CVE-2026-8059
published 2026-06-22CVE-2026-8059: IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.24%
14.4th percentile
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | datacap | — | — |
| ibm | datacap | — | — |
| ibm | datacap | — | — |
| ibm | datacap | 9.1.7 – 1.8.4 | — |
| ibm | datacap_navigator | — | — |
| ibm | datacap_navigator | — | — |
| ibm | datacap_navigator | — | — |
| ibm | datacap_navigator | 9.1.7 – 8.2.1.0 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting.
ghsa_unreviewed·2026-06-22
CVE-2026-8059 [MEDIUM] CWE-79 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting.
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
VulDB
IBM Datacap/Datacap Navigator up to 1.8.4/9.1.8/9.1.9 cross site scripting (EUVD-2026-38282)
vuldb·2026-06-22·CVSS 6.1
CVE-2026-8059 [MEDIUM] IBM Datacap/Datacap Navigator up to 1.8.4/9.1.8/9.1.9 cross site scripting (EUVD-2026-38282)
A vulnerability labeled as problematic has been found in IBM Datacap and Datacap Navigator up to 1.8.4/9.1.8/9.1.9. Impacted is an unknown function. Executing a manipulation can lead to cross site scripting.
This vulnerability appears as CVE-2026-8059. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
Red Hat
chromium-browser: Missing authorization in API
vendor_redhat·2026-10-06·CVSS 6.1
CVE-2026-106208 [MEDIUM] CWE-862 chromium-browser: Missing authorization in API
chromium-browser: Missing authorization in API
Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
A missing authorization flaw was found in the API component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/497062057
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Improper input validation in Mobile
vendor_redhat·2026-10-06·CVSS 9.6
CVE-2026-106414 [CRITICAL] CWE-20 chromium-browser: Improper input validation in Mobile
chromium-browser: Improper input validation in Mobile
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A flaw was found in Google Chrome on iOS. Improper input validation allows a remote attacker to achieve arbitrary code execution outside the application sandbox. By using social engineering to convince a user to visit a specially crafted HTML page, an attacker can exploit this vulnerability to execute unauthorized code on the device.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Use after free in PDF
vendor_redhat·2026-10-06·CVSS 8.8
CVE-2026-106421 [HIGH] CWE-416 chromium-browser: Use after free in PDF
chromium-browser: Use after free in PDF
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
An use after free flaw was found in the PDF component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/567873463
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Missing authorization in Google Lens
vendor_redhat·2026-10-06·CVSS 3.1
CVE-2026-106224 [LOW] CWE-862 chromium-browser: Missing authorization in Google Lens
chromium-browser: Missing authorization in Google Lens
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
A missing authorization flaw was found in the Google Lens component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/502278429
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Integer overflow in Media
vendor_redhat·2026-10-06·CVSS 9.6
CVE-2026-106417 [CRITICAL] CWE-190 chromium-browser: Integer overflow in Media
chromium-browser: Integer overflow in Media
Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
An integer overflow flaw was found in the Media component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/536471438
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Missing authorization in Google Lens
vendor_redhat·2026-10-06·CVSS 4.3
CVE-2026-106217 [MEDIUM] CWE-862 chromium-browser: Missing authorization in Google Lens
chromium-browser: Missing authorization in Google Lens
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
A missing authorization flaw was found in the Google Lens component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/501770489
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Missing authorization in Permissions
vendor_redhat·2026-10-06·CVSS 4.2
CVE-2026-106410 [MEDIUM] CWE-862 chromium-browser: Missing authorization in Permissions
chromium-browser: Missing authorization in Permissions
Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
A missing authorization flaw was found in the Permissions component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/517801814
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Incorrect provision of specified functionality in Mobile
vendor_redhat·2026-10-06·CVSS 6.5
CVE-2026-106361 [MEDIUM] CWE-684 chromium-browser: Incorrect provision of specified functionality in Mobile
chromium-browser: Incorrect provision of specified functionality in Mobile
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
A flaw was found in Google Chrome on iOS. This vulnerability could lead to information disclosure if a remote attacker bypasses the browser's web origin policy, which restricts interactions between different websites. An attacker could exploit this flaw by combining social engineering techniques with specially crafted network traffic to access sensitive cross-origin data.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the G
Red Hat
chromium-browser: Information leak in WebAudio
vendor_redhat·2026-10-06·CVSS 4.3
CVE-2026-106392 [MEDIUM] CWE-200 chromium-browser: Information leak in WebAudio
chromium-browser: Information leak in WebAudio
Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
A flaw was found in chromium-browser's WebAudio component. A remote attacker could exploit this vulnerability by convincing a user to visit a specially crafted HTML page. Successful exploitation can result in information disclosure, potentially allowing the attacker to access sensitive cross-origin data from other websites.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Missing authorization in Navigation
vendor_redhat·2026-10-06·CVSS 7.6
CVE-2026-106196 [HIGH] CWE-862 chromium-browser: Missing authorization in Navigation
chromium-browser: Missing authorization in Navigation
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
A missing authorization flaw was found in the Navigation component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/504215649
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Race condition in V8
vendor_redhat·2026-10-06·CVSS 8.8
CVE-2026-106207 [HIGH] CWE-367 chromium-browser: Race condition in V8
chromium-browser: Race condition in V8
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A race condition flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/554619028
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Incorrect authorization in FileSystem
vendor_redhat·2026-10-06·CVSS 9.6
CVE-2026-106329 [CRITICAL] CWE-863 chromium-browser: Incorrect authorization in FileSystem
chromium-browser: Incorrect authorization in FileSystem
Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
An incorrect authorization flaw was found in the FileSystem component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/562043997
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Incorrect authorization in Unbounded Element
vendor_redhat·2026-10-06·CVSS 4.2
CVE-2026-106295 [MEDIUM] CWE-863 chromium-browser: Incorrect authorization in Unbounded Element
chromium-browser: Incorrect authorization in Unbounded Element
Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
An incorrect authorization flaw was found in the Unbounded Element component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/553138969
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Red Hat
chromium-browser: Incorrect provision of specified functionality in SanitizerAPI
vendor_redhat·2026-10-06·CVSS 4.3
CVE-2026-106390 [MEDIUM] CWE-684 chromium-browser: Incorrect provision of specified functionality in SanitizerAPI
chromium-browser: Incorrect provision of specified functionality in SanitizerAPI
Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
An incorrect provision of specified functionality flaw was found in the SanitizerAPI component of the Chromium browser.
Upstream bug(s):
https://issues.chromium.org/issues/556213916
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-110917 chromium-browser: Memory corruption in SVG
bugzilla·2026-10-15·CVSS 4.3
CVE-2026-110917 [MEDIUM] CVE-2026-110917 chromium-browser: Memory corruption in SVG
CVE-2026-110917 chromium-browser: Memory corruption in SVG
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-110920 chromium-browser: Memory corruption in V8
bugzilla·2026-10-15·CVSS 8.8
CVE-2026-110920 [HIGH] CVE-2026-110920 chromium-browser: Memory corruption in V8
CVE-2026-110920 chromium-browser: Memory corruption in V8
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-110916 chromium-browser: Improper input validation in Desktop
bugzilla·2026-10-15·CVSS 9.6
CVE-2026-110916 [CRITICAL] CVE-2026-110916 chromium-browser: Improper input validation in Desktop
CVE-2026-110916 chromium-browser: Improper input validation in Desktop
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-110152 webkitgtk: Buffer overflow in ANGLE [fedora-all]
bugzilla·2026-10-14·CVSS 9.6
CVE-2026-110152 [CRITICAL] CVE-2026-110152 webkitgtk: Buffer overflow in ANGLE [fedora-all]
CVE-2026-110152 webkitgtk: Buffer overflow in ANGLE [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Bugzilla
CVE-2026-110158 chromium-browser: Use after free in Passwords
bugzilla·2026-10-13
CVE-2026-110158 [HIGH] CVE-2026-110158 chromium-browser: Use after free in Passwords
CVE-2026-110158 chromium-browser: Use after free in Passwords
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-110151 chromium-browser: Use after free in Media
bugzilla·2026-10-13
CVE-2026-110151 [HIGH] CVE-2026-110151 chromium-browser: Use after free in Media
CVE-2026-110151 chromium-browser: Use after free in Media
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Bugzilla
CVE-2026-110146 chromium-browser: Information leak in Passwords
bugzilla·2026-10-13
CVE-2026-110146 [HIGH] CVE-2026-110146 chromium-browser: Information leak in Passwords
CVE-2026-110146 chromium-browser: Information leak in Passwords
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-110153 chromium-browser: Use after free in Media
bugzilla·2026-10-13
CVE-2026-110153 [HIGH] CVE-2026-110153 chromium-browser: Use after free in Media
CVE-2026-110153 chromium-browser: Use after free in Media
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-106245 webkitgtk: Uninitialized resource in ANGLE [fedora-all]
bugzilla·2026-10-09·CVSS 4.3
CVE-2026-106245 [MEDIUM] CVE-2026-106245 webkitgtk: Uninitialized resource in ANGLE [fedora-all]
CVE-2026-106245 webkitgtk: Uninitialized resource in ANGLE [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-106293 webkitgtk: Type confusion in ANGLE [epel-all]
bugzilla·2026-10-09·CVSS 8.3
CVE-2026-106293 [HIGH] CVE-2026-106293 webkitgtk: Type confusion in ANGLE [epel-all]
CVE-2026-106293 webkitgtk: Type confusion in ANGLE [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-106394 chromium-browser: Incomplete cleanup in Glic
bugzilla·2026-10-06·CVSS 4.3
CVE-2026-106394 [MEDIUM] CVE-2026-106394 chromium-browser: Incomplete cleanup in Glic
CVE-2026-106394 chromium-browser: Incomplete cleanup in Glic
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Bugzilla
CVE-2026-106180 chromium-browser: Observable discrepancy in Animation
bugzilla·2026-10-06·CVSS 3.1
CVE-2026-106180 [LOW] CVE-2026-106180 chromium-browser: Observable discrepancy in Animation
CVE-2026-106180 chromium-browser: Observable discrepancy in Animation
Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106357 chromium-browser: Use after free in WebRTC
bugzilla·2026-10-06·CVSS 8.8
CVE-2026-106357 [HIGH] CVE-2026-106357 chromium-browser: Use after free in WebRTC
CVE-2026-106357 chromium-browser: Use after free in WebRTC
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-106360 chromium-browser: Information leak in Payments
bugzilla·2026-10-06·CVSS 4.3
CVE-2026-106360 [MEDIUM] CVE-2026-106360 chromium-browser: Information leak in Payments
CVE-2026-106360 chromium-browser: Information leak in Payments
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106188 chromium-browser: Confused deputy in SignIn
bugzilla·2026-10-06·CVSS 7.1
CVE-2026-106188 [HIGH] CVE-2026-106188 chromium-browser: Confused deputy in SignIn
CVE-2026-106188 chromium-browser: Confused deputy in SignIn
Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106181 chromium-browser: Incorrect reference resolution in DevTools
bugzilla·2026-10-06·CVSS 5.3
CVE-2026-106181 [MEDIUM] CVE-2026-106181 chromium-browser: Incorrect reference resolution in DevTools
CVE-2026-106181 chromium-browser: Incorrect reference resolution in DevTools
Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106359 chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page
bugzilla·2026-10-06
CVE-2026-106359 [MEDIUM] CVE-2026-106359 chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page
CVE-2026-106359 chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Bugzilla
CVE-2026-106324 chromium-browser: Incorrect authorization in WebAppInstalls
bugzilla·2026-10-06·CVSS 6.1
CVE-2026-106324 [MEDIUM] CVE-2026-106324 chromium-browser: Incorrect authorization in WebAppInstalls
CVE-2026-106324 chromium-browser: Incorrect authorization in WebAppInstalls
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106253 chromium-browser: Incorrect authorization in Extensions
bugzilla·2026-10-06·CVSS 4.3
CVE-2026-106253 [MEDIUM] CVE-2026-106253 chromium-browser: Incorrect authorization in Extensions
CVE-2026-106253 chromium-browser: Incorrect authorization in Extensions
Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106321 chromium-browser: Information leak in Editing
bugzilla·2026-10-06·CVSS 4.3
CVE-2026-106321 [MEDIUM] CVE-2026-106321 chromium-browser: Information leak in Editing
CVE-2026-106321 chromium-browser: Information leak in Editing
Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Bugzilla
CVE-2026-106399 chromium-browser: Out of bounds read in Skia
bugzilla·2026-10-06·CVSS 3.3
CVE-2026-106399 [LOW] CVE-2026-106399 chromium-browser: Out of bounds read in Skia
CVE-2026-106399 chromium-browser: Out of bounds read in Skia
Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)
Bugzilla
CVE-2026-106207 chromium-browser: Race condition in V8
bugzilla·2026-10-06·CVSS 8.8
CVE-2026-106207 [HIGH] CVE-2026-106207 chromium-browser: Race condition in V8
CVE-2026-106207 chromium-browser: Race condition in V8
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
2026-06-22
Published