CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allows a local attacker to cause a denial of service via a malicious file.
A vulnerability in the Paint component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is rated as low severity.
A vulnerability in the CSS component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is rated as low severity.
Google Chrome on Android prior to version 149.0.7827.53 has insufficient policy enforcement in Navigation. A remote attacker who compromised the renderer process can bypass navigation restrictions via a crafted HTML page.
Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Severity: Low)
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
A side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Severity: Low)
A vulnerability in the Shortcuts component in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a malicious file. The issue is rated as low severity.
In Google Chrome on Windows prior to 149.0.7827.53, an integer overflow in Chromoting allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event.
Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page.
Google Chrome on iOS prior to version 149.0.7827.53 had insufficient policy enforcement, allowing a remote attacker to bypass discretionary access control via a crafted HTML page.
Inappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass discretionary access control via malicious network traffic.
A vulnerability in the Page Info component in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. The issue is rated as low severity.
Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Insufficient validation of untrusted input in Omnibox in Chrome prior to 149.0.7827.53 allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page, after convincing a user to perform specific UI gestures.
Google Chrome prior to version 149.0.7827.53 has an inappropriate implementation in Passwords. A remote attacker who convinces a user to perform specific UI gestures can leak cross-origin data via a crafted HTML page.
Google Chrome on Android prior to version 149.0.7827.53 has a vulnerability in UI due to inappropriate implementation. A remote attacker can leak cross-origin data via a crafted HTML page. (Severity: Low)
Uninitialized use in the ANGLE component in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Severity: Low.
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS