-2025-8033/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8033/ LogicError in SpiderMonkey /cve/cve-2025-8034/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8034/ MemoryCorruption in Graphics /cve/cve-2025-8035/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8035/ MemoryCorruption in DOM /cve/cve-2025-8036/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8036/ CrossOrigin in Networking /cve/cve-2025-8037/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8037/ LogicError in Networking /cve/cve-2025-8038/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8038/ LogicError in Core /cve/cve-2025-8039/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8039/ LogicError in Core /cve/cve-2025-8040/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8040/ MemoryCorruption in Core /cve/cve-2025-8041/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8041/ LogicError in Core /cve/cve-2025-8042/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8042/ SandboxEscape in DOM /cve/cve-2025-8043/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8043/ LogicError in Core /cve/cve-2025-8044/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8044/ MemoryCorruption in DOM /cve/cve-2025-8364/ Tue, 22 Jul 2025 00:00:00 +0000 /cve/cve-2025-8364/ LogicError in Core /cve/cve-2025-6558/ Tue, 15 Jul 2025 00:00:00 +0000 /cve/cve-2025-6558/ LogicError in ANGLE and GPU /cve/cve-2025-7656/ Tue, 15 Jul 2025 00:00:00 +0000 /cve/cve-2025-7656/ IntegerOverflow in V8 /cve/cve-2025-7657/ Tue, 15 Jul 2025 00:00:00 +0000 /cve/cve-2025-7657/ UAF in WebRTC /cve/cve-2025-6554/ Mon, 30 Jun 2025 00:00:00 +0000 /cve/cve-2025-6554/ TypeConfusion in V8 /cve/cve-2025-6424/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6424/ UAF in Layout /cve/cve-2025-6425/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6425/ LogicError in Toolkit /cve/cve-2025-6426/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6426/ LogicError in Toolkit /cve/cve-2025-6427/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6427/ LogicError in Networking /cve/cve-2025-6428/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6428/ LogicError in Core /cve/cve-2025-6429/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6429/ LogicError in DOM /cve/cve-2025-6430/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6430/ LogicError in DOM /cve/cve-2025-6431/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6431/ LogicError in Core /cve/cve-2025-6432/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6432/ LogicError in Networking /cve/cve-2025-6433/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6433/ LogicError in DOM /cve/cve-2025-6434/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6434/ LogicError in DOM /cve/cve-2025-6435/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6435/ LogicError in Core /cve/cve-2025-6436/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6436/ MemoryCorruption in Widget /cve/cve-2025-6555/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6555/ UAF in Animatio /cve/cve-2025-6556/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6556/ LogicError in Loader /cve/cve-2025-6557/ Tue, 24 Jun 2025 00:00:00 +0000 /cve/cve-2025-6557/ LogicError in DevTools /cve/cve-2025-6191/ Tue, 17 Jun 2025 00:00:00 +0000 /cve/cve-2025-6191/ IntegerOverflow in V8 /cve/cve-2025-6192/ Tue, 17 Jun 2025 00:00:00 +0000 /cve/cve-2025-6192/ UAF in Profiler /cve/cve-2025-49709/ Tue, 10 Jun 2025 00:00:00 +0000 /cve/cve-2025-49709/ MemoryCorruption in DOM /cve/cve-2025-49710/ Tue, 10 Jun 2025 00:00:00 +0000 /cve/cve-2025-49710/ IntegerOverflow in SpiderMonkey /cve/cve-2025-5958/ Tue, 10 Jun 2025 00:00:00 +0000 /cve/cve-2025-5958/ UAF in Media /cve/cve-2025-5959/ Tue, 10 Jun 2025 00:00:00 +0000 /cve/cve-2025-5959/ TypeConfusion in V8 /cve/cve-2025-5068/ Mon, 02 Jun 2025 00:00:00 +0000 /cve/cve-2025-5068/ UAF in Blink /cve/cve-2025-5419/ Mon, 02 Jun 2025 00:00:00 +0000 /cve/cve-2025-5419/ OOB in V8 /cve/cve-2025-5063/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5063/ UAF in Compositing /cve/cve-2025-5064/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5064/ LogicError in Background Fetch API /cve/cve-2025-5065/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5065/ LogicError in FileSystemAccess API /cve/cve-2025-5066/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5066/ LogicError in Messages /cve/cve-2025-5067/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5067/ LogicError in Tab Strip /cve/cve-2025-5263/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5263/ CrossOrigin in Core /cve/cve-2025-5264/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5264/ LogicError in Core /cve/cve-2025-5265/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5265/ LogicError in Core /cve/cve-2025-5266/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5266/ CrossOrigin in Networking /cve/cve-2025-5267/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5267/ LogicError in Toolkit /cve/cve-2025-5268/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5268/ MemoryCorruption in Networking /cve/cve-2025-5270/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5270/ LogicError in Networking /cve/cve-2025-5271/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5271/ LogicError in DOM /cve/cve-2025-5272/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5272/ MemoryCorruption in Core /cve/cve-2025-5280/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5280/ OOB in V8 /cve/cve-2025-5281/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5281/ LogicError in BFCache /cve/cve-2025-5283/ Tue, 27 May 2025 00:00:00 +0000 /cve/cve-2025-5283/ MemoryCorruption in Media /cve/cve-2025-4918/ Sat, 17 May 2025 00:00:00 +0000 /cve/cve-2025-4918/ OOB in SpiderMonkey /cve/cve-2025-4919/ Sat, 17 May 2025 00:00:00 +0000 /cve/cve-2025-4919/ OOB in SpiderMonkey /cve/cve-2025-4609/ Wed, 14 May 2025 00:00:00 +0000 /cve/cve-2025-4609/ LogicError in Mojo /cve/cve-2025-4664/ Wed, 14 May 2025 00:00:00 +0000 /cve/cve-2025-4664/ LogicError in Chromium /cve/cve-2025-24213/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-24213/ TypeConfusion in WebCore /cve/cve-2025-24223/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-24223/ LogicError in WebKit /cve/cve-2025-31204/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31204/ OOB in JSC /cve/cve-2025-31205/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31205/ CrossOrigin in WebCore /cve/cve-2025-31206/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31206/ TypeConfusion in JSC /cve/cve-2025-31215/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31215/ TypeConfusion in JSC /cve/cve-2025-31217/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31217/ OOB in WebKit /cve/cve-2025-31223/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31223/ IntegerOverflow in JSC /cve/cve-2025-31238/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31238/ UAF in WebCore /cve/cve-2025-31257/ Mon, 12 May 2025 00:00:00 +0000 /cve/cve-2025-31257/ UAF in WebCore /cve/cve-2025-4372/ Tue, 06 May 2025 00:00:00 +0000 /cve/cve-2025-4372/ UAF in WebAudio /cve/cve-2024-13983/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2024-13983/ LogicError in Lens /cve/cve-2025-13097/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-13097/ LogicError in DevTools /cve/cve-2025-2817/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-2817/ LogicError in Toolkit /cve/cve-2025-4050/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4050/ OOB in DevTools /cve/cve-2025-4051/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4051/ LogicError in DevTools /cve/cve-2025-4052/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4052/ LogicError in DevTools /cve/cve-2025-4082/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4082/ OOB in DOM /cve/cve-2025-4083/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4083/ SandboxEscape in Core /cve/cve-2025-4085/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4085/ LogicError in DOM /cve/cve-2025-4086/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4086/ LogicError in Core /cve/cve-2025-4087/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4087/ OOB in DOM /cve/cve-2025-4088/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4088/ CrossOrigin in Core /cve/cve-2025-4089/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4089/ LogicError in Core /cve/cve-2025-4090/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4090/ LogicError in Core /cve/cve-2025-4091/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4091/ MemoryCorruption in Core /cve/cve-2025-4092/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4092/ MemoryCorruption in Widget /cve/cve-2025-4096/ Tue, 29 Apr 2025 00:00:00 +0000 /cve/cve-2025-4096/ OOB in HTML /cve/cve-2025-3608/ Tue, 15 Apr 2025 00:00:00 +0000 /cve/cve-2025-3608/ Race in Networking /cve/cve-2025-3619/ Tue, 15 Apr 2025 00:00:00 +0000 /cve/cve-2025-3619/ OOB in Codecs /cve/cve-2025-3620/ Tue, 15 Apr 2025 00:00:00 +0000 /cve/cve-2025-3620/ UAF in USB /cve/cve-2025-3066/ Tue, 08 Apr 2025 00:00:00 +0000 /cve/cve-2025-3066/ UAF in Site Isolatio /cve/cve-2025-3028/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3028/ UAF in DOM /cve/cve-2025-3029/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3029/ LogicError in Core /cve/cve-2025-3030/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3030/ MemoryCorruption in DOM /cve/cve-2025-3031/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3031/ LogicError in SpiderMonkey /cve/cve-2025-3032/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3032/ LogicError in Security/NSS /cve/cve-2025-3033/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3033/ LogicError in Widget /cve/cve-2025-3034/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3034/ MemoryCorruption in Core /cve/cve-2025-3035/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3035/ LogicError in Core /cve/cve-2025-3067/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3067/ LogicError in Custom Tabs /cve/cve-2025-3068/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3068/ LogicError in Intents /cve/cve-2025-3069/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3069/ LogicError in Extensions /cve/cve-2025-3070/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3070/ LogicError in Extensions /cve/cve-2025-3071/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3071/ LogicError in Navigations /cve/cve-2025-3072/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3072/ LogicError in Custom Tabs /cve/cve-2025-3073/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3073/ LogicError in Autofill /cve/cve-2025-3074/ Tue, 01 Apr 2025 00:00:00 +0000 /cve/cve-2025-3074/ LogicError in Downloads /cve/cve-2025-24208/ Mon, 31 Mar 2025 00:00:00 +0000 /cve/cve-2025-24208/ CrossOrigin in WebKit /cve/cve-2025-24209/ Mon, 31 Mar 2025 00:00:00 +0000 /cve/cve-2025-24209/ OOB in WebCore /cve/cve-2025-24216/ Mon, 31 Mar 2025 00:00:00 +0000 /cve/cve-2025-24216/ UAF in WebCore /cve/cve-2025-24264/ Mon, 31 Mar 2025 00:00:00 +0000 /cve/cve-2025-24264/ LogicError in WebKit /cve/cve-2025-30425/ Mon, 31 Mar 2025 00:00:00 +0000 /cve/cve-2025-30425/ LogicError in WebCore /cve/cve-2025-30427/ Mon, 31 Mar 2025 00:00:00 +0000 /cve/cve-2025-30427/ UAF in JSC /cve/cve-2025-2857/ Thu, 27 Mar 2025 00:00:00 +0000 /cve/cve-2025-2857/ SandboxEscape in IPC /cve/cve-2025-2476/ Wed, 19 Mar 2025 00:00:00 +0000 /cve/cve-2025-2476/ UAF in Lens /cve/cve-2025-24201/ Tue, 11 Mar 2025 00:00:00 +0000 /cve/cve-2025-24201/ OOB in WebKit /cve/cve-2025-1920/ Mon, 10 Mar 2025 00:00:00 +0000 /cve/cve-2025-1920/ TypeConfusion in V8 /cve/cve-2025-2135/ Mon, 10 Mar 2025 00:00:00 +0000 /cve/cve-2025-2135/ TypeConfusion in V8 /cve/cve-2025-2136/ Mon, 10 Mar 2025 00:00:00 +0000 /cve/cve-2025-2136/ UAF in Inspector /cve/cve-2025-2137/ Mon, 10 Mar 2025 00:00:00 +0000 /cve/cve-2025-2137/ OOB in V8 /cve/cve-2024-9956/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2024-9956/ LogicError in Core /cve/cve-2025-13102/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-13102/ LogicError in WebApp Installs /cve/cve-2025-1914/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1914/ OOB in V8 /cve/cve-2025-1915/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1915/ LogicError in DevTools /cve/cve-2025-1916/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1916/ UAF in Profiles /cve/cve-2025-1917/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1917/ LogicError in Browser UI /cve/cve-2025-1918/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1918/ OOB in PDFium /cve/cve-2025-1919/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1919/ OOB in Media /cve/cve-2025-1921/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1921/ LogicError in Media Stream /cve/cve-2025-1922/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1922/ LogicError in Selectio /cve/cve-2025-1923/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1923/ LogicError in Permission Prompts /cve/cve-2025-1930/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1930/ UAF in Core /cve/cve-2025-1931/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1931/ UAF in DOM /cve/cve-2025-1932/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1932/ OOB in DOM /cve/cve-2025-1933/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1933/ LogicError in SpiderMonkey /cve/cve-2025-1934/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1934/ LogicError in SpiderMonkey /cve/cve-2025-1935/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1935/ LogicError in Toolkit /cve/cve-2025-1936/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1936/ LogicError in SpiderMonkey /cve/cve-2025-1937/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1937/ MemoryCorruption in DOM /cve/cve-2025-1938/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1938/ MemoryCorruption in DOM /cve/cve-2025-1939/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1939/ LogicError in Core /cve/cve-2025-1940/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1940/ LogicError in Core /cve/cve-2025-1941/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1941/ LogicError in Core /cve/cve-2025-1942/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1942/ UninitializedMemory in SpiderMonkey /cve/cve-2025-1943/ Tue, 04 Mar 2025 00:00:00 +0000 /cve/cve-2025-1943/ MemoryCorruption in DOM /cve/cve-2025-1414/ Tue, 18 Feb 2025 00:00:00 +0000 /cve/cve-2025-1414/ MemoryCorruption in DOM /cve/cve-2025-1009/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1009/ UAF in DOM /cve/cve-2025-1010/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1010/ UAF in DOM /cve/cve-2025-1011/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1011/ LogicError in SpiderMonkey /cve/cve-2025-1012/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1012/ UAF in SpiderMonkey /cve/cve-2025-1013/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1013/ Race in DOM /cve/cve-2025-1014/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1014/ LogicError in Security/NSS /cve/cve-2025-1016/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1016/ MemoryCorruption in Graphics /cve/cve-2025-1017/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1017/ MemoryCorruption in Core /cve/cve-2025-1018/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1018/ LogicError in Core /cve/cve-2025-1019/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1019/ LogicError in Widget /cve/cve-2025-1020/ Tue, 04 Feb 2025 00:00:00 +0000 /cve/cve-2025-1020/ MemoryCorruption in Widget /cve/cve-2025-0762/ Tue, 28 Jan 2025 00:00:00 +0000 /cve/cve-2025-0762/ UAF in DevTools /cve/cve-2025-24143/ Mon, 27 Jan 2025 00:00:00 +0000 /cve/cve-2025-24143/ LogicError in WebKit /cve/cve-2025-24150/ Mon, 27 Jan 2025 00:00:00 +0000 /cve/cve-2025-24150/ LogicError in WebKit /cve/cve-2025-24158/ Mon, 27 Jan 2025 00:00:00 +0000 /cve/cve-2025-24158/ LogicError in WebKit /cve/cve-2025-24162/ Mon, 27 Jan 2025 00:00:00 +0000 /cve/cve-2025-24162/ LogicError in WebKit /cve/cve-2025-24189/ Mon, 27 Jan 2025 00:00:00 +0000 /cve/cve-2025-24189/ OOB in WebKit /cve/cve-2025-0611/ Wed, 22 Jan 2025 00:00:00 +0000 /cve/cve-2025-0611/ LogicError in V8 /cve/cve-2025-0612/ Wed, 22 Jan 2025 00:00:00 +0000 /cve/cve-2025-0612/ OOB in V8 /cve/cve-2025-0434/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0434/ OOB in V8 /cve/cve-2025-0435/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0435/ LogicError in Navigatio /cve/cve-2025-0436/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0436/ IntegerOverflow in Skia /cve/cve-2025-0437/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0437/ OOB in Metrics /cve/cve-2025-0438/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0438/ OOB in Tracing /cve/cve-2025-0439/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0439/ Race in Frames /cve/cve-2025-0440/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0440/ LogicError in Fullscree /cve/cve-2025-0441/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0441/ LogicError in Fenced Frames /cve/cve-2025-0442/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0442/ LogicError in Payments /cve/cve-2025-0443/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0443/ LogicError in Extensions /cve/cve-2025-0446/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0446/ LogicError in Extensions /cve/cve-2025-0447/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0447/ LogicError in Navigatio /cve/cve-2025-0448/ Tue, 14 Jan 2025 00:00:00 +0000 /cve/cve-2025-0448/ LogicError in Compositing /cve/cve-2024-43097/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2024-43097/ OOB in Core /cve/cve-2025-0237/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0237/ LogicError in Toolkit /cve/cve-2025-0238/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0238/ UAF in DOM /cve/cve-2025-0239/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0239/ LogicError in Networking /cve/cve-2025-0240/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0240/ UAF in SpiderMonkey /cve/cve-2025-0241/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0241/ LogicError in SpiderMonkey /cve/cve-2025-0242/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0242/ MemoryCorruption in ImageLib /cve/cve-2025-0243/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0243/ MemoryCorruption in DOM /cve/cve-2025-0244/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0244/ LogicError in Core /cve/cve-2025-0245/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0245/ LogicError in Core /cve/cve-2025-0246/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0246/ LogicError in Core /cve/cve-2025-0247/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0247/ MemoryCorruption in Security/NSS /cve/cve-2025-0291/ Tue, 07 Jan 2025 00:00:00 +0000 /cve/cve-2025-0291/ TypeConfusion in V8 /cve/cve-2024-12692/ Wed, 18 Dec 2024 00:00:00 +0000 /cve/cve-2024-12692/ TypeConfusion in V8 /cve/cve-2024-12693/ Wed, 18 Dec 2024 00:00:00 +0000 /cve/cve-2024-12693/ OOB in V8 /cve/cve-2024-12694/ Wed, 18 Dec 2024 00:00:00 +0000 /cve/cve-2024-12694/ UAF in Compositing /cve/cve-2024-12695/ Wed, 18 Dec 2024 00:00:00 +0000 /cve/cve-2024-12695/ OOB in V8 /cve/cve-2024-54479/ Wed, 11 Dec 2024 00:00:00 +0000 /cve/cve-2024-54479/ TypeConfusion in WebKit /cve/cve-2024-54502/ Wed, 11 Dec 2024 00:00:00 +0000 /cve/cve-2024-54502/ UAF in WebKit /cve/cve-2024-54505/ Wed, 11 Dec 2024 00:00:00 +0000 /cve/cve-2024-54505/ TypeConfusion in JSC /cve/cve-2024-54508/ Wed, 11 Dec 2024 00:00:00 +0000 /cve/cve-2024-54508/ TypeConfusion in WebKit /cve/cve-2024-54534/ Wed, 11 Dec 2024 00:00:00 +0000 /cve/cve-2024-54534/ UAF in WebKit /cve/cve-2024-54543/ Wed, 11 Dec 2024 00:00:00 +0000 /cve/cve-2024-54543/ OOB in WebKit /cve/cve-2024-12381/ Tue, 10 Dec 2024 00:00:00 +0000 /cve/cve-2024-12381/ TypeConfusion in V8 /cve/cve-2024-12382/ Tue, 10 Dec 2024 00:00:00 +0000 /cve/cve-2024-12382/ UAF in Translate /cve/cve-2024-12053/ Tue, 03 Dec 2024 00:00:00 +0000 /cve/cve-2024-12053/ TypeConfusion in V8 /cve/cve-2024-11691/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11691/ OOB in DOM /cve/cve-2024-11692/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11692/ LogicError in Layout /cve/cve-2024-11693/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11693/ LogicError in Toolkit /cve/cve-2024-11694/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11694/ LogicError in Core /cve/cve-2024-11695/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11695/ LogicError in Core /cve/cve-2024-11696/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11696/ LogicError in Toolkit /cve/cve-2024-11697/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11697/ LogicError in Toolkit /cve/cve-2024-11698/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11698/ LogicError in Widget /cve/cve-2024-11699/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11699/ MemoryCorruption in Widget /cve/cve-2024-11700/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11700/ LogicError in Core /cve/cve-2024-11701/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11701/ LogicError in Core /cve/cve-2024-11702/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11702/ LogicError in Core /cve/cve-2024-11703/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11703/ LogicError in Core /cve/cve-2024-11704/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11704/ MemoryCorruption in Core /cve/cve-2024-11705/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11705/ LogicError in Core /cve/cve-2024-11706/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11706/ LogicError in Core /cve/cve-2024-11708/ Tue, 26 Nov 2024 00:00:00 +0000 /cve/cve-2024-11708/ Race in DOM /cve/cve-2024-44308/ Tue, 19 Nov 2024 00:00:00 +0000 /cve/cve-2024-44308/ OOB in WebKit /cve/cve-2024-44309/ Tue, 19 Nov 2024 00:00:00 +0000 /cve/cve-2024-44309/ CrossOrigin in WebKit /cve/cve-2024-10458/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10458/ LogicError in DOM /cve/cve-2024-10459/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10459/ UAF in Core /cve/cve-2024-10460/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10460/ LogicError in Toolkit /cve/cve-2024-10461/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10461/ LogicError in Networking /cve/cve-2024-10462/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10462/ LogicError in Toolkit /cve/cve-2024-10463/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10463/ LogicError in DOM /cve/cve-2024-10464/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10464/ LogicError in DOM /cve/cve-2024-10465/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10465/ LogicError in Toolkit /cve/cve-2024-10466/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10466/ LogicError in DOM /cve/cve-2024-10467/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10467/ MemoryCorruption in Networking /cve/cve-2024-10468/ Tue, 29 Oct 2024 00:00:00 +0000 /cve/cve-2024-10468/ Race in DOM /cve/cve-2024-44212/ Mon, 28 Oct 2024 00:00:00 +0000 /cve/cve-2024-44212/ CrossOrigin in WebKit /cve/cve-2024-44244/ Mon, 28 Oct 2024 00:00:00 +0000 /cve/cve-2024-44244/ OOB in WebKit /cve/cve-2024-44296/ Mon, 28 Oct 2024 00:00:00 +0000 /cve/cve-2024-44296/ Bypass in WebKit /cve/cve-2024-9936/ Mon, 14 Oct 2024 00:00:00 +0000 /cve/cve-2024-9936/ LogicError in DOM /cve/cve-2024-9680/ Wed, 09 Oct 2024 00:00:00 +0000 /cve/cve-2024-9680/ UAF in DOM /cve/cve-2024-9391/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9391/ LogicError in Core /cve/cve-2024-9392/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9392/ CrossOrigin in DOM /cve/cve-2024-9393/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9393/ CrossOrigin in Toolkit /cve/cve-2024-9394/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9394/ CrossOrigin in Core /cve/cve-2024-9395/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9395/ LogicError in Core /cve/cve-2024-9396/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9396/ MemoryCorruption in SpiderMonkey /cve/cve-2024-9397/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9397/ LogicError in DOM /cve/cve-2024-9398/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9398/ LogicError in Networking /cve/cve-2024-9399/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9399/ LogicError in Networking /cve/cve-2024-9400/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9400/ MemoryCorruption in SpiderMonkey /cve/cve-2024-9401/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9401/ MemoryCorruption in Networking /cve/cve-2024-9402/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9402/ MemoryCorruption in Networking /cve/cve-2024-9403/ Tue, 01 Oct 2024 00:00:00 +0000 /cve/cve-2024-9403/ MemoryCorruption in SpiderMonkey /cve/cve-2024-40857/ Mon, 16 Sep 2024 00:00:00 +0000 /cve/cve-2024-40857/ CrossOrigin in WebKit /cve/cve-2024-40866/ Mon, 16 Sep 2024 00:00:00 +0000 /cve/cve-2024-40866/ LogicError in WebKit /cve/cve-2024-44187/ Mon, 16 Sep 2024 00:00:00 +0000 /cve/cve-2024-44187/ CrossOrigin in WebKit /cve/cve-2024-44192/ Mon, 16 Sep 2024 00:00:00 +0000 /cve/cve-2024-44192/ LogicError in WebKit /cve/cve-2024-54467/ Mon, 16 Sep 2024 00:00:00 +0000 /cve/cve-2024-54467/ CrossOrigin in WebKit /cve/cve-2024-8381/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8381/ TypeConfusion in SpiderMonkey /cve/cve-2024-8382/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8382/ LogicError in SpiderMonkey /cve/cve-2024-8383/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8383/ LogicError in Core /cve/cve-2024-8384/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8384/ MemoryCorruption in SpiderMonkey /cve/cve-2024-8385/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8385/ TypeConfusion in SpiderMonkey /cve/cve-2024-8386/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8386/ LogicError in Core /cve/cve-2024-8387/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8387/ MemoryCorruption in Core /cve/cve-2024-8388/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8388/ LogicError in Core /cve/cve-2024-8389/ Tue, 03 Sep 2024 00:00:00 +0000 /cve/cve-2024-8389/ MemoryCorruption in SpiderMonkey /cve/cve-2024-40776/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40776/ UAF in WebKit /cve/cve-2024-40779/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40779/ OOB in WebKit /cve/cve-2024-40780/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40780/ OOB in WebKit /cve/cve-2024-40782/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40782/ LogicError in WebKit /cve/cve-2024-40785/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40785/ Bypass in WebKit /cve/cve-2024-40789/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40789/ OOB in WebKit /cve/cve-2024-40794/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-40794/ LogicError in WebKit /cve/cve-2024-44185/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-44185/ TypeConfusion in WebKit /cve/cve-2024-44206/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-44206/ LogicError in WebKit /cve/cve-2024-4558/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-4558/ OOB in WebKit /cve/cve-2024-54551/ Mon, 29 Jul 2024 00:00:00 +0000 /cve/cve-2024-54551/ UAF in WebCore /cve/cve-2024-27808/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27808/ UAF in JSC /cve/cve-2024-27820/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27820/ OOB in JSC /cve/cve-2024-27830/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27830/ LogicError in WebCore /cve/cve-2024-27833/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27833/ IntegerOverflow in JSC /cve/cve-2024-27834/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27834/ Bypass in JSC /cve/cve-2024-27838/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27838/ LogicError in WebCore /cve/cve-2024-27850/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27850/ LogicError in WebCore /cve/cve-2024-27851/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27851/ OOB in WebCore /cve/cve-2024-27856/ Mon, 13 May 2024 00:00:00 +0000 /cve/cve-2024-27856/ UAF in WebCore /cve/cve-2024-23263/ Tue, 05 Mar 2024 00:00:00 +0000 /cve/cve-2024-23263/ Bypass in WebCore /cve/cve-2024-23280/ Tue, 05 Mar 2024 00:00:00 +0000 /cve/cve-2024-23280/ LogicError in WebCore /cve/cve-2024-23284/ Tue, 05 Mar 2024 00:00:00 +0000 /cve/cve-2024-23284/ Bypass in WebCore /cve/cve-2024-54658/ Tue, 05 Mar 2024 00:00:00 +0000 /cve/cve-2024-54658/ LogicError in WebCore /cve/cve-2024-23206/ Mon, 22 Jan 2024 00:00:00 +0000 /cve/cve-2024-23206/ Bypass in WebKit /cve/cve-2024-23213/ Mon, 22 Jan 2024 00:00:00 +0000 /cve/cve-2024-23213/ UAF in WebCore /cve/cve-2024-23222/ Mon, 22 Jan 2024 00:00:00 +0000 /cve/cve-2024-23222/ TypeConfusion in JSC /cve/cve-2024-23271/ Mon, 22 Jan 2024 00:00:00 +0000 /cve/cve-2024-23271/ Bypass in WebCore /reports/2026-w21/57e44bb6ce/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/57e44bb6ce/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/2c2b96df94cb454c6e58536b16fead32d4dd1de3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/2c2b96df94cb454c6e58536b16fead32d4dd1de3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Reaching the bug requires only ordinary WebAudio graph teardown (disconnecting nodes / letting a context be collected), which is scriptable from any page, but it is a timing-dependent re-entrancy race that surfaced as a flaky debug crash rather than a deterministically controllable free. The primitive is a use-after-free of an AudioNode during the deferred-deref drain, which is a strong corruption primitive, but the difficulty of shaping the re-entrant mutation and the fact that it manifested as a rare crash keep it at Medium/6.5 rather than High.</p> /reports/2026-w22/0fe9ff8c67/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/0fe9ff8c67/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>An integer-underflow in the ANGLE Metal backend&rsquo;s vertex-count math lets an out-of-bounds vertex attribute offset flow into VertexArrayMtl::setupDraw and crash (or read out-of-bounds GPU-side) when the binding offset exceeds the buffer size. WebGL is a broadly reachable web-exposed surface and the GPU process is a valuable target, so an OOB in vertex processing is high severity. It is scored high rather than critical because the immediate observed effect is a crash / robustness violation on the non-conversion path rather than a demonstrated controlled write.</p> /reports/2026-w21/e558364e9e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/e558364e9e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/55bbd269b7/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/55bbd269b7/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/b32bca6755/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/b32bca6755/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a genuine use-after-free reachable from untrusted CSS parsed at runtime, exercising the CSS :has() JIT compilation path, which historically has been a rich source of WebKit renderer exploits. The regression test crashes deterministically after repeated document reloads, showing the dangling pointers are baked into cached machine code that outlives the originating document&rsquo;s selector data. Because the stale pointers live inside JIT-compiled selector-matching code driven by attacker-controlled selectors, the primitive has strong exploitation potential, warranting the high rating even though the committed artifact only demonstrates a crash.</p> /reports/2026-w23/f7a8a5c0476af3f6349707dad1fd026c80eaf763/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/f7a8a5c0476af3f6349707dad1fd026c80eaf763/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/13d9bbd572/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/13d9bbd572/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/e9a9f1b34e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/e9a9f1b34e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/b5b06c0fc2/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/b5b06c0fc2/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a GPU-process out-of-bounds read caused by trusting an IPC-supplied FEColorMatrix whose values vector length does not match its type. The GPU process handles input from the less-privileged WebContent process, so an OOB read there is a cross-process memory-safety issue that can crash the GPU process or disclose its memory. The PoC uses the IPC testing API to send a SATURATE matrix with an empty values array; because it is a read/crash primitive rather than a demonstrated write, high rather than critical.</p> /reports/2026-w23/bf80e3eedd686c0fe2ecce39b3143e6279a89103/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/bf80e3eedd686c0fe2ecce39b3143e6279a89103/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/32aac5dacfa53cb1d89423f91f2e49e1210a3952/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/32aac5dacfa53cb1d89423f91f2e49e1210a3952/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/bb7ef44f57a19f532be31fbcaef9c02ebdc51fa5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/bb7ef44f57a19f532be31fbcaef9c02ebdc51fa5/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/8af0c2d1ea/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/8af0c2d1ea/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A use-after-close / lifetime race in the GStreamer WebRTC ICE backend: an asynchronous incoming-data callback scheduled during ICE agent configuration can run after the agent has been closed, operating on torn-down agent state. The observed symptom is a flaky Debug crash in webrtc/datachannel/multiple-connections.html; the class is a race on a torn-down object reachable when a peer connection with data channels is closed while ICE activity is in flight. Medium/0.6: real crash and clear closed-state race, but it is in the GStreamer (non-Apple) port and the demonstrated impact is a flaky crash rather than a proven controllable primitive.</p> /reports/2026-w34/884e3169771bfde0f93c3bc3ed12c55144d5cd04/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/884e3169771bfde0f93c3bc3ed12c55144d5cd04/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/917854a9c245b87b333e23ed4b195505d574a333/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/917854a9c245b87b333e23ed4b195505d574a333/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The primary bug is reachable from ordinary web content: a page calls IDBObjectStore.put with an indexed value of -0 into a unique index, which lives in the network/storage process. The hash/equality inconsistency lets a unique index&rsquo;s IndexValueStore HashMap hold two entries that compare equal, so removing one can destroy the other and leave a cursor referencing freed memory — a use-after-free in the network process. High/CVSS 8.1 is appropriate: no user interaction, cross-process memory-corruption surface, though driving the freed entry to a controlled reuse is non-trivial. The patch also hardens two adjacent issues (cursor invalidation on abort, and an unvalidated IPC message).</p> /reports/2026-w23/2757278b899d7543c54534314ddf8d7026ce7349/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/2757278b899d7543c54534314ddf8d7026ce7349/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable purely from untrusted script: any page that registers an implicit-root IntersectionObserver on an element whose owning document is not fully active drives updateObservations into the vulnerable branch. Reaching the freed iterator yields a use-after-free on a ref-counted Element during layout/rendering, giving an attacker a controllable freed-object reuse primitive in the WebContent process. High severity with CVSS 8.1 matches the assigned rating: no user interaction beyond visiting a page, and memory corruption impact, though the trigger window depends on refcount timing.</p> /reports/2026-w21/69d300842d/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/69d300842d/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/c0c27847a6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/c0c27847a6/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/9682d18068ac9fe96d17f82577f5c3afb803355e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/9682d18068ac9fe96d17f82577f5c3afb803355e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/ae69ef2312/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/ae69ef2312/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a DFG JIT soundness bug: on the fast Array-iterator entries path over a Double-storage array, GetByVal (which can OSR-exit) was followed immediately by NewArray (which can OOM/OSR-exit) with no intervening ExitOK, so the Fixup phase inserted a ValueRep conversion ahead of the GetByVal that produced its operand. The observed effect is a VirtualRegisterAllocationPhase crash, but a JIT that misorders value-representation conversions is a classic path toward exploitable miscompilation, so high severity is defensible; the public artifact demonstrates only a crash.</p> /reports/2026-w22/f181acea44/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/f181acea44/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/73689f5430825ecffb614dbcce8e6575dfea3d50/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/73689f5430825ecffb614dbcce8e6575dfea3d50/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from ordinary JavaScript: an attacker script drives a base object into a cacheable-dictionary structure, gets the DFG/FTL to constant-fold a prototype property load, and then shadows that property with an own value that the JIT continues to ignore. It yields a durable value confusion — the optimized code returns the wrong value with no OSR exit — which in the right idiom (e.g. a folded length, prototype method, or guard value) escalates to type confusion and memory corruption. High/8.1 fits a JIT soundness bug that requires a specific structure-shaping sequence but is fully script-reachable and defeats the engine&rsquo;s own invariants.</p> /reports/2026-w23/d58bad697e50a0bda1ff67669bb4cf9e1f78662e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/d58bad697e50a0bda1ff67669bb4cf9e1f78662e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/953bc0380f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/953bc0380f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a DFG JIT soundness bug: a graph transformation (constant-folding PerformPromiseThen into PerformPromiseThenOneHandler) inserted a replacement node without the ExitOK marker that records that OSR exit is legal at that point, leaving the exit state invalid. Missing ExitOK/exit-state invariants are exactly the class of miscompilation that becomes exploitable type confusion when an OSR exit fires with inconsistent state. In this instance it only tripped graph validation (a debug/assertion-level failure) with the note that no value fix-up was needed, which caps its practical severity below the worst OSR-exit corruption bugs but keeps it high as a JIT-correctness defect.</p> /reports/2026-w22/eba64ef44d/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/eba64ef44d/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>An FTL OSR-exit rematerialization used the wrong butterfly/structure when the VM &lsquo;had a bad time&rsquo; between compile and exit, treating an ArrayStorage array as if it had a contiguous butterfly. That is a JIT layout/type-confusion in a JS-reachable path (defining an indexed accessor on Array.prototype forces the bad time), a classic high-severity JS engine bug with a shipped regression test.</p> /reports/2026-w22/a82eb9dd7f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/a82eb9dd7f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A follow-up to the bad-time rematerialization fix: when a sunk double Array is rematerialized after a bad time, an unwritten element arrived as boxed NaN (the double hole default), matched no hole branch, and fell through to putDirectIndex, turning a hole into an own property and bypassing prototype indexed accessors. That is a correctness/soundness bug that lets fast paths (reverse) move raw holes without consulting accessors, a JIT security-relevant miscompile, so high.</p> /reports/2026-w22/8a7e39c2bf/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/8a7e39c2bf/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/958a13ecadda5806cf85cc0b61904b1d6cb6e868/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/958a13ecadda5806cf85cc0b61904b1d6cb6e868/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable whenever a wasm module performs an indirect call whose baseline call-profile slot lives at a large enough byte offset that the immediate no longer fits addPtr&rsquo;s short-form encoding, which an attacker controls by placing many indirect callsites; forcing BBQ tier-up is trivial. The clobbered register is GPRInfo::wasmContextInstancePointer, the pinned pointer to the live Wasm instance, so a corrupted value flowing into the polymorphic-call thunk is a live-register JIT miscompile. The commit message frames the observed effect as merely a lost profiling optimization, but a dedicated context register holding a wrong value crossing into a call thunk is a register-safety defect, hence the LogicError-to-TypeConfusion reclassification and a 7.5 rather than a higher score.</p> /reports/2026-w34/a5fa580c849f0d81096e8650be79392ae1517f59/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/a5fa580c849f0d81096e8650be79392ae1517f59/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>B3&rsquo;s LICM runs for both Wasm (OMG) and JS (FTL) code compiled from untrusted script, so the pass is broadly reachable. The direct hazard is a JIT soundness miscompile: a trapping/side-exiting load moved to a point where it executes when it must not (a never-taken guard) or before a side exit that must observe prior memory state, which for WasmGC struct.get / array.len means a null-check trap can be reordered around and a field read off a non-object - a type confusion / OOB read. The observable in this patch&rsquo;s own tests is a wrong trap outcome rather than a demonstrated arbitrary read, so High / 8.1 reflects a soundness bug with plausible memory-safety consequences rather than a proven primitive.</p> /reports/2026-w25/9a16de46f2/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/9a16de46f2/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A use-after-free in the WebAssembly JIT tiering machinery: a BBQCallee (and, in an edge case, its OMGOSREntryCallee) can be freed by a wasm compiler thread between the moment CalleeGroup::updateCallsitesToCallUs collects callsites and the moment it repatches them, so the repatch operates on freed code objects. Medium reflects that it requires OSR-entry tiering plus adversarial thread timing and that the impact is corruption of JIT callsite patching rather than a demonstrated controlled primitive.</p> /reports/2026-w22/78c04ea7a1/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/78c04ea7a1/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. tryEnsureAbsence in the DFG produces an ObjectPropertyConditionSet that the JIT caches as a proof that a property is absent, enabling aggressive folding (e.g. of property loads and Promise.resolve fast paths). Failing to validate the head (own) object structure means an own property that actually exists can be treated as absent, producing a JIT miscompile / type confusion where later code assumes the wrong shape. High value primitive, backed by a targeted stress test and rdar.</p> /reports/2026-w34/75a9d414a4a8b98d26840162d103eb16227eaeb6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/75a9d414a4a8b98d26840162d103eb16227eaeb6/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The stale-entry-point window is reachable from ordinary web JavaScript: any script that schedules async/await or async-generator microtask resumptions and then causes a full CodeBlock detach (deleteAllCode, triggered by memory pressure, debugger attach, or the internal idle path exercised by the test) leaves the VM&rsquo;s syncResumeCallCache pointing at code that has been detached from its executable. On the next microtask drain the cached entry point is invoked against detached/freed JIT code, yielding a controllable use-after-free that is a strong renderer-RCE primitive; the CVSS 8.1 reflects reliable remote reachability tempered by the need to force a whole-heap code deletion.</p> /reports/2026-w23/21ab50e40f062d97c1d1eb47f5d42e51bc201203/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/21ab50e40f062d97c1d1eb47f5d42e51bc201203/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The race is reachable from ordinary web content: Atomics.waitAsync across a Worker and a cross-origin iframe (as the regression test demonstrates) is enough to register async waiters whose tickets are freed on a different VM&rsquo;s GC/sweep thread. WaiterListManager::unregister runs on one VM&rsquo;s thread and dereferenced ticket-&gt;target()-&gt;realm(), racing another VM freeing the ticket&rsquo;s m_dependencies via cancelAndClear, i.e. a cross-thread data race that becomes a use-after-free read of a freed JSObject. High/CVSS 8.1 is consistent: no user interaction, memory-corruption potential in the WebContent process, but exploitability is gated by thread-timing rather than a deterministic primitive.</p> /reports/2026-w23/544a3bff9b31c9ba947710eac79486e43d053c11/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/544a3bff9b31c9ba947710eac79486e43d053c11/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/32f1bfb841/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/32f1bfb841/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. eval() constructs a DirectEvalCodeCache::CacheLookupKey holding a raw StringImpl* (no ref) taken from the flattened contents of the program string. When the program string is an on-stack rope, rope flattening can free the fiber JSString whose contents that raw pointer references, and a GC/sweep during cache lookup then dereferences freed memory, a use-after-free reachable from ordinary script via direct eval. Backed by a stress test with slowPathAllocsBetweenGCs and rdar.