Threat database

A vulnerability in jeremyckahn Chitchatter affects the isConfigMessageEvent function in the PostMessage Handler component. Manipulating the parentDomain argument leads to improper authentication, allowing remote exploitation. The issue has been publicly disclosed with exploit code available. The vendor responded promptly and released a patch identified by commit e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688. No specific version numbers are provided due to the product's rolling release model.

The private keys of eight eMudhra intermediate Certificate Authority (CA) certificates were compromised and subsequently revoked on October 18, 2026. This incident is tracked under CVE-2026-22063. Although it is not a software vulnerability, the CVE identifier is used to monitor related impacts on NetApp products. The compromise of intermediate CA keys can undermine trust in certificates issued by those CAs.

A use-after-free vulnerability exists in the Layout component of Google Chrome versions prior to 156.0.8078.73. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is classified as critical by Chromium security.

A vulnerability in the Skia component of Google Chrome prior to version 156.0.8078.73 allows remote attackers to potentially execute arbitrary code within the browser sandbox via crafted HTML content. This issue arises from improper input validation.

A vulnerability in Google Chrome prior to version 156.0.8078.73 involves improper input validation in the Command component. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The issue has been fixed in version 156.0.8078.73.

A use-after-free vulnerability exists in the Compositing component of Google Chrome versions prior to 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code within the sandbox by delivering a specially crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A memory corruption vulnerability in the Cache component of Google Chrome versions prior to 156.0.8078.73 could allow a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The issue is classified with high severity by the Chromium security team.

A memory corruption vulnerability exists in the Skia component of Google Chrome versions prior to 156.0.8078.73. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A use-after-free vulnerability exists in PDFium within Google Chrome versions prior to 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code inside the sandbox by delivering a specially crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A use-after-free vulnerability exists in the Modularization component of Google Chrome versions prior to 156.0.8078.73. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The issue has been fixed in version 156.0.8078.73.

A use-after-free vulnerability exists in the Turbolev component of Google Chrome versions prior to 156.0.8078.73. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

An improper access control vulnerability in the Forms component of Google Chrome versions prior to 156.0.8078.73 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue has been fixed in version 156.0.8078.73.

A use-after-free vulnerability in the Paint component of Google Chrome versions prior to 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the sandbox by delivering a crafted HTML page. This vulnerability has been assigned CVE-2026-118353 and is rated with high severity by Chromium security.

A memory corruption vulnerability in the Payments component of Google Chrome versions prior to 156.0.8078.73 allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. This issue has been fixed in version 156.0.8078.73.

A use-after-free vulnerability exists in the Animation component of Google Chrome versions prior to 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code within the browser's sandbox by convincing a user to visit a specially crafted HTML page. The Chromium project has assigned this vulnerability a medium severity rating.

A memory corruption vulnerability exists in the Skia component of Google Chrome versions prior to 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to visit a specially crafted HTML page. The issue is classified with high severity by Chromium security.

An input validation vulnerability in the ReadingList feature of Google Chrome versions prior to 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code within the sandbox by delivering a crafted HTML page. This issue has been fixed in version 156.0.8078.73.

An out-of-bounds write vulnerability exists in the editing component of Google Chrome versions prior to 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The issue has been fixed in version 156.0.8078.73.

An improper input validation vulnerability in the Headless component of Google Chrome versions prior to 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code inside the sandbox by delivering a crafted HTML page. This vulnerability has been fixed in version 156.0.8078.73.

A use-after-free vulnerability exists in the FileSystem component of Google Chrome versions prior to 156.0.8078.73. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has been fixed in version 156.0.8078.73.