Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)

Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Race Condition in Chromoting Allows Remote Bypass of System Access Restrictions

Race condition in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome WebProtect Race Condition Allows Bypassing System Access via Crafted PDF

Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted PDF file. (Chromium security severity: Low)

Race Condition in Chrome DevTools Enables Remote Access Restriction Bypass

Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Race Condition in Chrome Transactions Platform Enables Remote Information Disclosure

Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Race Condition in V8 Engine Enables Remote Code Execution in Chrome

Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

gnutls: gnutls: Information disclosure via contradictory Key Usage and Extended Key Usage extensions

GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

Race Condition Causing Kernel Memory Corruption and System Termination

A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.

A race condition was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Windows Virtualization-Based Security (VBS) Enclave Security Feature Bypass Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

Windows Network File System Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.

Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.