Threat database

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it.

CVE-2026-102305 is a UI misrepresentation vulnerability in the SignIn feature of Google Chrome on iOS versions prior to 154.0.8037.92. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. It does not have known exploits in the wild and affects only specific Chrome versions on iOS.

UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-102327 is a vulnerability in Google Chrome's WebView on Android versions prior to 154.0.8037.92. It involves incorrect authorization that could allow a remote attacker, who has compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5.

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability has a high severity rating and affects versions before the fixed release.

A buffer overflow vulnerability exists in the V8 engine of Google Chrome versions prior to 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity and has a CVSS score of 8.8.

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)

CVE-2026-102324 is a use-after-free vulnerability in the PictureInPicture feature of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.3.

CVE-2026-102301 is a high-severity vulnerability in Google Chrome prior to version 154.0.8037.92. It involves an out-of-bounds write in the GPU component that could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability affects desktop versions of Chrome and has a CVSS score of 8.3.

A use-after-free vulnerability exists in the Views component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the FullScreen component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. This vulnerability has a high severity rating and can lead to full compromise of the affected browser instance.

CVE-2026-102304 is a use-after-free vulnerability in the Passwords component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated critical with a CVSS score of 9.6. Google has released an official fix in version 154.0.8037.92.

CVE-2026-102316 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the sandbox by crafting a malicious HTML page. This vulnerability is rated high severity with a CVSS score of 8.8.

Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)