</p> /reports/2026-w22/cdfa73fdc3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/cdfa73fdc3/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/3ddc7045b7c5a9ccb6ef09124c7b8efb93527208/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/3ddc7045b7c5a9ccb6ef09124c7b8efb93527208/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from ordinary JavaScript: any <code>switch</code> whose scrutinee the DFG types as a string (SwitchChar with StringUse) that then OSR-exits on a non-string scrutinee triggers the mis-ordered death event, which the provided test reproduces with a two-line driver. The consequence is that baseline re-execution of op_switch_char receives a dead/poisoned recovery value for the live scrutinee, i.e. a value of the wrong type where a JSString is assumed, a classic type-confusion foundation. It sits at 8.1 because turning the dead-value read into a controlled primitive is non-trivial and depends on OSR-exit value scavenging, not because reachability is limited.</p> /reports/2026-w34/8283d4f1273add66f659b203baaae8e56c4fc3f2/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/8283d4f1273add66f659b203baaae8e56c4fc3f2/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Directly reachable from script: any function that reads from a Uint32Array in a hot loop where the loaded values happen to fit in Int32 will drive the DFG to speculate Int32 on the GetByVal, hitting the buggy path. setIntTypedArrayLoadResult boxed the loaded uint32 as a double while the rest of the DFG-compiled code, having proven the node produces SpecInt32Only, consumes the result as a boxed Int32 - a JSValue representation confusion (double bits read where an Int32 tag/payload was promised) that surfaces a wrong, attacker-influenced value. JS-reachable type confusion on a JSValue is a classic exploitation primitive, and the higher 8.8 reflects the controllability of the loaded value and the absence of any special preconditions.</p> /reports/2026-w34/9f07374e9eb2398ebf629352f5fc0a509ae631b8/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/9f07374e9eb2398ebf629352f5fc0a509ae631b8/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Reachable from any WebAssembly module that places an exception-capable call inside a try block whose result feeds a Select whose sink is a Check (e.g. ref.as_non_null) - all instantiable from untrusted script via WebAssembly.Module/Instance, no special privilege. When B3 Select specialization (or B3DuplicateTails) clones the OMG call patchpoint, the two resulting call sites alias a single exception-restoration stackmap even though their live-value layouts differ, so the catch handler restores values from the wrong registers/slots and can reinterpret a raw i64 bit-pattern as an externref (object) or vice versa. That is a JIT-introduced type confusion on a GC reference, the standard precursor to a fake-object / arbitrary-read-write primitive, justifying High / 8.1.</p> /reports/2026-w22/ed0f115abf/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/ed0f115abf/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/4e802a14ca/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/4e802a14ca/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/ce60d5d618367a814de46344cb0e45696bf27786/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/ce60d5d618367a814de46344cb0e45696bf27786/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from any WebAssembly module that uses GC struct types with reference fields (struct.new / struct.new_default) once BBQ tier-up compiles the allocation, which is trivial to force from untrusted web content. Because the fence is omitted entirely, the concurrent marker can observe a freshly-allocated struct whose ref-field slots and its mark-state metadata are visible in an inconsistent order, causing the collector to mis-scan or skip live references and ultimately free objects that are still reachable, giving a use-after-free primitive. It is a race, so exploitation is probabilistic rather than deterministic, which is why it lands at 8.1 rather than higher.</p> /reports/2026-w22/799e388d2e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/799e388d2e/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium (memory-safety hardening in JSC bytecode metadata handling). OBSERVED: ExpressionInfo::Encoder::adjustInstPC previously held a raw EncodedInfo* pointing into the m_expressionInfoEncodedInfo Vector&rsquo;s backing buffer, and in its MultiWide path it calls m_expressionInfoEncodedInfo.append(&hellip;), which can reallocate that buffer, after which the function keeps reading and writing through the now-dangling pointer (firstInfo[i], *firstInfo). That is a genuine use-after-realloc write primitive inside the compiler. INFERRED: reachability requires generating bytecode whose expression-info stream is large enough to hit the reallocation during remapping (the added test uses a generator with ~9,000,000 spaces of padding to force a multi-wide instPC delta and vector growth). It is compiler-internal state not directly attacker-shaped, so rated medium rather than high, but the corruption is real.</p> /reports/2026-w22/fa0214fe9a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/fa0214fe9a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium-to-high in impact class (JIT miscompilation), rated medium here by the dataset. OBSERVED: AirFixObviousSpills, a JSC B3/Air backend optimization, mismodeled early defs during its rewrite phase — it treated early defs the same as late defs and could substitute a register alias that an early def (e.g. a scratch register) had already clobbered, so the rewritten instruction reads a value from a register that no longer holds it. That is a soundness bug in code generation: the compiled machine code computes wrong values. INFERRED: miscompilation in an optimizing tier can escalate to type confusion / memory corruption when the wrong value feeds bounds checks or object shapes (the regression test is built around DataView on a resizable ArrayBuffer with .resize(), a classic bounds-check-elimination surface), which is why the family is memory-safety relevant.</p> /reports/2026-w34/e88b92e29f0753e644abe33fdbc2b78c051ebf59/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/e88b92e29f0753e644abe33fdbc2b78c051ebf59/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/3b9afb2b4f23fc2eb9555835a2ce0c6ebdb26056/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/3b9afb2b4f23fc2eb9555835a2ce0c6ebdb26056/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>WebAssembly is reachable by any web page, and the bug lives in the BBQ/OMG JIT&rsquo;s memory bounds-check and ref.cast null-check elision — the exact code that guarantees Wasm memory safety. Two flaws are addressed: a ref.cast null check that was elided even when no fault signal handler exists (a null dereference / potential missing trap), and bounds-check-skip logic keyed on offset rather than the last-accessed byte (boundary), which is over-conservative for signaling memory but is a genuine soundness defect. Given the stress-test-demonstrated missing-trap conditions and the corruption potential of skipping a Wasm bounds check, High/8.1 is justified.</p> /reports/2026-w21/7429d22f2b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/7429d22f2b/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a DFG JIT soundness bug in the inlining of Array.prototype.sort comparators: the SetLocal queue was flushed before ExitOK was emitted, letting a node be hoisted above its producer and tripping CPS validation. CPS-form violations in the DFG are serious because incorrect def/use ordering and invalid OSR-exit state are the substrate for type-confusion miscompiles and memory corruption when validation is disabled in release builds. It is rated medium here because the observed symptom is a CPS validation trip (caught by an assertion/validator) rather than a demonstrated exploit primitive, and the fix is a two-line reordering. The comparator-inlining feature is reachable from ordinary JavaScript, which raises reachability but the patch does not establish an attacker-controlled corruption path.</p> /reports/2026-w22/e638840dd2/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/e638840dd2/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A GC-safety defect in FTL&rsquo;s compileMaterializeNewArrayWithButterfly leaves contiguous-array element cell pointers off the stack across the GC point inside allocateJSArray&rsquo;s slow path, so a collection can free live objects that the reconstructed array still references — a genuine use-after-free reachable from ordinary JS that allocates and escapes small arrays of objects under memory pressure. UAF in the JIT-materialized heap is a premier exploitation primitive (freed object reuse -&gt; type confusion). High is correct; it is a real memory-safety bug demonstrated by a regression test.</p> /reports/2026-w23/3825a1a93bbf70dba2406c75919f5d5049a18607/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/3825a1a93bbf70dba2406c75919f5d5049a18607/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/a271abef22/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/a271abef22/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>TypedArray.prototype.forEach cached the backing vector pointer for the common fixed-length non-shared case, but that vector can move during iteration — a non-wasteful typed array materializing its ArrayBuffer (transition to wasteful, new backing store) or a BoundsChecking Wasm memory reallocating — so the user callback can cause a relocation and subsequent element reads use a stale, freed pointer. That is an attacker-reachable use-after-free / OOB read from plain JS. High is appropriate for a heap UAF in a core TypedArray builtin.</p> /reports/2026-w21/b07dca9615/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/b07dca9615/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a JIT type-confusion/soundness bug: GetByStatus::computeFor walked the prototype chain even for direct (own-property) accesses like GetByIdDirect and GetPrivateNameById, so it could hand the DFG a status describing a prototype property when the actual bytecode semantics require an own-property lookup. Feeding the optimizing compiler a status that contradicts the real access semantics lets it install an inline cache / speculation that reads the wrong slot or elides checks, the classic route from a JIT mis-informing itself to attacker-controlled memory access. It is high severity because it originates in the compiler&rsquo;s model of memory layout and is reachable from ordinary property reads, though the diff itself does not include a memory-corruption regression test, so the observed change is the correctness fix rather than a demonstrated exploit.</p> /reports/2026-w22/5099a4a895/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/5099a4a895/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: a one-line change to a loop bound in ClonedArguments::copyToArguments, a routine that materializes an argument object&rsquo;s elements into a caller-supplied JSValue* buffer. INFERRED: with a non-zero offset the loop terminated |offset| iterations early, leaving destination slots either unwritten (uninitialized JSValue leaking into a spread/apply target) or, depending on how firstElementDest and the requested length were sized, allowing writes to be miscounted. That is a memory-safety defect in argument marshalling, hence high. Tempering it: the author states there is no known path to reach copyToArguments with a non-zero offset (op_call_varargs did not yield a PoC), which is why the input&rsquo;s confidence is 0.65 and no test was added.</p> /reports/2026-w21/fb8bfead60/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/fb8bfead60/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a genuine JIT type-confusion soundness bug in the DFG abstract interpreter. After commit 313031@main allowed Set spreads to invoke a user-defined Symbol.iterator, the AI&rsquo;s assumption that Spread(SetObjectUse) has no side effects became false, so it kept folding a CheckStructure whose guarding OSR exit was the only thing preventing a following GetByOffset from reading a stale slot after the iterator mutated the object&rsquo;s structure. A stale-slot read/write under a folded structure check is a classic path to type confusion and thus to arbitrary read/write and RCE in the renderer. High severity, characteristic of a weaponizable JSC bug.</p> /reports/2026-w21/c415e39f48/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/c415e39f48/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a JIT soundness bug in the DFG&rsquo;s Array.prototype.sort inlining: nested inlined sorts allocated cross-block temporaries that could alias each other, letting the inner sort&rsquo;s tmp slots overwrite the outer sort&rsquo;s live values (or vice versa) and corrupt JSArray cells and neighbouring heap objects. Memory corruption originating in the optimizing compiler and driven purely by ordinary JavaScript is the highest-value class for exploitation because it gives an attacker deterministic, attacker-shaped control over object state. The added regression test demonstrates real data corruption (neighbour arrays losing their length, the outer result being mangled), confirming the bug is reachable and not merely theoretical.</p> /reports/2026-w22/aed1fddc0b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/aed1fddc0b/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: the patch converts JSLock::m_hasOwnerThread from a plain bool guarded by a one-sided storeStoreFence into a std::atomic&lt;bool&gt; accessed with release stores and acquire loads, and the commit describes a real cross-thread data race in currentThreadIsHoldingLock / ownerThread / ownerThreadUID. INFERRED: JSLock ownership is queried from threads other than the owner (notably during VM/thread suspension and heap-access coordination), so a thread could observe m_hasOwnerThread==true while the paired m_ownerThread store is not yet visible, reading a stale/torn owner. That can produce incorrect &lsquo;we already hold the lock&rsquo; decisions and use of a stale Thread pointer, a memory-safety-adjacent concurrency bug in a core VM primitive. Rated medium: it is a genuine data race with a plausible path to misbehavior, but the patch is a hardening/ordering fix and no concrete corruption primitive is demonstrated.</p> /reports/2026-w25/1d2be470ed/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/1d2be470ed/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/7663d811d0/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/7663d811d0/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/dcf25ed3c9/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/dcf25ed3c9/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a data race on JSC&rsquo;s regexp bytecode-compilation path between the mutator (VM thread) and the JIT compiler thread, both of which can call into RegExp matching. Data races on shared JIT/runtime state are memory-safety bugs: an unsynchronized compile of m_regExpBytecode racing with a read can produce a torn or half-initialized BytecodePattern that the interpreter then executes. The commit acknowledges the race is only manifestable with artificial sleeps, so it is a hard-to-hit but real corruption primitive rather than a trivially weaponizable one, placing it firmly at high but not critical.</p> /reports/2026-w25/7937fd75ae/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/7937fd75ae/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a JIT-correctness hardening of the DFG/FTL model for Map/Set iterator advancement. Pre-patch, MapIteratorNext mutated the JSMapIterator/JSSetIterator in place and was declared with a NodeResultBoolean while forbidding OSR exit mid-operation; that coupling made allocation-sinking impossible and left the advance non-atomic w.r.t. OSR exit. The class of defect (an iterator left partially- or double-advanced across an OSR exit or a sunk-object materialization) is a soundness bug that can desynchronize the iterator&rsquo;s storage/entry state; graded medium as a correctness/robustness fix without a demonstrated in-the-wild memory-corruption exploit.</p> /reports/2026-w22/b67282ad89/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/b67282ad89/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: the fix adds two RETURN_IF_EXCEPTION guards to the Set-iterator fast path in forEachInIteratorProtocol and ships a regression test that runs under &ndash;validateExceptionChecks=1. INFERRED: the direct consequence is invoking a user (JS) callback while a JSC exception is pending. In JSC, running arbitrary JS with an unchecked pending exception violates the engine&rsquo;s exception-check invariant; on debug/ASan builds this fires an assertion, and on release builds it can lead to executing code paths that assume no exception is set. That is a correctness/soundness defect in a hot iteration primitive reachable from ordinary script (Set.prototype.entries() plus any Iterator-helper consumer), justifying a medium-to-high rating; it is rated medium here because the throwing condition (constructArrayPair OOM for kind==Entries) is not trivially attacker-triggerable without exhausting memory.</p> /reports/2026-w22/34669c802f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/34669c802f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>In the DataView byteLength getter inline cache stub, a null-vector out-of-bounds check emitted before preserveReusedRegistersByPushing jumped to a failure label positioned before restoreReusedRegistersByPopping, so on that path the pushed registers were never popped — a misbalanced stack in JIT-generated code. Stack desynchronization in an IC stub corrupts the native stack/register state and is a classic path to controlled memory corruption and control-flow hijack; the test reaches it by transferring a resizable ArrayBuffer so the DataView&rsquo;s vector becomes null. High is appropriate for a JIT stack-imbalance memory-safety bug.</p> /reports/2026-w22/1b422914d5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/1b422914d5/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A JIT soundness/robustness fix: the FTL stack-overflow check ran as a B3 patchpoint in the function body after the prologue rather than in the Air prologue before frame allocation, and the patchpoint path did not correctly restore the stack pointer. Getting the stack-overflow check ordering or the sp/callee-save restore wrong on the overflow path is the kind of defect that can leave the stack in an inconsistent state at the moment an exception is thrown deep in recursion. Medium/0.6: the change is structural and the commit notes a real sp-restore bug, but there is no demonstrated corruption primitive and no test (too slow to trigger).</p> /reports/2026-w34/7711916200dda7e418b321e34493f66a7af2a0b0/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/7711916200dda7e418b321e34493f66a7af2a0b0/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The miscompilation is reachable from ordinary JavaScript: a hot ++/&ndash; on an integer that reaches its Int32 limit is enough to trigger the wrong-typed result once the function is JIT-compiled, and warm-up is script-driven. Because the DFG drops an integer overflow check it should have preserved, the JIT produces a value that is semantically wrong and, in downstream typed uses, a soundness violation that generalizes to type confusion and memory corruption, justifying a High rating; the CVSS of 8.6 reflects broad reachability but the need to build a full exploit chain on top of the miscompile.</p> /reports/2026-w25/357d3881fd/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/357d3881fd/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/f7026fa96b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/f7026fa96b/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is JIT profiling soundness for op_unsigned (UInt32ToNumber): without arith profiling, the DFG&rsquo;s decision about whether the uint32-&gt;number conversion can overflow int32 relied only on OSR-exit history, risking either miscompilation or repeated deopt storms. The commit message and rdar framing present it as a soundness/performance correctness fix rather than a demonstrated corruption, so medium; the family (Int32 overflow speculation) is the same one that produces exploitable JIT bugs when speculation is wrong.</p> /reports/2026-w23/51cc3feb729804866ae63510d837f4df674bbc59/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/51cc3feb729804866ae63510d837f4df674bbc59/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Reachable purely from script whenever two JSGlobalObjects share a VM and a promise from one realm is awaited/settled by another (createGlobalObject in JSC shells, and in the browser via same-VM contexts such as same-origin iframes and ShadowRealm), so the trigger surface is ordinary async/await and Promise combinator code. The impact is a realm-boundary confusion that hands script from realm A a function/object (resolving functions, AggregateError, Promise.allSettled result records) constructed in realm B, i.e. a cross-realm reference leak that can seed prototype-pollution and confused-deputy chains; there is no direct memory corruption, so Medium/5.4 fits.</p> /reports/2026-w22/177d2cad35/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/177d2cad35/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. This tightens the head-structure check added in 314147@main (78c04ea7a1): that check accepted cacheable dictionary structures, but adding a property to a dictionary does not transition its structure, so a proven absence of &rsquo;then&rsquo; stays cached even after a &rsquo;then&rsquo; getter is added post-compilation, with no watchpoint or CheckStructure catching it. Promise.resolve() folded into NewResolvedPromise then skips the user&rsquo;s &rsquo;then&rsquo; getter, and running the getter later on the slow path executes user code where the compiler assumed no side effects, a JIT correctness/type-confusion bug reachable from plain script.</p> /reports/2026-w21/e7c63753e1/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/e7c63753e1/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/5e2667f6b1/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/5e2667f6b1/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a soundness fix in JSC&rsquo;s DFG bytecode parser: baseline-observed Int32 overflow was not being propagated into DFG node flags, so DFG speculation reasoned from incomplete profiling. Mis-modeled overflow in an optimizing JIT can lead to incorrect range/type assumptions and, in the worst case, memory-safety issues, but the patch is a one-line flag propagation with no PoC and no stated exploit, so medium severity reflects a real correctness/soundness defect of uncertain exploitability.