Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106230

Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106230

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106230

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106230
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9533 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:33 GMT
Publisher date: Tue, 06 Oct 2026 18:41:27 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106181

Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106181

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106181

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106181
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9532 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:32 GMT
Publisher date: Tue, 06 Oct 2026 18:41:15 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103631

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103631

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103631

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103631
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9502 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:18:24 GMT
Publisher date: Fri, 02 Oct 2026 16:07:56 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-103627

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103627

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103627
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9501 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:18:24 GMT
Publisher date: Fri, 02 Oct 2026 16:07:56 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103623

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103623

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103623

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103623
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9499 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:18:23 GMT
Publisher date: Fri, 02 Oct 2026 16:07:56 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103630

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103630

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103630

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103630
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9233 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:13:58 GMT
Publisher date: Fri, 02 Oct 2026 16:07:54 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103629

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103629

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103629

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103629
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8394 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:00:37 GMT
Publisher date: Fri, 02 Oct 2026 16:07:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103626

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103626

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103626

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103626
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8393 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:00:36 GMT
Publisher date: Fri, 02 Oct 2026 16:07:54 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103624

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103624

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103624

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103624
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8392 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:00:36 GMT
Publisher date: Fri, 02 Oct 2026 16:07:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103621

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103621

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103621

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103621
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8391 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:00:34 GMT
Publisher date: Fri, 02 Oct 2026 16:07:54 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103628

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Chrome CVE-2026-103628

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103628

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103628
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8204 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:57:04 GMT
Publisher date: Fri, 02 Oct 2026 16:07:53 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103625

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103625

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103625

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103625
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8202 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:57:02 GMT
Publisher date: Fri, 02 Oct 2026 16:07:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-103622

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-103622

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103622

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103622
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #8201 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:57:02 GMT
Publisher date: Fri, 02 Oct 2026 16:07:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95326

Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95326

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95326

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95326
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #7914 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:52:34 GMT
Publisher date: Tue, 29 Sep 2026 17:31:58 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95385

Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95385

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95385

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95385
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #7891 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:51:15 GMT
Publisher date: Tue, 29 Sep 2026 17:31:58 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95285

Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95285

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95285

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95285
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #7890 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:51:14 GMT
Publisher date: Tue, 29 Sep 2026 17:31:55 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95278

Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-95278

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95278

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95278
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #7889 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:51:14 GMT
Publisher date: Tue, 29 Sep 2026 17:31:56 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95374

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95374

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95374

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95374
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #5706 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:13:03 GMT
Publisher date: Tue, 29 Sep 2026 17:31:52 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95314

Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95314

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95314

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95314
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #5705 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:13:03 GMT
Publisher date: Tue, 29 Sep 2026 17:31:49 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-95303

Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-95303

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-95303

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-95303
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #5704 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:13:02 GMT
Publisher date: Tue, 29 Sep 2026 17:31:48 GMT

Read the original announcement

Older events