Threat database

CVE-2026-102762 is a high-severity vulnerability in the Eclipse Foundation's NetX Duo MQTT client. It causes a memory leak by failing to release packets carrying malformed PUBLISH messages. Each malformed message consumes resources from the network driver's receive pool without returning them, potentially exhausting the pool. This exhaustion halts all inbound network traffic on the affected device until it is rebooted.

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95340 is a vulnerability in Google Chrome's PictureInPicture feature prior to version 154.0.8037.57. It involves incorrect authorization that allows a remote attacker, using social engineering, to bypass the web origin policy via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3.

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

CVE-2026-95316 is a low severity vulnerability in Google Chrome's Performance component prior to version 154.0.8037.57. It involves an unchecked return value that could allow a local attacker to potentially read memory via a local program. The vulnerability has a CVSS score of 2.9, indicating low impact. No known exploits are reported in the wild. The issue is fixed in Chrome version 154.0.8037.57.

A missing authorization vulnerability in Google Chrome on Mac prior to version 154.0.8037.57 allows a remote attacker to obtain cross-origin data via a crafted HTML page through social engineering. The vulnerability has a low Chromium security severity and a CVSS score of 4.3, indicating medium severity.

A missing authorization vulnerability in the V8 engine of Google Chrome prior to version 154.0.8037.57 allows a remote attacker to bypass the web origin policy via a crafted HTML page. The issue has been assigned a medium severity with a CVSS score of 4.3. This vulnerability could enable limited integrity impact without compromising confidentiality or availability.

CVE-2026-95380 is a type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

A confused deputy vulnerability in Google Chrome DevTools prior to version 154.0.8037.57 allows a remote attacker to bypass the web origin policy via a crafted HTML page using social engineering techniques. The issue has a CVSS score of 4.3, indicating medium severity, and does not impact confidentiality or availability but can cause limited integrity loss. Google has released an update to address this vulnerability.

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95326 is a vulnerability in Google Chrome prior to version 154.0.8037.57 involving incomplete cleanup in the Bluetooth component. This flaw allows a remote attacker, through social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a high severity rating with a CVSS score of 8.4. Google has released a stable channel update addressing this issue.

CVE-2026-95319 is a use-after-free vulnerability in the printing component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3. Google has released an update to address this issue.

CVE-2026-95368 is a vulnerability in Google Chrome's DevTools prior to version 154.0.8037.57. It involves incorrect authorization that could allow a remote attacker, using social engineering, to potentially access cross-origin data via a crafted HTML page. The issue has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity overall.

CVE-2026-95385 is a medium severity vulnerability in Google Chrome on Windows prior to version 154.0.8037.57. It involves an inappropriate implementation in the PlatformIntegration component that allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability requires user interaction to be exploited and does not impact confidentiality or availability but can impact integrity.

Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

A vulnerability in Google Chrome prior to version 154.0.8037.57 allows incorrect authorization in DevTools. This flaw enables a remote attacker, using social engineering and a crafted Chrome extension, to bypass the web origin policy. The issue has a medium severity rating with a CVSS score of 5.4.

CVE-2026-95292 is an incorrect authorization vulnerability in the Safe Browsing component of Google Chrome versions prior to 154.0.8037.57. This flaw allows a remote attacker to bypass system access restrictions by sending crafted network traffic. The vulnerability has a medium severity rating with a CVSS score of 4.8. Google has released an update in Chrome version 154.0.8037.57 that addresses this issue.