</p> /reports/2026-w21/87b4375777/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/87b4375777/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a garbage-collector visibility use-after-free in the DFG and FTL OSR-exit machinery: scratch buffers that transiently become the sole retainers of live on-stack JSValues were not published to the conservative GC via activeLength, so a collection during the exit could free objects that are still referenced. GC-visibility bugs in the JIT are high severity because they let ordinary JavaScript induce a dangling pointer to a real, type-correct heap object, which is a premium exploitation primitive. The fix is small but load-bearing — writing activeLength around the stack-shuffle window — and the added test drives the exact condition (a large allocation and a timer forcing GC after an exit), confirming reachability.</p> /reports/2026-w25/72e0ec4b21/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/72e0ec4b21/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This corrects ArrayProfile MayStoreHole accounting for hole-creating stores across the fast paths (directPutByVal and trySetIndexQuickly). Wrong profiling drives &rsquo;too aggressive (wrong)&rsquo; DFG/FTL speculation about whether an array store can create a hole &ndash; the soundness precondition for array-store OOB/indexing-mode bugs &ndash; but the commit frames the symptom as spurious OSR exits, so medium; the class (unsound array-store speculation) is a classic OOB primitive.</p> /reports/2026-w22/09c07d2796/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/09c07d2796/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/1f4e4caab0/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/1f4e4caab0/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A DFG JIT soundness bug that produces a type-confused value: two String.prototype.at accesses that should return different types (a JSString when in-bounds vs. the undefined value when out-of-bounds) can be collapsed into one by pure common-subexpression elimination because the cache key ignored arrayMode. Miscompiles that hand JavaScript a value of the wrong type are the classic root of JSC exploit chains, which argues for high severity; it is scored medium because triggering it requires a specific same-receiver/same-index pattern whose two occurrences are speculated into different array modes, and the immediately observable divergence is undefined-vs-string rather than an obviously controllable object pointer. Confidence 0.65: the fix and its own comment state the invariant plainly, but the exact downstream misuse is inferred.</p> /reports/2026-w25/aa5589433c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/aa5589433c/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a JSC re-entrancy type-confusion in a hot object-literal fast path where a cached structure transition (target Structure + PropertyOffset) is used to store a value AFTER user JavaScript has been allowed to run mid-parse. Using a stale offset/out-of-line-capacity against a mutated object is a classic path to controlled heap corruption in the butterfly, so the theoretical ceiling is high; the added test only asserts an incorrect result (o[1] !== 2), so the publicly demonstrated effect is corruption of parsed values / wrong state rather than a proven arbitrary write, keeping the confirmed severity at medium-to-high.</p> /reports/2026-w25/055680a255/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/055680a255/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a use-after-free in JavaScriptCore&rsquo;s polymorphic inline cache machinery: the GC&rsquo;s dependent-cell walk omitted the custom slot base for CustomAccessorGetter/CustomAccessorSetter cases, so a JSObject serving as the accessor&rsquo;s slot base could be collected while a still-live AccessCase referenced it. A UAF on a JSCell in the JIT/IC path is a classic renderer memory-corruption primitive that historically leads to type confusion and RCE, which justifies a high real-world severity even though the metadata labels it medium. The included gc()-driven regression test and the $vm custom getter/setter harness show the condition is deterministically reachable.</p> /reports/2026-w21/59a20ddcb9/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/59a20ddcb9/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A JIT-generated slow-path call passed nine 64-bit arguments to a C operation while both ARM64 (8 argument registers) and x86_64 (6) can only place a subset in registers, and the DFG/FTL back ends assume the platform never spills call arguments to the stack (maxFrameExtentForSlowPathCall is 0 on those targets). The ninth argument was therefore poked to [sp + 0], aliasing the lowest spill slot and silently corrupting a live value that had been spilled there. Because the corrupted slot can hold an arbitrary JSValue that later feeds arithmetic or object operations, this is a controlled in-process memory-corruption primitive reachable from ordinary script, not merely a robustness bug. It rates high: JS-reachable JIT frame-layout corruption is the classic starting point for a renderer RCE chain.</p> /reports/2026-w22/c8525868de/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/c8525868de/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. genericTypedArrayViewProtoFuncSortImpl operates directly on the backing store of a TypedArray view; if the length it copies with can exceed the store&rsquo;s true element count at the moment of the copy, the sort reads (and writes back) out of the bounds of the ArrayBuffer&rsquo;s allocation. Because the trigger is a growable SharedArrayBuffer (GSAB) grown concurrently on another thread, this is a data race that yields a controlled OOB read/write on the JS heap, a strong exploitation primitive. Backed by an rdar and a landed stress test, hence high confidence.</p> /reports/2026-w22/76b3468621/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/76b3468621/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>JSWebAssemblyInstance&rsquo;s destructor tore down the Wasm::InstanceAnchor last, after already destroying parts of the instance, but the anchor can expose the instance to other threads (including the Wasm compiler thread). A concurrent thread resolving the anchor during destruction obtains a pointer to a partially-destroyed JSWebAssemblyInstance — a use-after-free / use-during-destruction across threads. The bundled test expects a crash on vulnerable builds. Cross-thread UAF in the Wasm runtime is a strong exploitation primitive; high is appropriate.</p> /reports/2026-w21/d55bf0c070/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/d55bf0c070/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/116394de19/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/116394de19/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The flaw is in the JSC Yarr regex JIT, invoked whenever a page runs a RegExp, so it is reachable from any script with no permission. A word-boundary assertion combined with the unicode flag and the non-BMP fast path corrupts the match index register, producing a JSString whose backing indices are wrong &ndash; a memory-safety defect the commit says crashes WebContent. It is scoped as index/string corruption leading to a crash rather than a demonstrated controllable write, so high rather than critical.</p> /reports/2026-w25/f5722de1f7/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/f5722de1f7/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/ba26b52421/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/ba26b52421/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a defense-in-depth hardening change, not the fix for a specific exploitable bug, so its intrinsic severity is low; but the failure mode it closes is high-value. Before the patch a zeroed libpas compact pointer decoded to the memory immediately preceding the compact-heap reservation, and any unchecked load/store through a decoded compact pointer (e.g. pas_segregated_directory_data_ptr_load_non_null) could silently read or corrupt whatever mapped VM region happened to sit there. Converting that class of corruption into a deterministic PROT_NONE fault removes a stealthy, exploitation-friendly primitive that any compact-pointer-zeroing bug elsewhere in the engine could otherwise weaponize. It does not fix a memory-safety bug in itself; it degrades one from silent corruption to a reliable crash.</p> /reports/2026-w22/ed57dc0915/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/ed57dc0915/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/65e6c589b7/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/65e6c589b7/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/55c608d2b1b46d1ac0b40d093a8c6b5a69c16907/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/55c608d2b1b46d1ac0b40d093a8c6b5a69c16907/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/ceb4d817be51a2f1fd44eb46cd575598358abbdc/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/ceb4d817be51a2f1fd44eb46cd575598358abbdc/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/112604f6a167ea78c004e392cd123edde551f2b5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/112604f6a167ea78c004e392cd123edde551f2b5/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/fec133e2eaadbecd135945e4090f561497e055af/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/fec133e2eaadbecd135945e4090f561497e055af/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/c1ab79ebcc0fff886aad0217b9d1a9b8f20a20cf/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/c1ab79ebcc0fff886aad0217b9d1a9b8f20a20cf/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A cross-origin iframe carrying upgrade-insecure-requests could drive window.top.location to a plaintext http:// URL and have that top-level navigation proceed over HTTP instead of being upgraded to HTTPS, silently defeating the iframe&rsquo;s declared HTTPS-only posture and exposing the top navigation to network downgrade/MITM. Reachability is entirely web-content driven (any embedded iframe can attempt window.top.location) but impact is confidentiality/integrity of a single navigation rather than memory corruption, and the top frame&rsquo;s own transport is not weakened, so CVSS 5.3 (network, low complexity, no privileges, no UI, limited scope) is appropriate.</p> /reports/2026-w22/888c80c640/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/888c80c640/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A CSP upgrade-insecure-requests / mixed-content bypass specific to site isolation: when a cross-origin iframe navigates window.top.location.href to an http:// URL, the top frame&rsquo;s upgrade-insecure-requests directive was never applied because the site-isolation path routes through a provisional page in another process where no document exists to consult, so the navigation proceeded over cleartext. It downgrades a security guarantee the author explicitly opted into (silent http instead of forced https), exposing the top-level navigation to network MITM/downgrade. It is not memory corruption and requires a cross-process navigation configuration, so medium, but it is a genuine same-page security-policy bypass.</p> /reports/2026-w21/e5c4d1be15/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/e5c4d1be15/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>During a Site-Isolation cross-origin navigation, a freshly created RemoteFrame was seeded with the dying LocalFrame&rsquo;s FrameTreeSyncData, whose cached frameDocumentSecurityOrigin still reflected the pre-swap (old) document rather than the cross-origin document being navigated to. For a short window before the post-commit refresh IPC arrived, any task querying the remote window (e.g. a BroadcastChannel dispatch from a pagehide handler) could observe a stale origin that spuriously matched the active document — a transient same-origin-with-a-cross-origin-frame condition. The observed consequence in the patch is a debug ASSERT crash in DOMWindow::crossDomainAccessErrorMessage, and BindingSecurity still correctly denied the cross-process access, so this is scored as a correctness/origin-tracking hardening bug with security relevance rather than a demonstrated cross-origin read. It is worth attention because a stale cached origin on a cross-origin frame is exactly the kind of same-origin-policy desync that can become a real leak if any code path trusts the cached value instead of BindingSecurity.</p> /reports/2026-w21/3c5a9e4f2e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/3c5a9e4f2e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/273837bcb9abb0793a8d7a7002c27572eb37f850/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/273837bcb9abb0793a8d7a7002c27572eb37f850/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/62fb864bff/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/62fb864bff/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/5b5081adba8f0891b114ba01a843fbbfdb6b7cd7/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/5b5081adba8f0891b114ba01a843fbbfdb6b7cd7/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/cbe41ae484/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/cbe41ae484/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/073bf48042/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/073bf48042/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a security-check correctness fix in the WebAuthn ancestor-origin scoping path, not a memory-corruption bug, so its ceiling is a logic/spoofing class rather than RCE. Under Site Isolation the pre-patch loop walked Document::parentDocument(), which returns null the moment an ancestor lives in another process; the same-site/cross-origin determination therefore ran against a truncated ancestor chain and could reach the wrong verdict for a credential ceremony. Because the observable failure mode in the shipped configuration was a crash (the WPT was marked [ Crash ]/[ Failure ] on the site-isolation bots), the realistic impact is a reliability defect plus a latent scoping-integrity concern for cross-origin embedded WebAuthn. It is rated high because a mis-scoped same-origin-with-ancestors result touches the trust boundary of public-key credential creation/assertion.</p> /reports/2026-w21/cd11ac52db/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/cd11ac52db/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Under Site Isolation, a NetworkProcess crash left cross-origin subframe web processes unable to prove first-party-for-cookies authorization, so their subsequent cookie/fetch IPCs failed allowsFirstPartyForCookies MESSAGE_CHECKs and the subframe web processes were killed. This is a functional/availability and security-model consistency defect: legitimate cross-origin iframes break after a network-process relaunch, and the recovery path was reconstructing the allow-list only from main-frame state. Because MESSAGE_CHECK failures terminate the offending web process, the bug is a reliable cross-origin-subframe denial of service and a sign the cookie-authorization state machine was not crash-durable. It is not a memory-corruption bug, hence high-but-not-critical.</p> /reports/2026-w23/00a2a6621815015a6a81b1d6bcf2e82666de1f45/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/00a2a6621815015a6a81b1d6bcf2e82666de1f45/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/fd143209a4/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/fd143209a4/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: under Site Isolation with MultiProcessBackForwardCacheEnabled, restoring a page with a cross-site iframe from BFCache after a cross-site navigation caused the iframe&rsquo;s first party for cookies to resolve to the wrong site (b.com instead of the a.com main frame); the NetworkProcess then denied the access and terminated the iframe process. INFERRED severity: the observable failure is an iframe-process termination (denial of service / broken restore), but the same stale-top-URL condition is a cross-origin cookie-context confusion, which is a privacy/security-relevant class. Rated medium: the shipped effect is a process kill and a mis-resolved (over-restrictive) first party rather than a demonstrated cross-origin cookie disclosure, but it touches the first-party-for-cookies boundary in a multi-process trust context.</p> /reports/2026-w21/0a6b5cd60b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/0a6b5cd60b/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/6512004572/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/6512004572/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A lifetime bug in the UI-process navigation path under Site Isolation: a web content process chosen for a navigation can be moved into the process cache during an in-flight async IPC, so by the time the completion handler runs it hits RELEASE_ASSERT(!newProcess-&gt;isInProcessCache()), crashing Safari. The observed impact is a reliable release-assert crash reachable from ordinary navigation (typing in the smart search field and searching); the underlying condition is a use-of-cached/possibly-recyclable process, which is why it is treated as a UAF-adjacent lifetime bug. Medium severity/0.65: the crash is clear, but weaponizing the cache-recycle window into memory corruption is speculative, and the author calls the fix speculative.</p> /reports/2026-w34/9c771fce0a906f72dba484655193f91a369f78d3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/9c771fce0a906f72dba484655193f91a369f78d3/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/874b112868/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/874b112868/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a cross-origin storage-access isolation bypass specific to Site Isolation: storage access granted to an iframe survived a self-initiated cross-origin navigation when a redirect bounced the load back to the original process. Persisting unpartitioned-storage access across an origin boundary violates the Storage Access API&rsquo;s own limitation and can enable cross-site tracking/data access, a privacy/same-origin-policy weakening rather than memory corruption &ndash; consistent with a medium rating. Exploitation requires the target frame to already hold a storage-access grant.</p> /reports/2026-w34/884d0116ea09545d3bebd0d91a834ecc23ab6c31/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/884d0116ea09545d3bebd0d91a834ecc23ab6c31/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/bafdda395e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/bafdda395e/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A UI-process lifetime bug in the Web Inspector&rsquo;s Site-Isolation instrumentation: an IPC message-receiver registration on a WebProcessProxy could outlive the proxy itself because full-page cross-origin navigation (didCommitProvisionalPage) never paired the add with a remove, and cleanup relied on WebProcessProxy::processForIdentifier() which returns null after the proxy is destructed even though its receiver-map entry is not yet torn down. The observed symptom is a debug ASSERT(!m_messageReceiverMapCount) in ~MessageReceiver, but the commit explicitly calls it the same latent UAF pattern (using a destructed process&rsquo;s receiver map). Medium/0.6: requires Web Inspector attached during a cross-origin navigation; not a remote-content primitive on its own.</p> /reports/2026-w25/69aa56247c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/69aa56247c/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a site-isolation confidentiality bypass reachable from a compromised or malicious web content process, the exact threat model site isolation exists to contain. Because WebPasteboardProxy ran in the UI process and performed no subtree/ancestry check on caller-supplied remote frame identifiers, a web process could name arbitrary out-of-process frames and cause their cross-origin DOM to be serialized into a WebArchive on the pasteboard, disclosing cross-site content. It is not a memory-corruption RCE, which caps it below critical, but it defeats a core security boundary, warranting high.</p> /reports/2026-w34/1feb6ac19b06a18bee095b204f70551cb22eff3b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/1feb6ac19b06a18bee095b204f70551cb22eff3b/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/f76f30efcb689ec60174addc19d38b9150b67c69/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/f76f30efcb689ec60174addc19d38b9150b67c69/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/b56d0c9b157522fba900fc8b8b009b4729fd42de/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/b56d0c9b157522fba900fc8b8b009b4729fd42de/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/57df341619/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/57df341619/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium. OBSERVED: two WebAssembly builtin paths call JSString::value()/asString(nextValue)-&gt;value() to resolve a possibly-rope string and then continue using the result without a RETURN_IF_EXCEPTION check. JSString::value() can throw an OutOfMemory exception while resolving a rope; when it does, the returned string view is empty/invalid and there is a pending exception on the VM. Continuing to iterate over stringLength char codes (intoCharCodeArray) or to build makeString(&ldquo;wasm:&rdquo;, StringView(contents)) with a null/empty resolved string, while an exception is live, is an exception-safety violation that can corrupt control flow / produce inconsistent results. INFERRED: exploitability is limited — triggering requires forcing rope-resolution OOM — and the immediate effect is a missing bail-out rather than a direct write, so medium.</p> /reports/2026-w25/96d0619b3a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/96d0619b3a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/36a3e59bad/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/36a3e59bad/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>WebAssembly.Table.prototype.grow(delta, fillValue) is directly script-callable, and the bug leaves a live WebAssemblyFunction wrapper unmarked so the GC frees it while table.get still returns it - a use-after-free / dangling-cell yielding a freed JSCell to script. That is a strong exploitation primitive and the patch ships two regression tests, so high.