CVE-2026-7904

chromium-browser: Out of bounds read in Fonts

Out of bounds read in Fonts in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7924

chromium-browser: Uninitialized Use in Dawn

Uninitialized Use in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7931

chromium-browser: chromium-browser: Insufficient validation of untrusted input in iOS

Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Iphone Os Chrome

CVE-2026-7933

chromium-browser: Out of bounds read in WebCodecs

Out of bounds read in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7941

chromium-browser: Insufficient validation of untrusted input in Mobile

Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7943

chromium-browser: Insufficient validation of untrusted input in ANGLE

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7944

chromium-browser: Insufficient validation of untrusted input in Persistent Cache

Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7945

chromium-browser: Insufficient validation of untrusted input in COOP

Insufficient validation of untrusted input in COOP in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7947

chromium-browser: Insufficient validation of untrusted input in Network

Insufficient validation of untrusted input in Network in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7982

chromium-browser: Uninitialized Use in WebCodecs

Uninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7983

chromium-browser: Out of bounds read in Dawn

Out of bounds read in Dawn in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7993

chromium-browser: Insufficient validation of untrusted input in Payments

Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7996

chromium-browser: Insufficient validation of untrusted input in SSL

Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7942

chromium-browser: Integer overflow in ANGLE

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7912

chromium-browser: Integer overflow in GPU

Integer overflow in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7934

chromium-browser: Insufficient validation of untrusted input in Popup Blocker

Insufficient validation of untrusted input in Popup Blocker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2026-7939

chromium-browser: Inappropriate implementation in SanitizerAPI

Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google Linux and 1 more

Products

Macos Chrome Linux Kernel and 1 more

CVE-2024-52911

Undisclosed Authorization Control Vulnerability in Bitcoin Core

Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bitcoincore

Products

Bitcoin Core

CVE-2025-31983

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2025-31982

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directl

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management