Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102311

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-102311

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102311

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102311
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4031 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:07 GMT
Publisher date: Tue, 29 Sep 2026 19:45:03 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102307

Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-102307

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102307

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102307
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4030 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:06 GMT
Publisher date: Tue, 29 Sep 2026 19:45:03 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102313

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-102313

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102313

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102313
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4029 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:05 GMT
Publisher date: Tue, 29 Sep 2026 19:45:02 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102325

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-102325

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102325

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102325
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4019 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:44:59 GMT
Publisher date: Tue, 29 Sep 2026 19:45:04 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102314

UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-102314

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102314

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102314
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4018 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:44:59 GMT
Publisher date: Tue, 29 Sep 2026 19:45:07 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102303

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-102303

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102303

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102303
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4017 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:44:58 GMT
Publisher date: Tue, 29 Sep 2026 19:45:03 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102300

Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-102300

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102300

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102300
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4016 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:44:58 GMT
Publisher date: Tue, 29 Sep 2026 19:45:03 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-102305

UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-102305

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102305

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-102305
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4014 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:44:56 GMT
Publisher date: Tue, 29 Sep 2026 19:45:07 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95368

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95368

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95368

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95368
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3955 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:27 GMT
Publisher date: Tue, 29 Sep 2026 17:31:58 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95317

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

Chrome CVE-2026-95317

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95317

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95317
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3954 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:27 GMT
Publisher date: Tue, 29 Sep 2026 17:31:48 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95316

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)

Chrome CVE-2026-95316

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95316

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95316
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3953 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:26 GMT
Publisher date: Tue, 29 Sep 2026 17:32:00 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95312

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95312

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95312

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95312
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3952 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:26 GMT
Publisher date: Tue, 29 Sep 2026 17:31:53 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95302

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)

Chrome CVE-2026-95302

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95302

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95302
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3951 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:25 GMT
Publisher date: Tue, 29 Sep 2026 17:31:45 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95296

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95296

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95296

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95296
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3950 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:24 GMT
Publisher date: Tue, 29 Sep 2026 17:32:00 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95289

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95289

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95289

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95289
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3949 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:24 GMT
Publisher date: Tue, 29 Sep 2026 17:31:54 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95346

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)

Chrome CVE-2026-95346

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95346

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95346
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3943 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:20 GMT
Publisher date: Tue, 29 Sep 2026 17:31:47 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95337

UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95337

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95337

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95337
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3942 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:20 GMT
Publisher date: Tue, 29 Sep 2026 17:31:47 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95371

Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95371

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95371

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95371
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3940 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:19 GMT
Publisher date: Tue, 29 Sep 2026 17:31:50 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95364

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95364

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95364

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95364
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3939 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:19 GMT
Publisher date: Tue, 29 Sep 2026 17:32:01 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95321

UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95321

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95321

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95321
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3938 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:43:19 GMT
Publisher date: Tue, 29 Sep 2026 17:31:53 GMT

Read the original announcement

Older events