</p> /reports/2026-w23/c18d1e3571f490235aa624c1593e7d1289ea7ba6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/c18d1e3571f490235aa624c1593e7d1289ea7ba6/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The vulnerability is a JIT miscompilation reachable from any WebAssembly module that a web page can compile and run, so it is web-content reachable without prior compromise; only the OMG tier and Wasm tail calls need be enabled, both of which normal execution reaches after warm-up. The register allocator can keep a live outgoing argument in a pinned register that the cross-instance context-switch reload overwrites, silently corrupting a value that flows into the callee — a JIT-soundness violation that produces attacker-influenced wrong values / memory corruption rather than a clean fault. Classified TypeConfusion per JIT-soundness convention (a miscompiled value violates the type/soundness model), with web reachability and corruption potential supporting 8.8 High.</p> /reports/2026-w34/4fa207d1c8d4a14afbda9ffa02b9070effd52d9b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/4fa207d1c8d4a14afbda9ffa02b9070effd52d9b/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/d40f4efab0e0cee61e29c8540abff5285bf5275d/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/d40f4efab0e0cee61e29c8540abff5285bf5275d/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Fully reachable from unprivileged web content: an &lt;img&gt; in a &lt;picture&gt;, a load/error handler, and showModalDialog are all ordinary DOM features, and internals is only needed for the test harness, not the bug. The defect is a use-after-free of the ImageLoader (owned by the HTMLImageElement) that runs on freed <code>this</code> when the trailing updatedHasPendingEvent() executes, a classic renderer-side UAF that is a strong basis for a controlled type-confusion / heap-reuse primitive and thus RCE. CVSS 8.8 reflects network attack vector, low complexity (single reload handler), no privileges, and high impact on all three of C/I/A within the content process.</p> /reports/2026-w34/6dca6330dba27ff589985db50e5e259f71a44f61/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/6dca6330dba27ff589985db50e5e259f71a44f61/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from WebGPU-enabled web content (or a WebGPU render bundle) with no special privileges: two drawIndirect/drawIndexedIndirect calls out of one arguments buffer in a single render pass are ordinary API usage. However, it lives entirely in the sandboxed WebGPU/GPUProcess Metal backend and its direct observable effect is corrupted indirect draw arguments feeding a GPU draw, producing wrong rendering and, in the reported case, an unrecoverable AGX tiler timeout / device loss (DoS). Because the corrupted values are GPU-side draw counts rather than a CPU-controllable pointer, and the win is primarily denial-of-service within the GPU process rather than a clean memory-write primitive, severity is Medium; the 7.1 reflects easy web reachability against a GPU-process asset with integrity/availability impact but no established CPU-side corruption.</p> /reports/2026-w21/912cfd18d9/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/912cfd18d9/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/84cde5ed5a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/84cde5ed5a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>SerializedScriptValue::deserialize() moves several Internals members (array-buffer contents, detached handles, wasm modules/memory), so it is single-use. BroadcastChannel.postMessage() fans one SerializedScriptValue out to multiple same-origin recipients and re-deserialized it per recipient; after the first deserialize the moved-from members are empty, so later recipients received an incomplete message and, for shared/transferred backing (SharedArrayBuffer, shared WebAssembly.Memory, ArrayBuffers), the second consumption operated on already-moved state. Graded medium: it is a same-origin correctness/robustness defect (multi-recipient message loss) with a plausible use-after-move/aliasing angle on shared memory, but the patch demonstrates only message-integrity failures, not a proven UAF exploit.</p> /reports/2026-w21/a02317c784/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/a02317c784/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/d3de21e23b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/d3de21e23b/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. platformImportSpki and platformImportPkcs8 parse attacker-controlled ASN.1 key blobs supplied to crypto.subtle.importKey. A crafted length byte drives the parse index past the buffer end, causing keyData.size() - index to underflow (size_t) and subvector(index) to read out of bounds, crashing the WebContent process and constituting a heap over-read. Fully web-reachable with no special privileges; six regression tests and an rdar back it.</p> /reports/2026-w23/e30ca29fe97301994a1d6c66ab56fcc1aff66d3f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/e30ca29fe97301994a1d6c66ab56fcc1aff66d3f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The unvalidated download IPCs are handled by the NetworkProcess but their arguments come from a WebContent process, so exploitation presupposes a renderer that can craft <code>StartDownload</code>/<code>ConvertMainResourceLoadToDownload</code> messages with a spoofed first-party origin — a compromised or coerced renderer. Given that, the flaw lets a download request be issued with an attacker-chosen <code>firstPartyForCookies</code>, causing the NetworkProcess to attach another origin&rsquo;s first-party cookies to the request (a CSRF/cross-origin cookie-attachment issue). Confidentiality/integrity impact across the origin boundary behind a renderer-trust precondition fits CVSS 6.5 Medium.</p> /reports/2026-w23/6a4511bc5935267f5bc58b34616bc9e244ec66c4/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/6a4511bc5935267f5bc58b34616bc9e244ec66c4/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/846badc3c41ca797dd2d5980061ad32c157638f5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/846badc3c41ca797dd2d5980061ad32c157638f5/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/52162f9781/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/52162f9781/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/9a19d07c4f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/9a19d07c4f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a Content Security Policy path allow-list bypass in a security boundary that sites deliberately deploy to constrain which scripts may execute. Because the pre-patch matcher percent-decoded the entire URL path into one flat string before doing prefix/equality checks, an attacker who can influence a resource URL (for example via an open redirect, a reflected path, or a directory that serves attacker-controlled content) could smuggle %2F..%2F traversal sequences that satisfied a narrow script-src path but resolved to a script outside the intended directory. It does not corrupt memory, so it is not directly RCE, but defeating CSP removes the primary mitigation that sites rely on to contain XSS and to gate script provenance, which is why WebKit treats it as high severity and shipped it on a Safari rapid-response branch.</p> /reports/2026-w21/b4e7e8bd27/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/b4e7e8bd27/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This closes an attribute-tainting bypass in CSS attr(): a typed attr(data-foo type(&lt;url&gt;)) let attacker-controlled attribute text become a live, non-tainted url(), defeating the attr-taint mechanism whose entire purpose is to stop attribute values from being turned into resource-fetching URLs. The consequence is a same-page data exfiltration / CSRF-style resource-load primitive (background-image or custom property resolving to an attacker-chosen URL) that should have been neutralized by tainting, so it is a privacy/SSRF-adjacent boundary bug rather than memory corruption. It is rated high because attr-tainting is a deliberate security control and the bypass is directly demonstrated by WPT security tests flipping FAIL to PASS. The blast radius is limited to what CSS URL loading can reach and requires the page to consume the tainted attribute in a URL context.</p> /reports/2026-w25/8be326aece/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/8be326aece/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/56c55ddc38/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/56c55ddc38/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>ANGLE&rsquo;s index-range computation feeds WebGL draw-call validation, which is reachable by any page using a WebGL context with no permission prompt. An integer overflow in gl::IndexRange let a draw whose largest index is 0xFFFFFFFF slip past the bounds check that rejects indices exceeding the bound vertex buffer, producing out-of-bounds vertex fetches in the GPU/driver path. OOB access driven by attacker-controlled index data in the GPU process warrants high severity; it is bounded by being an index/vertex read rather than an arbitrary write, so not critical.</p> /reports/2026-w21/1694417658/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/1694417658/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/675c62d66e3cfa45f2a6206bdd5f1ca9fd59cc09/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/675c62d66e3cfa45f2a6206bdd5f1ca9fd59cc09/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A compromised (or IPC-fuzzing) WebContent process could forge a WebFrameProxy::SetAppBadge or WebProcessProxy::SetAppBadgeFromWorker message naming an arbitrary origin - e.g. <a href="https://apple.com">https://apple.com</a> - that the process never committed, causing the UI process to display an application badge attributed to a spoofed first party. Reachability presupposes a process already able to craft IPC (a compromised renderer or the IPC testing API), and the impact is a UI-level origin-attribution spoof (integrity of the badge, potential for social-engineering), not memory corruption or data theft, so the assigned CVSS 5.3 / Medium is retained.</p> /archive/ Mon, 01 Jan 0001 00:00:00 +0000 /archive/ /reports/2026-w23/4f393fd202e3aae8e78552bb3dd8473b10fa7113/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/4f393fd202e3aae8e78552bb3dd8473b10fa7113/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/537cc2c75c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/537cc2c75c/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/35c8316c38/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/35c8316c38/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A cross-origin information-leak / privacy defect rather than a memory-safety bug: SpeechSynthesis audio started by one origin keeps playing after the document is torn down or suspended for the back/forward cache, so it bleeds into the next, possibly cross-origin, page. No memory corruption, but audible content crossing an origin boundary is a real confidentiality and user-confusion issue, and events could fire into a suspended context. Medium is appropriate; confidence 0.65 because the fix&rsquo;s intent (cancel on suspend/stop, gate events on isAllowedToRunScript) is explicit while the precise platform-synthesizer lifetime is inferred.</p> /reports/2026-w25/97990a2481/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/97990a2481/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A concrete undefined-behavior bug: fromCBOR compared an iterator from a nested credProps map against the outer decodedMap&rsquo;s end(), so a credProps map lacking an &lsquo;rk&rsquo; key passed the guard and dereferenced a past-the-end iterator. Input is attacker-influenceable CBOR from an authenticator/WebAuthn response, and dereferencing an invalid iterator is an OOB read of whatever memory follows the map&rsquo;s storage. Impact is an info-leak/crash on malformed input rather than a demonstrated corruption chain, so medium.</p> /reports/2026-w23/b9f72089660743af40868166a591f2ce0469e760/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/b9f72089660743af40868166a591f2ce0469e760/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/28e2def3391fcf13871b39813d3c2fa8d91d9a06/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/28e2def3391fcf13871b39813d3c2fa8d91d9a06/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/ce27a48eff/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/ce27a48eff/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/b8c7728535/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/b8c7728535/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/e118db06408d11b659613936beccef24dea1421e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/e118db06408d11b659613936beccef24dea1421e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/d6c7e00d0a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/d6c7e00d0a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a privacy / cross-origin cookie bug, not memory corruption: cross-origin requests made from an about:blank popup used firstPartyForCookies = about:blank, whose empty registrable domain caused thirdPartyCookieBlockingDecisionForRequest() to return None and skip third-party cookie blocking, leaking first-party cookies to third parties. It is rated medium because it defeats a privacy/anti-tracking control (ITP/resource-load-statistics third-party cookie blocking) rather than granting code execution, but it is trivially reachable from any page that can open a popup and enables cross-site tracking/cookie exfiltration. The fix restores correct first-party attribution by inheriting the opener&rsquo;s firstPartyForCookies. The impact is confidentiality of cross-site cookie state, scoped to environments with third-party cookie blocking enabled.</p> /reports/2026-w25/5b76a52475/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/5b76a52475/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/113cf2c7cf/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/113cf2c7cf/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/f8acb9cb819c1f8ae56c81b5e5076403a6b12a5b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/f8acb9cb819c1f8ae56c81b5e5076403a6b12a5b/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/89f18277fe742a66605ffb4401a3732ae4bff55b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/89f18277fe742a66605ffb4401a3732ae4bff55b/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/20790ef5e0/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/20790ef5e0/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a data-clearing / privacy-hygiene failure, not a memory-safety bug: a Clear-Site-Data: &ldquo;cache&rdquo; HTTP response silently failed to evict the calling origin&rsquo;s back/forward-cache and memory-cache entries. Origin-scoped content that a site (or a user) explicitly asked to be purged remained resident and reusable, which is a confidentiality/state-persistence weakness of medium severity. There is no attacker-controlled corruption primitive, so it does not rise to high.</p> /reports/2026-w23/da44cdb89cd768f800e38ca1f675b723b70bb575/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/da44cdb89cd768f800e38ca1f675b723b70bb575/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Exploitation requires an already-compromised WebContent process that can synthesize arbitrary IPC (the test enables IPC_TESTING_API to stand in for that capability), so it is a post-compromise primitive, not a remote-from-nothing bug. Given that precondition, it lets one renderer drain pending MessagePort messages entangled to a different, cross-origin renderer, an information disclosure that crosses the site-isolation boundary the NetworkProcess is supposed to enforce. That combination of a meaningful confidentiality breach gated behind prior compromise justifies the High-to-Medium downgrade to CVSS 6.5.</p> /reports/2026-w22/08911bd034/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/08911bd034/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The definitive memory-safety fix for the same concurrent-HashMap-access class as cf20d123b3: the free functions getScreenProperties()/screenData() exposed a mutable process-global ScreenProperties (and its screenDataMap HashMap) that could be read off the main thread while the main thread mutated it, causing MTE crashes. This commit removes those functions entirely and replaces them with a ThreadSafeRefCounted PlatformScreen singleton with copy-on-write, resettable semantics so a worker holding a ref keeps a stable snapshot while the main thread swaps in a new instance. Broad, cross-platform memory-safety hardening reachable from web content (WebGPU, media codecs, PDF, model), but the corrupted data is display metadata and the race needs specific timing, so medium.</p> /reports/2026-w22/cf20d123b3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/cf20d123b3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A data race / memory-safety fix: GPUCanvasContextCocoa read WebCore::getScreenProperties() and iterated its screenDataMap HashMap from a worker thread while the main thread could be mutating that same map, producing MTE-detected crashes on Apple hardware. It is a real concurrency UAF/type-confusion class over a HashMap, WebGPU-reachable from web content, but requires a specific main/worker timing race and the corrupted data is display headroom state, so medium. This is the branch-landed precursor to the fuller PlatformScreen singleton rework (08911bd034).</p> /reports/2026-w25/ee05249166/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/ee05249166/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/7d28e39dfc/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/7d28e39dfc/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/cc35e71c66143f1777eb577bd3b81917356bd514/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/cc35e71c66143f1777eb577bd3b81917356bd514/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/ea232f3860/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/ea232f3860/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/4d4fbca02b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/4d4fbca02b/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a use-after-free in the UIProcess-side visionOS/iOS fullscreen controller reached through an ordinary, un-privileged UI flow (a second video entering fullscreen while a first is still animating), so it is memory corruption in a privileged process rather than a sandboxed renderer bug. However, the trigger is a timing race in the animation lifecycle rather than a directly attacker-shaped heap grooming primitive, and the observed outcome is a crash in objc_msgSend, so medium severity is appropriate absent evidence of controlled reuse.</p> /reports/2026-w22/a926a679cf/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/a926a679cf/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. A ScrollerMac object owned by ScrollerPairMac is destroyed on the main thread, while an in-flight NSAnimation display-link callback on the &lsquo;WebCore: Scrolling&rsquo; thread still holds a CheckedPtr to it and calls updateProgress in -[WebScrollbarPartAnimationMac setCurrentProgress:]. This is a cross-thread use-after-free of a heap object. Reachability is via ordinary scrollbar animation, so it is broadly triggerable; confidence 0.8 as it is a race and non-web-content thread interaction.</p> /reports/2026-w22/7b904b1187/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/7b904b1187/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A UI-process use-after-free on iOS: a DidCommitLoadForFrame IPC during navigation dismisses the date/time picker, and dismissViewControllerAnimated: can synchronously free the WKDateTimePicker; the SetForScope&lt;bool&gt; destructor then writes _isDismissingDatePicker = NO into the freed object. It is a genuine memory-safety fix in the trusted UIProcess, but reachability requires a specific reentrant deallocation the authors could not reproduce deterministically (the commit says no test, verified only via method swizzling), and the write is a single fixed byte to a freed slot, so medium rather than high.</p> /reports/2026-w23/a3f3cda54a85059955df2848f0e8ef77a850c2a8/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/a3f3cda54a85059955df2848f0e8ef77a850c2a8/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/8e3ad95fd1/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/8e3ad95fd1/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: Navigation::reload() gains a frame()-&gt;loader().isDispatchingPageSwapEvent() guard (matching the one already in Navigation::navigate()), so a navigation.reload() invoked during pageswap dispatch is rejected with InvalidStateError. INFERRED per the commit message: a reload transitioning to committed dispatches pageswap; a navigation.reload() inside that handler runs a synchronous policy check that clears the provisional DocumentLoader, and after the event returns HistoryController::updateForCommit() dereferences the now-null FrameLoader::provisionalDocumentLoader(). Medium: a reentrancy-induced null-deref / loader-state UAF crash in the navigation pipeline, script-triggerable but a crash rather than demonstrated corruption.</p> /reports/2026-w34/1603d30438c2628ceb6b413201a1c26b6e5cc192/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/1603d30438c2628ceb6b413201a1c26b6e5cc192/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/5f39d2e310/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/5f39d2e310/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/8ea9912036/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/8ea9912036/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A null-pointer dereference crash in WKWebView on iOS: a client that overrides -[WKWebView setFrame:] can drive frame/bounds and view-layout codepaths during WKWebView initialization before WebPageProxy (_page) exists, dereferencing a null _page. The impact is an app crash reachable purely from client subclassing behavior, not from web content; there is no memory corruption. Medium/0.6: it is a reliable reentrancy crash addressed with straightforward null checks, but the trigger requires a client subclass, limiting the attack surface to app code rather than remote pages.</p> /reports/2026-w22/4f359a0df3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/4f359a0df3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A renderer use-after-free reachable purely from author CSS/DOM on a base-appearance &lt;select&gt;: an author rule makes ::checkmark content depend on :checked, and changing the selection re-runs updatePseudoElement, which frees the existing ::checkmark and then re-attaches a fresh one at a now-dangling beforeChild. The crash lands in RenderTreeBuilder::Block::attach, i.e. inside the render tree with a freed RenderObject* still in hand. It is content-triggerable without special privileges, which argues for more than low; but it is a render-tree-update UAF whose freed object is a pseudo-element renderer and the corrupt pointer is consumed almost immediately, giving a limited grooming window, so medium is appropriate rather than high.</p> /reports/2026-w25/d2af128b14/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/d2af128b14/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This commit is NOT a vulnerability fix; it is opt-in, sampled diagnostic instrumentation to locate an unresolved memory-corruption bug that crashes high volumes of WebContent processes in JSC::WeakImpl::clear() while rehashing DOMWrapperWorld::m_wrappers. The underlying defect is a genuine heap corruption (a stray write leaving a garbage WeakImpl pointer, with the same reused-memory fingerprint appearing in unrelated tables like CodeBlockSet) that Apple could not reproduce even under ASAN. Severity of the underlying bug is potentially high, but this change itself only adds guard-page detection, so medium reflects that it is tooling, not a patch.</p> /reports/2026-w22/69ff7c4b91/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/69ff7c4b91/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/c195e933ce50176cc8364190abe293b5a859836c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/c195e933ce50176cc8364190abe293b5a859836c/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/97721a8704/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/97721a8704/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/1ad0d2a7c3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/1ad0d2a7c3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A cross-process page-identity confusion / missing IPC authorization: WebProcessProxy::didPostMessage() looked up a WebPageProxy by a WebPageProxyIdentifier supplied by a (potentially compromised) WebProcess without verifying that page belongs to the sending process, letting one web process deliver a userscript message as/into a page owned by another process &ndash; a site-isolation boundary and cross-origin integrity violation. The primitive is message injection into another process&rsquo;s page rather than direct memory corruption, and it requires an already-compromised WebProcess, so medium; but the class (unauthenticated pageID in a UIProcess IPC handler) is exactly what site isolation must prevent.</p> /reports/2026-w25/01c89d15c3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/01c89d15c3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This corrects how CSP resolves the &lsquo;self&rsquo; source expression for http(s) documents that have an opaque origin (e.g. a sandboxed iframe without allow-same-origin, or after a cross-origin redirect). A regression (314912@main) had &lsquo;self&rsquo; match nothing, over-blocking same-origin resources; more broadly, incorrect &lsquo;self&rsquo; resolution against a hostless opaque origin is a CSP-enforcement correctness bug where both over-blocking and unintended matching are possible. Impact is policy-enforcement, not memory safety, so medium is appropriate; the demonstrated effect is same-origin content wrongly refused.</p> /reports/2026-w25/150a3a12e5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/150a3a12e5/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a Content Security Policy enforcement-correctness bug: JSON module imports were being checked against script-src instead of connect-src, the directive the spec assigns to them. The impact is policy misapplication in both directions (a policy that allows scripts but restricts connections would wrongly permit a JSON import, and a script-src-only policy could wrongly block one), a bypass/over-block issue rather than memory corruption, so medium severity is appropriate.</p> /reports/2026-w23/cc6b337ba1540c4c071c16103cd2c0fdb8e32564/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/cc6b337ba1540c4c071c16103cd2c0fdb8e32564/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A same-origin navigation whose response carries Content-Security-Policy: sandbox (without allow-same-origin) becomes an opaque-origin document, yet it still received the previous page&rsquo;s captured cross-document view transition - element names, geometry, and rendered snapshots (including sensitive on-screen content) - leaking that state across the very origin boundary the sandbox was meant to erect. Reachability requires the victim to navigate to an attacker-influenced sandboxed response and the previous page to have opted into view transitions, and the leak is a rendered-snapshot/geometry information disclosure rather than arbitrary read, so CVSS 5.3 (network, low complexity, no privileges/UI, confidentiality-only) holds.</p> /reports/2026-w22/4003087f20/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/4003087f20/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: adds a globalObject-&gt;webAssemblyEnabled() CSP gate to webAssemblyCompileFunc, webAssemblyInstantiateFunc, webAssemblyCompileStreamingFunc, webAssemblyInstantiateStreamingFunc (JSWebAssembly.cpp) and constructJSWebAssemblyModule (WebAssemblyModuleConstructor.cpp), each rejecting with a WebAssembly.CompileError before compilation. INFERRED: previously the CSP wasm-unsafe-eval check ran only at instance creation (JSWebAssemblyInstance::tryCreate), so byte compilation via WebAssembly.compile / new WebAssembly.Module / compileStreaming / instantiateStreaming succeeded despite policy. Medium: a policy-enforcement (CSP) bypass, not direct memory corruption, but it defeats a defense-in-depth control and enables transferring a compiled Module to a same-origin Worker where instantiation is unchecked.</p> /reports/2026-w34/6743d4ebb647587a2b5b6ae8df4041490b87eb54/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/6743d4ebb647587a2b5b6ae8df4041490b87eb54/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/64a55fd574c40d8fda92b4f114d2a2afb9f0ec71/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/64a55fd574c40d8fda92b4f114d2a2afb9f0ec71/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/621e3bf30e1d188679b927a6ea34c0c8971e020c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/621e3bf30e1d188679b927a6ea34c0c8971e020c/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is the follow-up that closes the residual boundary-point data race left behind by commit ab488735a4: the first patch mutated m_start and m_end under two separate lock scopes with an unlocked treeOrder read in between, so the concurrent GC visit could still observe a half-updated boundary pair. Reachability and impact are identical to the parent bug — an unprivileged web page holding a live Range and provoking GC can drive a cross-thread race whose consequence is a use-after-free of container Node objects in WebContent — so the assigned High / CVSS 8.1 carries over. Read this together with ab488735a4: it does not fix a new bug so much as finish fixing the old one.</p> /reports/2026-w23/ab488735a47d06ba5753be00ae0212f76e20a5ff/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/ab488735a47d06ba5753be00ae0212f76e20a5ff/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a cross-thread data race on the boundary-point container nodes of live DOM Ranges: the JavaScriptCore GC thread reads m_start/m_end while the main thread mutates them from ordinary DOM APIs (setStart/setEnd/collapse/selectNodeContents/text mutations), racing on the Ref&lt;Node&gt; pointers and their refcounts. The consequence is a use-after-free of container Node objects in WebContent, reachable from unprivileged script on any page that holds a Range and provokes GC, which matches the assigned High / CVSS 8.1 given the powerful renderer-memory-corruption impact tempered by the timing-race attack complexity. This is the first of a related pair; commit 621e3bf30e is the follow-up that closes a residual race this patch leaves in setStart/setEnd.</p> /reports/2026-w21/1aeca6948c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/1aeca6948c/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a JIT soundness bug in JavaScriptCore&rsquo;s optimizing compiler: the DFG abstract interpreter and prediction-propagation phase both assign the type set SpecObjectOther to the result of ArraySortCompact, but the runtime value produced is a JSCellButterfly, whose type belongs to SpecCellOther and is disjoint from SpecObjectOther. A disjoint, wrong type proof is exactly the ingredient that downstream optimizations (CheckStructure elimination, speculation folding, type-based load/store narrowing) trust unconditionally, so it can be parlayed into a type confusion and, from there, a controlled read/write. Exploitability is raised because it is reachable from ordinary Array.prototype.sort with a JS comparator and the confusion is on a cell pointer; it is capped only in that the confused value is an internal butterfly object not directly returned to script, so an attacker must find a downstream node that consumes the bad proof to weaponize it rather than reading it out directly.</p> /reports/2026-w21/23b15df9eb/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/23b15df9eb/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A compromised or malicious web content process could send the UI process a didSameDocumentNavigationForFrameViaJS IPC carrying an arbitrary URL, which the UI process would accept and reflect as the frame&rsquo;s committed location. Because the browser chrome (address bar) reads the UI-process notion of the frame URL, this let script display an attacker-chosen origin — e.g. a bank&rsquo;s https URL — while the page content stayed under attacker control, a high-impact address-bar spoof and the classic building block for credential-phishing. It does not corrupt memory, so it is a spoofing / origin-confusion issue rather than RCE, but address-bar integrity is a core security-boundary property of the browser. The fix is a one-line MESSAGE_CHECK, confirming the pre-patch path performed no origin validation at all.</p> /docs/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/ <p><strong>PatchGap</strong> tracks <em>1-day</em> and <em>n-day</em> vulnerabilities in the major browser engines. For every disclosed CVE it locates the fixing commit, extracts the code change, links the reporter&rsquo;s original bug report and proof-of-concept where the vendor makes it public, and surfaces the <strong>patch gap</strong> — the window in which a fix is visible in the source repository before the CVE is formally disclosed.</p> /reports/2026-w21/ed04ff4067/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/ed04ff4067/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>AudioContext&rsquo;s destructor called document-&gt;removeAudioProducer(*this) while the owning Document was itself mid-destruction, reaching into a Document that may have already freed member state — a use-during-destruction / use-after-free reachable purely from script that creates a WebAudio AudioContext in a document that is then torn down. The added manual test is explicitly an ASAN-reproducible crash, confirming a real memory-safety defect rather than a benign ordering nit. It is rated high because Document teardown UAFs in the renderer are a classic exploit-primitive class (controlled free during a well-defined lifecycle event), though the patch itself demonstrates only a crash. The trigger is ordinary same-origin content, so reachability is trivial; weaponization beyond a crash is unproven from the diff.</p> /reports/2026-w22/5021f999fe/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/5021f999fe/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: DocumentStorageAccess::enableTemporaryTimeUserGesture now constructs its temporary UserGestureIndicator with UserGestureType::ActivationTriggering and, critically, UserGestureIndicator::ProcessInteractionStyle::Never instead of the default Immediate. INFERRED: the no-gesture requestStorageAccess() rejection path installs a temporary gesture so callers keep gesture-gated abilities, but with Immediate it logged user interaction as a side effect; in a popup with an opener that fabricated interaction triggered requestStorageAccessUnderOpener(), silently granting cross-site cookie access with no prompt. Medium: a tracking-prevention / privacy bypass yielding cross-site storage access without consent.</p> /reports/2026-w34/3400ff6aa7b63e840b7cecd229e38e2c19e538ae/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/3400ff6aa7b63e840b7cecd229e38e2c19e538ae/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The change removes cross-thread sharing of a WTF StringImpl between the thread that creates a WebAssembly.Module and the JSC Wasm compiler threads that read its import-name comparison strings, where StringImpl&rsquo;s refcount and interior fields are not all atomic — a data race that can in principle corrupt the refcount and lead to a premature free / use-after-free. The author explicitly characterizes the current site as benign, and no in-the-wild trigger or memory-safety failure is demonstrated, so this is a hardening/hygiene fix; the Medium/6.5 rating reflects the theoretical cross-thread refcount UAF potential of StringImpl sharing rather than a proven exploitable primitive. Because the shared object was an isolatedCopy() intended precisely to avoid sharing, real-world reachability of the race is narrow.</p> /reports/2026-w23/3f1ad2f2e5cc888d49b13d08f41d2b16a33f1be4/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/3f1ad2f2e5cc888d49b13d08f41d2b16a33f1be4/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/df8786e8b6a8fabb2ad9574914a4f33117f8950e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/df8786e8b6a8fabb2ad9574914a4f33117f8950e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/15fa22b107d107d2c48bb99373ac9767dcf1bf62/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/15fa22b107d107d2c48bb99373ac9767dcf1bf62/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug lets a WebExtension inject its content scripts and style sheets into domains the user (or policy) explicitly denied, defeating the per-site permission model that is the extension security boundary. Impact is scoped to the extension&rsquo;s own capabilities on pages it was supposed to be barred from — content-script access to page DOM/DOM-based data on a denied origin — rather than direct browser memory corruption, and it requires an installed extension whose match patterns are broad (e.g. <em>://</em>/*) with a narrower deny. That reachability profile and the injected-content (not privileged-API) blast radius put it at Medium/6.1.</p> /reports/2026-w25/f076e1adb5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/f076e1adb5/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>FEMorphologySoftwareApplier runs SVG feMorphology on multiple worker threads via ParallelJobs, and the shared PixelBuffer was only RefCounted (single-thread refcounting), a thread-safety defect flagged by WebKit&rsquo;s NoUncountedMemberChecker. Concurrent refcount operations and shared mutable pixel storage across threads are a data-race class that can manifest as heap corruption or a use-after-free of the buffer, all reachable from untrusted SVG content in the web process. Because the diff is a substantial correctness refactor and no memory-safety PoC is included, medium is the honest rating.</p> /reports/2026-w25/3e90b93505/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/3e90b93505/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a cross-origin information-leak defense, not a memory-safety defect: filter output derived from currentColor (which can encode :visited link state or otherwise-inaccessible computed style) was reaching a canvas/readback path without being marked as origin-tainting, so a page could read back pixels that encode privileged color information. Impact is confined to same-page style-inference / history-sniffing style leaks rather than code execution, which places it at medium.</p> /reports/2026-w23/1cdc540e6ebee5192b5b5d4fc0202b8bfd37eece/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/1cdc540e6ebee5192b5b5d4fc0202b8bfd37eece/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from any JavaScript that runs the baseline JIT form of <code>delete o.x</code> / <code>delete o[&quot;x&quot;]</code> and assigns the boolean result back over the base register (<code>o = delete o.x</code>), so no exotic API surface is needed and a web page can drive it. A missing generational write barrier lets the GC&rsquo;s remembered set omit a live old-to-new reference, producing a use-after-free that is a strong exploitation primitive; the High/8.1 rating is consistent with a memory-corruption bug that still requires a specific bytecode pattern and GC timing to trigger.</p> /reports/2026-w22/4c43686c30/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/4c43686c30/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium. This is a DOM tree-consistency logic error in ContainerNode::replaceAll, not a directly reachable memory-safety bug. OBSERVED: the commit message itself states the bug is currently unreachable because every existing caller of replaceAll passes either a Text node or nullptr, never an Element, so the short-circuit that skips child removal is never taken in shipping code. The severity is bounded by that latency: no current attacker path. INFERRED: the fix is defensive against a near-future regression — an existing FIXME in HTMLElement::setInnerText() proposes routing Element inserts through replaceAll(), which would immediately activate the latent bug and leave stale, still-parented children in the tree while the insertion logic believes all children were replaced, a classic setup for later use-after-free or double-parenting confusion.</p> /reports/2026-w21/02e76c68f6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/02e76c68f6/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Incoming WebRTC audio and video sources register themselves as sinks on libwebrtc track objects, so libwebrtc delivers media on dedicated audio/video threads via OnData/OnFrame callbacks. Because C++ destroys a derived object&rsquo;s own members before running the base-class destructor — and it was the base destructor&rsquo;s stop() that removed the sink — a source that was still producing data at destruction time had its derived members (e.g. m_audioBufferList, pixel-buffer pools) freed while a concurrent OnData/OnFrame callback could still touch them, a genuine cross-thread use-after-free. It is reachable whenever normal teardown via requestToEnd() is blocked, which the commit notes happens when a RealtimeMediaSourceObserver returns true from preventSourceFromEnding(). This rates high: a UAF driven by remote-peer media timing in the media/GPU process is memory corruption with an attacker (the remote peer) influencing the freed-memory contents and the race window.</p> /reports/2026-w22/81aa535db3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/81aa535db3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A JIT dominance bug in B3CanonicalizePrePostIncrements rewrites the SSA graph even when the moved Add does not dominate all of its uses, producing a miscompiled memory-address computation reachable from ordinary JS running through Atomics loops. Miscompilations in the JSC optimizing backend are classic exploit primitives: a wrong address or wrong value materialized in optimized code can be leveraged into out-of-bounds access and type confusion. The fix is guarded behind &ndash;useB3CanonicalizePrePostIncrements and the trigger is plain typed-array/Atomics code, so it is remotely reachable script. High is appropriate; it is a correctness/type-safety defect in the compiler rather than a directly demonstrated memory write.</p> /reports/2026-w22/8449fc1aac/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/8449fc1aac/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/b9e630270a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/b9e630270a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/8c860928af/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/8c860928af/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a genuine heap use-after-free reachable purely from playback timing in the media pipeline, but the reentrancy window is narrow and depends on a client re-installing a time observer from inside its own periodic callback. The freed object is a WTF::Function (a heap-allocated callable with captured state), and the stale operator() continues executing on the stack against freed storage, which is a controllable-lifetime primitive rather than a mere null deref. It is rated medium because reaching it requires a specific re-entrant setTimeObserver() call pattern that most MediaPlayer clients do not exercise, and there is no demonstrated attacker-controlled heap grooming path in the patch. It is nonetheless a real teardown/reentrancy UAF in AVFoundation media code that runs in the WebContent process.</p> /reports/2026-w23/2a8ad89393e742e18a6df250b4f3fd579b0ead4e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/2a8ad89393e742e18a6df250b4f3fd579b0ead4e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/349e1d8549509c1925480da94432d2212d23903a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/349e1d8549509c1925480da94432d2212d23903a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/0cf61b7a19/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/0cf61b7a19/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/9d60567537546eba3b8e490334a06b2fb3ecb0ae/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/9d60567537546eba3b8e490334a06b2fb3ecb0ae/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a use-after-free in the WebKit UIProcess (the privileged broker that owns every WebProcess), reachable from ordinary web content that creates and quickly removes a cross-site iframe under site isolation. The freed memory is read by an IPC reply lambda during process teardown, giving an attacker a timing-controlled UAF in the most privileged part of the browser; combined with the difficulty of winning the launch/teardown race this squares with the assigned High / CVSS 8.1 (network vector, high attack complexity, no privileges, high impact on confidentiality and integrity).</p> /reports/2026-w21/cc28449d96/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/cc28449d96/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a real use-after-move memory-safety bug in the IPC string-transfer path: TransferString::release() passed memory-&gt;span() and a lambda that moved out the backing RefPtr as sibling arguments, and under GCC&rsquo;s typical right-to-left argument evaluation the move ran first, so span() then read m_data/m_size through a nulled RefPtr, producing a SIGSEGV. It is rated medium because on the primarily-tested Clang toolchain (left-to-right) the bug does not manifest, and the crash is a null-ish deref of a moved-from RefPtr rather than a controllable heap UAF, so realistic impact is a crash / denial of service on GCC-built WebKit (WebKitGTK/WPE). Reachability is straightforward: any IPC-transferred string larger than ~16 KB (transferAsMappingSize) takes the shared-memory path that contains the bug.