CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Object lifecycle issue in the Dawn component of Google Chrome prior to 148.0.7778.168. A remote attacker could obtain potentially sensitive information from process memory via a crafted HTML page.
Inappropriate implementation of CORS in Google Chrome on Linux and ChromeOS before 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
A type confusion flaw exists in V8 in Google Chrome prior to 148.0.7778.168. A remote attacker could obtain potentially sensitive information from process memory via a crafted HTML page.
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Insufficient policy enforcement in the Payments component in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension.
Incorrect security UI in Downloads in Google Chrome on Android and Mac before 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Side-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
Google Chrome on Mac and iOS before 148.0.7778.168 contains a heap buffer overflow in SwiftShader. A remote attacker can perform an out-of-bounds memory read via a crafted HTML page.
Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
Heap buffer overflow in the GPU component of Google Chrome on Android prior to 148.0.7778.168. A remote attacker could perform an out of bounds memory write via a crafted HTML page.
Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium severity: High.
Out of bounds read in the GPU component of Google Chrome on Mac and Windows prior to 148.0.7778.168. A remote attacker who had compromised the renderer process could obtain potentially sensitive information from process memory via a crafted HTML page.
Google Chrome on Mac before 148.0.7778.168 contains an out-of-bounds read in the FileSystem component. A remote attacker who convinces a user to perform specific UI gestures can obtain potentially sensitive information from process memory via a crafted HTML page.
Out of bounds read in the UI component of Google Chrome prior to 148.0.7778.168. A remote attacker who had compromised the renderer process could obtain potentially sensitive information from process memory via a crafted HTML page.
Script injection in SanitizerAPI in Google Chrome on Android before 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
Insufficient validation of untrusted input in the GPU component of Google Chrome prior to 148.0.7778.168. A remote attacker who had compromised the renderer process could perform a denial of service via a crafted HTML page.
Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS