Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95363

UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95363

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95363

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95363
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3937 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:18 GMT
Publisher date: Tue, 29 Sep 2026 17:31:50 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95323

UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95323

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95323

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95323
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3936 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:17 GMT
Publisher date: Tue, 29 Sep 2026 17:31:53 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95320

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95320

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95320

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95320
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3935 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:17 GMT
Publisher date: Tue, 29 Sep 2026 17:31:47 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95309

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95309

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95309

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95309
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3934 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:16 GMT
Publisher date: Tue, 29 Sep 2026 17:31:59 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95307

UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95307

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95307

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95307
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3933 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:16 GMT
Publisher date: Tue, 29 Sep 2026 17:31:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95305

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

Chrome CVE-2026-95305

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95305

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95305
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3932 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:15 GMT
Publisher date: Tue, 29 Sep 2026 17:32:01 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95294

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95294

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95294

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95294
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3931 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:15 GMT
Publisher date: Tue, 29 Sep 2026 17:31:47 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95291

UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-95291

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95291

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95291
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3930 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:14 GMT
Publisher date: Tue, 29 Sep 2026 17:31:38 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95288

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95288

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95288

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95288
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3929 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:13 GMT
Publisher date: Tue, 29 Sep 2026 17:31:59 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95279

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95279

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95279

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95279
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3927 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:12 GMT
Publisher date: Tue, 29 Sep 2026 17:31:57 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95382

Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95382

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95382

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95382
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3908 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:01 GMT
Publisher date: Tue, 29 Sep 2026 17:31:44 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95367

Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95367

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95367

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95367
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3907 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:00 GMT
Publisher date: Tue, 29 Sep 2026 17:31:57 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95336

Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95336

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95336

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95336
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3906 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:00 GMT
Publisher date: Tue, 29 Sep 2026 17:31:51 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95360

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95360

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95360

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95360
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3905 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:42:59 GMT
Publisher date: Tue, 29 Sep 2026 17:31:49 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95328

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

Chrome CVE-2026-95328

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95328

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95328
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3903 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:42:58 GMT
Publisher date: Tue, 29 Sep 2026 17:32:00 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-13018

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

Chrome CVE-2026-13018

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-13018

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-13018
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3324 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:33:34 GMT
Publisher date: Mon, 28 Sep 2026 18:53:25 GMT

Read the original announcement