</p> /reports/2026-w25/5c3bc51f9e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/5c3bc51f9e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/1ea0492626/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/1ea0492626/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/e57f9072af/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/e57f9072af/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: the PAIR_VECTOR_TO_DICTIONARY macro in FontPlatformSerializedAttributes::toCFDictionary now skips any key/value pair where item.first or item.second is null before calling CFDictionaryAddValue. INFERRED (and stated in the commit): paletteColors and variations are IPC-decoded vectors of optional-encoded key/value pairs, so a crafted CacheFont message can carry null RetainPtrs; passing NULL to CFDictionaryAddValue raises NSInvalidArgumentException that propagates uncaught and crashes the GPU process. Medium: an IPC-reachable, unauthenticated (any web content via WebProcess-&gt;GPUProcess) remote crash of the GPU process; a reliability/DoS hardening fix with no demonstrated memory corruption.</p> /reports/2026-w25/f10b871ab9/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/f10b871ab9/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A test-only IPC message, InstallMockContentFilter on NetworkConnectionToWebProcess, was reachable in production builds and overwrote a process-global MockContentFilterSettings singleton in the NetworkProcess. A compromised WebContent process could thereby install a mock content filter that redirects or blocks navigations for every connection served by that NetworkProcess &ndash; a cross-process, cross-tab navigation-integrity bypass. It is medium because it requires an already-compromised/IPC-capable WebContent process as a precondition and yields navigation redirection/blocking rather than direct memory corruption.</p> /reports/2026-w25/0d3713dbb6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/0d3713dbb6/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is an access-control bypass in the UI process pasteboard IPC that lets a sandboxed WebContent process read local filesystem paths (and their sandbox extensions) during a drag-over, before any drop or user confirmation. Disclosure of absolute file paths and, worse, sandbox extension handles undermines the sandbox boundary and can seed further exploitation, but it is an information-disclosure/permission bug rather than direct memory corruption. Reachable by any page during an ordinary drag interaction, so high severity is appropriate.</p> /reports/2026-w34/97df94ead028cddcfc21e48ec6f2f72d25ec1662/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/97df94ead028cddcfc21e48ec6f2f72d25ec1662/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from unprivileged web content: any script can hand JavaScriptCore an enormous function body (via new Function or a large source), and bytecode metadata layout runs during ordinary parsing/compilation in the content process. An unchecked 32-bit offset overflow in UnlinkedMetadataTable::finalize() under-allocates the metadata table, so subsequent metadata writes land out of bounds on a heap-allocated buffer sized smaller than the opcodes require, an RCE-capable linear heap corruption primitive. The high attack surface and memory-corruption impact justify CVSS 8.1; it is not a 9+ only because triggering the overflow requires an extremely large program (tens of millions of metadata-bearing opcodes) that is memory-intensive to construct and is gated behind 64-bit address space.</p> /reports/2026-w21/fc1ef83eae/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/fc1ef83eae/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a trusted-event bypass: an untrusted (script-initiated) click on a &lt;label&gt; was forwarded to the associated form control as a trusted event (isTrusted === true), letting script forge user activation/trust on the control. Trusted-event gating protects sensitive behaviors — here haptic feedback for &lt;input type=checkbox switch&gt;, but the same isTrusted forwarding governs other activation-gated actions — so the bypass has cross-cutting security relevance. The concrete impact in the commit is limited (spoofing trust to trigger haptics after a real gesture), which keeps it below memory-corruption severity, but forging isTrusted on a form control is a real integrity boundary violation.</p> /reports/2026-w23/934ecdc220856de5f97da087b09923355c2c7414/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/934ecdc220856de5f97da087b09923355c2c7414/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Triggerable from ordinary web content: a page builds a small detached DOM subtree, keeps only a TreeWalker referencing an inner node, lets GC reclaim the surrounding tree, then touches the node — no privileged access needed. The stale Node::m_shadowIncludingRoot then points into freed memory, and shadowIncludingRoot()/rootNode() return a reference to a destroyed Node, giving a use-after-free read (and subsequent method dispatch, e.g. RadioButtonGroups updates on checked=true) that is a strong RCE-capable corruption primitive in the WebContent process. Web-reachable heap UAF in the DOM core justifies 8.8 High.</p> /reports/2026-w34/e8b1d6b3bee17692f749f06aa2729107a2e3148d/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/e8b1d6b3bee17692f749f06aa2729107a2e3148d/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/7a310eed9f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/7a310eed9f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Switching the WebRTC TCP socket dispatch queue from concurrent to serial removes a data race on socket callback state in the NetworkProcess, whose most concrete symptom is resolving the same native promise twice. A double-resolve of an RTCPeerConnection-adjacent promise is undefined behavior that in the best case is a benign flaky test and in the worst case a use-after-free or state-machine corruption on freed promise/socket state. It is bounded because the affected code is per-connection socket setup rather than attacker-controlled data parsing, and the commit is framed as a flakiness fix. Rated by the monitor as a data-race/double-resolve, which is a genuine concurrency-safety defect in a network-facing process even if weaponization is uncertain.</p> /reports/2026-w21/d85455322d/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/d85455322d/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a missing IPC authorization check in the NetworkProcess, a privileged process that services IndexedDB for all origins across all web content processes. Before the patch NetworkStorageManager looked up IndexedDB connection and transaction objects purely by attacker-supplied identifiers without verifying the object belonged to the IPC connection that sent the message, so a compromised or malicious WebContent process could reference another origin&rsquo;s IDB connection/transaction and drive cross-origin data leakage or corruption. Severity is high because it crosses the origin/site boundary from a sandboxed content process; it is capped below critical because it requires an already-compromised or specially-crafted WebContent process (it is not reachable purely from unprivileged script) and the primitive is data disclosure/manipulation rather than direct memory corruption.</p> /reports/2026-w23/093f34607a3e8c6bdf6fbe178a68ca96ecc067c6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/093f34607a3e8c6bdf6fbe178a68ca96ecc067c6/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Any web page can trigger the vulnerable path by causing a browser-initiated top-level navigation (the common case for user-typed URLs, bookmarks, and reloads) to a victim origin, causing SameSite=Strict cookies to be transmitted even though the navigation crossed a site boundary. The impact is confidentiality-only leakage of authentication and session cookies that the SameSite=Strict directive is specifically meant to withhold on cross-site navigations, enabling CSRF-style and session-fixation follow-ons; there is no integrity or availability impact and no code execution, which keeps it at Medium/6.5.</p> /reports/2026-w22/86f9503e09/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/86f9503e09/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: adds a lower-bound guard (size &lt;= H264::kNaluTypeSize) before ComputeH264InfoFromAVC continues parsing an SPS NALU from an attacker-supplied avcC (WebCodecs description buffer). INFERRED: without it, a size field smaller than or equal to the NALU-type prefix causes an integer underflow in subsequent length arithmetic, leading to an out-of-bounds read/crash while parsing web-controlled configuration bytes. Medium because the immediate observed effect is a decoder crash (DoS) on attacker data rather than a demonstrated memory-corruption-to-RCE; it lives in libwebrtc&rsquo;s AVC config parser reachable from JavaScript via VideoDecoder.configure.</p> /reports/2026-w34/0fd61004f1b1dcb44797e0e0059910b47be12b85/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/0fd61004f1b1dcb44797e0e0059910b47be12b85/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/25570b9123/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/25570b9123/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/9c6099bea06bf812084dc9118bbae1dcda5937a0/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/9c6099bea06bf812084dc9118bbae1dcda5937a0/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is reachable from any web page that installs a MutationObserver with a subtree registration and then triggers node removal plus garbage collection, all of which are directly script-controllable. A freed Node is dereferenced through a dangling WeakRef both on the main thread (during disconnect()) and on a GC thread (during isReachableFromOpaqueRoots()), giving an attacker a controllable use-after-free of a DOM node object, which is the classic foundation for renderer RCE, justifying CVSS 8.8.</p> /reports/2026-w23/ca8c809f1e71553a22215a67fe9be1d05114e6d6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/ca8c809f1e71553a22215a67fe9be1d05114e6d6/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/446481a1be/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/446481a1be/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a media-containment/isolation bypass reachable only from an already-compromised or IPC-fuzzing WebContent process: it lets a rogue renderer ask the GPU process to instantiate media engines that containment policy is supposed to forbid, widening the GPU-process attack surface. The fix responds with a MESSAGE_CHECK that terminates the offending WebContent, so the demonstrated outcome is process termination (defense-in-depth) rather than proven GPU-process code execution, warranting medium severity.</p> /reports/2026-w25/315ac3073a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/315ac3073a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>WebAuthn origin binding is the entire security guarantee of the API: an assertion or credential must be scoped to the true origin of the requesting frame. A compromised WebContent process could set frameInfo.securityOrigin (and the getAssertion parentOrigin) to an arbitrary value such as <a href="https://bank.com">https://bank.com</a> over IPC, causing the UI process to perform credential ceremonies as if for that origin. That is a direct authentication-bypass / origin-spoofing primitive against phishing-resistant credentials, meriting high severity even though it is not memory corruption.</p> /reports/2026-w25/791d472399/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/791d472399/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/67117c4975bb291a8775a61ee3c19dfe13e50690/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/67117c4975bb291a8775a61ee3c19dfe13e50690/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/c6cd4e07e9/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/c6cd4e07e9/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This closes a UI-process file-access gap reachable from a compromised WebContent process: the renderer could name an arbitrary local path (e.g. /etc/passwd) in RegisterAttachmentIdentifierFromFilePath and have the trusted UI process read that file into an attachment, exfiltrating file contents outside the sandbox. That is a sandbox-boundary confidentiality escape, so high is appropriate; it is not memory corruption and requires prior renderer control, which keeps it below critical.</p> /reports/2026-w21/9850353d12/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/9850353d12/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/84a08d4a5b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/84a08d4a5b/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/958ef3d92e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/958ef3d92e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/2b7262df1a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/2b7262df1a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A UI-process use-after-free: two RemoteLayerTree DisplayLink clients deregistered themselves via existingDisplayLink(), which depends on page()/*m_displayID still being valid at destruction time; when that lookup returned null the client&rsquo;s entry stayed in the DisplayLinkCollection, and a later DisplayLink callback invoked a CheckedRef pointing at zero&rsquo;d/freed memory. It is a real lifetime bug in the trusted UIProcess made more deterministic by prior heap-allocation and dead-store-resilience changes, but it is timing-dependent (requires a DisplayLink callback racing teardown) and not directly content-scriptable to a clean primitive, so medium.</p> /reports/2026-w21/f4ce4a791d/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/f4ce4a791d/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/e269e1967d8d2dd0d4b1ba8bedd38900a46b6102/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/e269e1967d8d2dd0d4b1ba8bedd38900a46b6102/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/1c9e3e8e8bcdd1531787cbf782fbf8020f3340d6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/1c9e3e8e8bcdd1531787cbf782fbf8020f3340d6/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/5b391e6d3b14d549908dad2c6695999291313f30/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/5b391e6d3b14d549908dad2c6695999291313f30/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The overflow is triggered by simply loading a crafted animated PNG that carries an embedded ICC (iCCP) profile and a frame with a nonzero xOffset, which any web page or image reference can supply, so the attack surface is fully web-reachable on GTK/WPE ports built with USE(LCMS). The result is a heap out-of-bounds write via LCMS transforming past the end of the frame buffer, corrupting adjacent heap and on the last row writing past the pixel allocation, a strong primitive for memory corruption; the rating is tempered from critical by being limited to LCMS-enabled ports, giving CVSS 8.1.</p> /reports/2026-w22/2050ddd586/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/2050ddd586/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium. This is a policy/lifetime bug in user-gesture propagation across postMessage, not memory corruption. OBSERVED: the guard that nulls out an expired user-gesture token is the security-relevant change; failing to clear it lets a stale gesture token continue to authorize gesture-gated actions (notably window.open popups) long after the real user interaction ended. Impact is a popup-blocker / user-activation bypass, an annoyance-to-abuse class issue rather than RCE. OBSERVED: this commit adds two byte-identical copies of the expiry guard back-to-back in processPostMessage (the diff shows the same if-block inserted twice). The duplication is harmless functionally — the second check is a no-op once the first has nulled the token — but it is a redundant artifact of the branch cherry-pick/merge process (Originally-landed-as 305413.591 on the safari-7624 branch), not intentional double-guarding.</p> /reports/2026-w22/4f82ed3499/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/4f82ed3499/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium. This is a policy/lifetime bug in user-gesture propagation across postMessage, not memory corruption. OBSERVED: the guard that nulls out an expired user-gesture token is the security-relevant change; failing to clear it lets a stale gesture token continue to authorize gesture-gated actions (notably window.open popups) long after the real user interaction ended. Impact is a popup-blocker / user-activation bypass, an annoyance-to-abuse class issue rather than RCE. OBSERVED: this commit adds yet another identical copy of the expiry guard slightly later in processPostMessage (just before UserGestureIndicator userGestureIndicator(userGestureToForward)), on top of the copies introduced by the companion commit 2050ddd586. The net effect on main is that the same expiry check appears multiple times in a row; only the first has any effect. This is redundant merge residue rather than a distinct fix, but the security-relevant intent — never install an expired forwarded gesture — is correct.</p> /reports/2026-w22/cfbce92003/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/cfbce92003/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>OBSERVED: in LocalDOMWindow::processPostMessage, before constructing the UserGestureIndicator for the forwarded gesture, the patch nulls userGestureToForward if it has already expired past UserGestureToken::maximumIntervalForUserGestureForwarding. INFERRED: previously a chain of postMessage relays kept re-installing the same UserGestureToken, indefinitely extending an otherwise-expired gesture and letting a page open popups (or perform other gesture-gated actions) long after the real user activation should have lapsed. Medium: a user-activation / popup-blocker bypass, an abuse/annoyance and phishing-adjacent control, not memory corruption.</p> /reports/2026-w23/dc24f31e117d804296b6b5a1fa56014a6e9fe21a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/dc24f31e117d804296b6b5a1fa56014a6e9fe21a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/a814080321/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/a814080321/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>An XMLHttpRequest is script-reachable on every web page and its wrapper is visited concurrently by the JSC GC (marking) thread, so the race is trivially reachable by untrusted content. A RefPtr&lt;Document&gt; that the GC thread reads while the main thread nulls it out is a classic cross-thread use-after-free of a large, exploitable DOM object graph, warranting the high rating even though the window is narrow.</p> /reports/2026-w22/597af50a64/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/597af50a64/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>ReadableStreamBYOBReader is obtained via stream.getReader({mode:&lsquo;byob&rsquo;}) and, like the default reader, is visited by the concurrent GC thread which dereferenced m_stream while the main thread could null it. Reachable from ordinary script, cross-thread UAF of a live ReadableStream, so high.</p> /reports/2026-w22/ad57b514bb/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/ad57b514bb/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>ReadableStreamDefaultReader is created by any page that calls stream.getReader(), and its wrapper is visited by the concurrent GC thread which dereferenced m_stream while the main thread could null it via releaseLock/genericRelease/destructor. That is a cross-thread UAF of a live JS-reachable ReadableStream, reachable from untrusted content, hence high.</p> /reports/2026-w25/8d71b72447/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/8d71b72447/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A concurrent garbage-collection thread could dereference an Attr&rsquo;s owner Element after the main thread freed it, a genuine use-after-free/data race in core DOM binding code that is exercised by ordinary attribute manipulation plus GC. It is rated medium because it is a timing-dependent race between the GC marking thread and main-thread DOM mutation rather than a deterministically controllable corruption, and the observed impact is reading a freed Element to compute an opaque root.</p> /reports/2026-w25/b9c7a1bf56/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/b9c7a1bf56/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is an attack-surface reduction fix: an attacker-supplied WebExtension icon could steer which ImageIO codec runs in the UIProcess by controlling magic bytes, exposing exotic, less-scrutinized decoders (PSD, OpenEXR, TIFF) to untrusted data in a privileged process. No specific memory-corruption CVE is claimed in the patch, and the fix hardens rather than repairs a single overflow, so medium severity reflects a plausible but not demonstrated path to UIProcess compromise via a decoder bug.</p> /reports/2026-w34/7684281e4877ed748ef81431c1556cb80db78285/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/7684281e4877ed748ef81431c1556cb80db78285/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/db743cc339/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/db743cc339/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A data race and consequent use-after-free of VoidCallback objects in JSSubscriber&rsquo;s concurrent GC visitation: the GC thread snapshotted teardown callbacks under a lock but then released the lock and visited them, so the main thread could destroy a VoidCallback while the GC thread called visitJSFunctionInGCThread on it. Medium reflects a timing-dependent race in Observable/Subscriber binding code, reachable via the Observable API, with crash-class impact rather than a shown controlled primitive.</p> /reports/2026-w23/f88c5d9a0c4dee653373dd5fd4d0bd20c9f1706a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/f88c5d9a0c4dee653373dd5fd4d0bd20c9f1706a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The racy read happens on the GC marking thread every time a JS reference to a disconnected DOM node is scanned, so it is reachable from ordinary script that holds wrapper references while mutating the tree on the main thread; no special privilege is needed. The consequence is a genuine data race between the concurrent collector reading parent/shadow-host pointers and the main thread mutating those same pointers during insertion/removal, which is undefined behavior that can yield a torn or stale opaque root and mis-marked (prematurely collected) or corrupted objects. CVSS 7.0 (High) is consistent with a memory-safety-adjacent race that is script-reachable but nondeterministic and hard to steer.</p> /reports/2026-w34/313a4e84e9cc3044d9d5587e807074d0d6240dc1/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/313a4e84e9cc3044d9d5587e807074d0d6240dc1/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/4193d2c83f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/4193d2c83f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a use-after-free during destruction of MediaPlayerPrivateMediaSourceAVFObjC, a WebCore media backend used by Media Source Extensions on macOS/iOS. During teardown the destruction of m_mediaSourcePrivate can fire synchronous KVO notifications that re-enter the object through a WeakPtr-guarded callback (the AVFoundation error path calling setNetworkState()), which touches members such as m_logger that C++ has already destroyed because they precede m_mediaSourcePrivate in reverse declaration order. Severity is high because MSE is reachable from ordinary web content and UAF during teardown is a classic exploitable primitive; it is a REGRESSION (introduced at 301011@main) and the window is a narrow, timing-dependent teardown re-entrancy, which somewhat caps reliability.</p> /reports/2026-w25/03015890a6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/03015890a6/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is an out-of-bounds read in WebCore&rsquo;s text-search word-boundary logic (ICUSearcher), reachable from ordinary find-in-page / window.find over attacker-controlled page text containing complex-context (e.g. Thai) runs. The read is past the end of a trimmed context buffer inside the web (content) process, so the impact is information disclosure or a crash rather than direct corruption, matching a medium rating. It is a regression introduced by 311049@main, narrowing the affected-version window.</p> /reports/2026-w21/5e2525e60a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/5e2525e60a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/f78e2fb7cfb10417c5a99affaba7fcad58226c52/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/f78e2fb7cfb10417c5a99affaba7fcad58226c52/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/64ad3f36af0d8f25efc49f0390c7a3732e99c825/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/64ad3f36af0d8f25efc49f0390c7a3732e99c825/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/810f13a41f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/810f13a41f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A script-reachable bad-cast: downcast&lt;RenderListBox&gt; was applied unconditionally to a renderer that, for an appearance:base-select with a freshly-added multiple attribute, is still the generic (non-RenderListBox) renderer. In a release build downcast&lt;&gt; is an unchecked static_cast, so the code operated on a wrong-type object &ndash; a type-confusion crash and potential memory-corruption primitive &ndash; but reaching a controllable corruption state is constrained by the transient renderer-rebuild window, keeping it medium.</p> /reports/2026-w21/63ac45d3bc/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/63ac45d3bc/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/f5376181a6/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/f5376181a6/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/afa9356bdfb252a174b3a0d53184c2ec62a1bcba/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/afa9356bdfb252a174b3a0d53184c2ec62a1bcba/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/e8902beae5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/e8902beae5/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/cc7a6821b7cceb7cb9e2836a9dfc11a42691683a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/cc7a6821b7cceb7cb9e2836a9dfc11a42691683a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/c73014505affe2bd1a831719b86068cc07dcde4a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/c73014505affe2bd1a831719b86068cc07dcde4a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/39b67e68ebc2aed8f549fdf73622f8f6c4871647/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/39b67e68ebc2aed8f549fdf73622f8f6c4871647/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a security-policy downgrade, not a memory-safety bug: on a reload that traverses the back/forward machinery after a process relaunch, EnhancedSecurityTracking::handleBackForwardNavigation read the prior Enhanced Security state from the wrong history item and defaulted it to Disabled, causing the tracker to go dormant, the HTTPS-fallback state to be discarded, and the connection to be silently upgraded back to https. Impact is a loss of an intended protection state (and thus a defeat of the HTTP-fallback decision) rather than direct code execution, and the trigger requires a fairly specific relaunch-then-reload sequence, which places it in the Medium band. There is no memory corruption, so 5.3 is appropriate.</p> /reports/2026-w25/37310f2c57/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/37310f2c57/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A web-process-controlled Int32 delta reaches a UIProcess back/forward index computation. In Swift, signed overflow (and negating INT32_MIN) traps rather than silently wrapping, so the realistic worst case here is a deterministic UIProcess crash / denial of service driven from a compromised or misbehaving WebContent process, not silent memory corruption. It is the Swift port of an already-fixed C++ hardening (314581@main), so it is defense-in-depth on an attacker-reachable integer boundary; medium is appropriate.</p> /reports/2026-w23/8aab904f7092297ec74b591486cc700379fe61d5/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/8aab904f7092297ec74b591486cc700379fe61d5/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/479f2b4542/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/479f2b4542/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Medium (denial-of-service / abusable release assert across the IPC trust boundary). OBSERVED: NetworkConnectionToWebProcess::scheduleResourceLoad() guarded the load identifier with RELEASE_ASSERT(identifier). The identifier arrives from the (less-trusted) WebContent process over IPC; a compromised or malicious WebContent process can send a null/zero identifier, which would fire the RELEASE_ASSERT and crash the shared, higher-privileged network process — taking down networking for all web content, not just the misbehaving process. The fix swaps it for MESSAGE_CHECK, which on a failed check rejects the IPC message and terminates the offending WebContent process instead. INFERRED: this is a robustness/anti-abuse fix at a process boundary, not a memory-corruption primitive, so DoS-class medium.</p> /reports/2026-w25/cb220370b4/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/cb220370b4/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/18a2c9a100/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/18a2c9a100/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/7d09127ca947791dc0a72109466a9b0433ab898e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/7d09127ca947791dc0a72109466a9b0433ab898e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/083c7393fe/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/083c7393fe/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/44ba2b5c11/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/44ba2b5c11/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a script-triggerable process abort in WebCore&rsquo;s CSSOM rule-insertion path: inserting an @namespace rule at a global index that follows one or more @import rules passed an out-of-bounds position into Vector::insert on m_namespaceRules. libc++ hardening (_LIBCPP_HARDENING_MODE_EXTENSIVE) catches the bad subspan and aborts before any write, so on hardened builds this is a reliable denial-of-service rather than memory corruption. On builds without that hardening the same out-of-bounds insert position would be a genuine OOB write into the namespace-rule vector, which is why it is treated as an OOB memory bug.</p> /search/ Mon, 01 Jan 0001 00:00:00 +0000 /search/ /reports/2026-w25/df1c872b25/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/df1c872b25/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/fb75caed1b/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/fb75caed1b/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A compromised or malicious web process could call the NetworkProcess IPC endpoint setRawCookie with an attacker-chosen cookie.domain and url that do not correspond to the firstParty, letting it set cookies for arbitrary domains — a cross-origin cookie injection / session-fixation primitive that undermines origin isolation. Separately, a malformed cookie could throw during NSHTTPCookie creation outside the BLOCK_OBJC_EXCEPTIONS scope and crash the privileged NetworkProcess. Setting cookies for arbitrary domains from a sandbox-escaped renderer is a serious cross-origin/integrity break, warranting high.</p> /reports/2026-w23/0e4040cd014e6b637fe4390c547e1ab82bbf18d7/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/0e4040cd014e6b637fe4390c547e1ab82bbf18d7/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/bc0b5db0e5d31ca7a15a2bf334188ed71004e553/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/bc0b5db0e5d31ca7a15a2bf334188ed71004e553/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/5db4d93144/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/5db4d93144/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/527353138b7cb1b6d6f8b5c8c9fe5bf52c63c266/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/527353138b7cb1b6d6f8b5c8c9fe5bf52c63c266/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w34/c52bbb5187e1602b26568547b57440f196bba56a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/c52bbb5187e1602b26568547b57440f196bba56a/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Any attacker-controlled page that a victim can be lured into loading a cross-origin iframe from can nest a srcdoc iframe and issue credentialed requests (fetch, &lt;img&gt;, form posts) back to a target origin that receive that origin&rsquo;s SameSite=Strict and SameSite=Lax cookies, defeating the CSRF mitigation SameSite exists to provide. Impact is scoped to authenticated cross-site request forgery — no direct code execution or memory corruption — and requires the victim to already have SameSite-protected cookies for the target, so CVSS 6.5 (network, low complexity, no privileges, user interaction, high integrity impact bounded to same-site request forgery) is appropriate.</p> /reports/2026-w21/825d9df307/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/825d9df307/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/a7ea563d0f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/a7ea563d0f/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a cross-thread use-after-free / lifetime race in the GPU process: renderer callbacks captured a non-thread-safe WeakPtr to RemoteAudioVideoRendererProxyManager and ran on other threads, dereferencing it in the window between the owning GPUConnectionToWebProcess reaching refcount zero and its main-thread destruction. A UAF in the GPU process is a serious sandbox-relevant corruption primitive, though the reported artifact is a null-deref crash in ref() surfaced by StabilityTracer, keeping the observed impact at medium. Reachability depends on media-renderer teardown timing rather than a direct scripted trigger.</p> /statistics/ Mon, 01 Jan 0001 00:00:00 +0000 /statistics/ /reports/2026-w21/9b473b0e91/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/9b473b0e91/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/33448fd684/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/33448fd684/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/3bce213c8a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/3bce213c8a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/b88376b534/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/b88376b534/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/96ec73a1e57d67618055237272f866849103669c/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/96ec73a1e57d67618055237272f866849103669c/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>Reachable entirely from unprivileged web content: any page can construct a ReadableStream, override Promise[Symbol.species] inside a cancel callback, and drive the plumbing via pipeTo(), so no prior compromise is required. The bug turns an attacker-shaped JSValue (e.g. the JS number 0) into a JSC::JSPromise* via an unchecked static downcast, after which performPromiseThen executes against a non-promise object, giving a type-confusion primitive suitable for RCE-grade corruption in the WebContent process. Web-reachable + memory-safety-violating type confusion in a JIT-adjacent object model justifies the 8.8 (High) rating.</p> /reports/2026-w25/8384c8455e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/8384c8455e/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug lives in WebRTC Encoded Transform, a surface reachable from any page allowed to use RTCPeerConnection/RTCRtpScriptTransform with no special permission. A type confusion between audio and video encoded frames lets attacker script route a frame of the wrong media type into a sender/receiver back-end whose native code assumes the other type, yielding an out-of-bounds read of encoded-frame memory. Because the mismatch reaches native RTP packetization/decode paths in the WebContent process and can be driven deterministically from JS, high severity is justified; it is a read primitive rather than a direct write, which caps it below critical.</p> /reports/2026-w25/de88d16504/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/de88d16504/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/fa10d866af/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/fa10d866af/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/774fe6ba2f/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/774fe6ba2f/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w21/3758417301/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/3758417301/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This is a heap buffer overflow in the bundled libaom AV1 encoder&rsquo;s frame-extension routine av1_copy_and_extend_frame, reachable through WebRTC/media encode paths that feed images into the AV1 encoder. When the caller requests a size_align larger than the display dimensions the allocated buffer is sized to the crop (display) dimensions while the extension math used the padded dimensions, so the copy/extend writes past the allocation. Severity is high because it is an attacker-influenceable memory-corruption bug in a media codec, but exploitability is capped by the constrained overflow shape (border/alignment-driven, not arbitrary length) and by the fact that reaching it requires driving the AV1 encoder with a specific size_align &gt; display-size configuration.</p> /reports/2026-w25/54e82182ce/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/54e82182ce/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/869d5c5531/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/869d5c5531/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>High. BaseDateAndTimeInputType::didChangeValueFromControl dispatches an input event during date/time editing. A script input handler can set input.type = &rsquo;text&rsquo;, which replaces HTMLInputElement::m_inputType and destroys the BaseDateAndTimeInputType (and its DateTimeEditElement owner) mid-call; execution then continues on the freed object through setupDateTimeChooserParameters/showDateTimeChooser, a use-after-free directly reachable from web content via a normal input event. rdar-backed with a crash regression test.</p> /reports/2026-w25/70753442a3/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/70753442a3/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A use-after-free reachable synchronously from a trivial page: a button with command=close inside an open &lt;dialog&gt; whose beforetoggle handler removes the button&rsquo;s value attribute. The freed memory is the backing store of the invoker&rsquo;s value string, dereferenced during dialog close. Medium reflects that the added test demonstrates only a crash/ASan hit rather than a controlled read-write primitive, though it is deterministically triggerable from unprivileged script.</p> /reports/2026-w34/55d9d9007f54ee61fa38accb59cd88a8d4075847/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w34/55d9d9007f54ee61fa38accb59cd88a8d4075847/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The bug is a cross-thread use-after-free reachable entirely from web content: any page that creates a MediaElementAudioSourceNode over an &lt;audio&gt; element inside an iframe and then removes that iframe drives HTMLMediaElement::stop() into clearMediaPlayer() while the real-time audio render thread may still be inside provideInput(). Because MediaPlayer is DestructionThread::Main, ~MediaPlayer runs synchronously on the main thread and can free the RemoteAudioSourceProvider out from under the render thread&rsquo;s live raw pointer, giving an attacker a race-conditioned dangling-pointer read/call with heap-grooming potential. The window is small and non-deterministic, which is why this rates High/8.1 rather than Critical.</p> /reports/2026-w22/20beac1f6e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/20beac1f6e/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>NamedSlotAssignment drives shadow-DOM slotting, reachable by any page using attachShadow (the default named mode). The patch ships an ASAN crash regression test and fixes a use-after-free where slot map mutation during iteration frees the SlotInfo being dereferenced. Renderer/DOM UAFs of this kind are a common exploitation surface, hence high.</p> /reports/2026-w25/acee67e9af/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/acee67e9af/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>A use-after-free in the WebAssembly streaming-compilation path is reachable directly from script (WebAssembly.compileStreaming/instantiateStreaming) in any document, including a same-origin iframe. The freed objects are a JSGlobalObject and a DeferredWorkTimer TicketData whose contents are attacker-influenced, so the dangling dereference is a strong memory-corruption primitive in the WebContent process; the medium rating reflects that the race window requires iframe teardown timing and the crash is the observed outcome rather than a demonstrated controlled write.</p> /reports/2026-w21/2feb5ed7bc/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/2feb5ed7bc/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>LibWebRTCCodecsProxy runs in the GPUProcess and services createDecoder/createEncoder IPCs from web/content processes keyed by a caller-supplied VideoDecoderIdentifier/VideoEncoderIdentifier. Without validating that the identifier is not already in use, a malicious or buggy client could create a second decoder/encoder object under an identifier already mapped, producing IPC state confusion in the GPUProcess codec maps. The patch adds MESSAGE_CHECKs that reject duplicate identifiers before object creation, closing a state-confusion primitive in a privileged media process. It is a hardening/robustness fix against a compromised content process, hence high but bounded (no demonstrated corruption).</p> /reports/2026-w21/53c3a3a59a/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/53c3a3a59a/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w23/4b574bf8287b6b5783596850d8a17f300b75a7a2/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/4b574bf8287b6b5783596850d8a17f300b75a7a2/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The flaw is remotely reachable by any site that can cause a resource to be handled as a download (via decidePolicyForNavigationAction or decidePolicyForResponse returning Download), including through subframes, and it defeats the Safe Browsing verdict that would otherwise block a known-malicious download. Impact is a security-control bypass rather than direct code execution: the download still lands on disk and the user must open it, so it is an integrity/UX-safety degradation gated on a slow Safe Browsing response, consistent with Medium/6.1.</p> /reports/2026-w21/d8b63073f0/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w21/d8b63073f0/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/b425ed981e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/b425ed981e/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>An inverted end()-iterator check causes resetPermissions() to dereference a past-the-end iterator of m_pageSets whenever the queried registrable domain is absent &ndash; an out-of-bounds / invalid-memory read in the WebContent process. It is medium rather than high because the trigger is a domain-not-found lookup on a geolocation reset path (limited attacker control over the resulting memory contents) and the observable effect is dereferencing it-&gt;value on an invalid iterator, most plausibly a crash rather than a controllable primitive.</p> /reports/2026-w25/d0000cab59/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/d0000cab59/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>This fixes an out-of-bounds access in WebGL2 readPixels into a PIXEL_PACK_BUFFER (PBO) with a byte offset, reachable directly from unprivileged page JavaScript. The pre-patch code fabricated a client-buffer span of size bufferSize starting at the raw offset value and drove the legacy wipeAlphaChannelFromPixels path, so a script-controlled offset produced an out-of-bounds write/read relative to the PBO. Script-reachable graphics OOB in the GPU/graphics path is a serious memory-safety issue, warranting high; the public artifact shows validation/crash-prevention rather than a full exploit.</p> /reports/2026-w23/841ad59485b9991f47dd40dc1c9652bc714f7231/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/841ad59485b9991f47dd40dc1c9652bc714f7231/ <h2 id="the-bug-at-a-glance">The bug at a glance</h2> <p>The vulnerable IPC is exposed to the WebContent process, which is the standard post-renderer-compromise attacker position in WebKit&rsquo;s threat model, so this is a second-stage sandbox-escape-adjacent capability rather than a pure remote bug. A compromised WebContent process could send <code>SetCORSDisablingPatterns</code> with a pattern like <code>*://*/*</code> to the NetworkProcess and defeat same-origin enforcement, letting it read the body of any cross-origin site the user is authenticated to (SOP/CORS bypass, confidentiality-critical). High/8.1 reflects the requirement of an already-compromised renderer combined with the severe cross-origin data-theft impact and no user interaction beyond browsing.</p> /reports/2026-w23/1682be99490a2f051957f351a9d44782b4c579f8/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w23/1682be99490a2f051957f351a9d44782b4c579f8/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w25/b0273bc189/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w25/b0273bc189/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p> /reports/2026-w22/1aba36b70e/ Mon, 01 Jan 0001 00:00:00 +0000 /reports/2026-w22/1aba36b70e/ <p><em>Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.</em></p>