Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

847 advisories match Clear all Export 25 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	Unknown	n/a	CVE-2026-99048	In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls... Linux, GoogleLinux, Linux kernel, Google gve	NVD	Oct 23 13:17 UTC
CVE-2026-99048In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls... Executive summary The advisory describes a flaw in the Linux kernel's gve driver, which is the network driver for Google virtual NICs. When XSK pools are disabled, the driver can deadlock on a lock it already holds, so the affected system can hang in that path. The advisory does not state a severity rating, and the fix is a kernel patch that changes the driver to use the locked NAPI disable and enable calls. Technical summary The flaw is a deadlock, a locking bug, in the gve_xsk_pool_disable path of the Linux kernel gve driver. The driver called the unlocked versions of napi_disable and napi_enable even though the netdev lock was already held because gve supports queue management ops, so the thread tried to re-acquire a lock it already held. The advisory says the issue was found in production. The fix replaces the calls with napi_disable_locked and napi_enable_locked, in commit 0cb6939a4dfefa822007b7a71986e06bc4f61f54, and the fixed kernel version is not stated in the advisory. The advisory does not state the CVSS score, attack vector or required privileges, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/0cb6939a4dfefa8…b7a71986e06bc4f61f54 Score No CVSS score published. Affects Linux Google Linux Linux kernel Google gve NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-99047	In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as... Linux, GoogleLinux, Linux kernel, Google gve	NVD	Oct 23 13:17 UTC
CVE-2026-99047In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as... Executive summary A flaw in the Linux kernel's gve network driver, which is used with Google Virtual NIC hardware, causes buffers used for AF_XDP zero-copy to leak when receive rings are stopped. The advisory does not state a severity score or describe an attack, but it says the issue was hit in production. The fix is a kernel patch that frees these buffers when rings are stopped, and the advisory presents it as a stable tree commit. Technical summary This is a resource leak (buffer leak) in the gve driver's DQO receive path for AF_XDP zero-copy buffers. When ring state is reset during queue stop, XSK buffers posted to the NIC were not freed, so they leaked. The fix frees XSK buffers attached to an allocated buf_state in gve_rx_reset_ring_dqo and clears the pointer. The commit is tagged Fixes c1fffc5d66a7 and Cc stable. The advisory does not state affected or fixed kernel version numbers, a CVSS score, attack vector or required privileges, workarounds, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/506f9de069d07a7…7ce3edd2fdf32f4953aa Score No CVSS score published. Affects Linux Google Linux Linux kernel Google gve NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-99046	In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor,... Linux, GoogleLinux, Linux kernel, Google gve	NVD	Oct 23 13:17 UTC
CVE-2026-99046In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor,... Executive summary The advisory concerns a resource leak in the Linux kernel's gve network driver, which is used with Google virtual network hardware. The leak affects AF_XDP zero-copy receive buffers when a receive completion descriptor reports an error. The advisory does not state a severity rating, and the fix is a kernel patch that the stable tree has already incorporated. Technical summary This is a buffer leak (resource management flaw) in the gve driver's DQO RX datapath for AF_XDP zero-copy. When the rx_error bit is set in the RX completion descriptor, the driver freed the buf_state but did not free the attached XSK buffer, so the XSK buffer leaked. The fix, shown in the diff, checks whether buf_state->xsk_buff is set and, if so, calls xsk_buff_free() and gve_free_buf_state() instead of gve_free_buffer(). The advisory references the commit that introduced the bug as c1fffc5d66a7 and the fixing commit 06656aaa7e43ae62b673c2244d27099b8b94a70d, and says the fix is tagged for stable. Affected and fixed kernel version ranges, attack vector and preconditions, workarounds, and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/stable/c/06656aaa7e43ae6…c2244d27099b8b94a70d Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Linux Google Linux Linux kernel Google gve NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.2	CVE-2026-107858	Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent... GoogleGoogle Agent Development Kit (ADK) for Java	NVD	Oct 23 06:17 UTC
CVE-2026-107858Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent... Executive summary The advisory describes a flaw in the development web server (ADK Web) in Google Agent Development Kit that lets a malicious web page reach the server through DNS rebinding and cross-origin WebSocket access. The advisory text provided does not state a severity rating. The fix adds a request origin guard and related checks, and the advisory indicates that listing trusted origins or using a loopback bind address is relevant to protection. Technical summary The weakness is missing origin validation for WebSockets (CWE-1385) and a permissive cross-domain policy with untrusted domains (CWE-942) in the development server. The attack relies on DNS rebinding, where a page resolves its own domain to the local machine, so the server sees a foreign Host or Origin header. The change adds an OriginGuardFilter that rejects a non-loopback Host when the server binds to loopback and rejects a non-loopback Origin on loopback requests, with listed origins exempt and a wildcard origin disabling both checks. Affected and fixed version numbers are not stated in the advisory text. A CVSS score is not stated. Workarounds described include listing the external origin in adk.web.cors.origins, avoiding the wildcard, and setting server.address=127.0.0.1 for AdkWebServer.start() and main(). Exploitation status and detection guidance beyond these checks are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Google Google Agent Development Kit Summarized from github.com/google/adk-java/commit/1ae50…e32833f1db323ef084e1 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Google Google Agent Development Kit (ADK) for Java NIST National Vulnerability DatabasePublished Oct 23, 2026 06:17 UTC Read the advisory
	Critical	9.2	CVE-2026-111497	A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker... Google, Node.jsGoogle Brotli, Node.js	NVD	Oct 22 14:17 UTC
CVE-2026-111497A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker... Executive summary The advisory describes a buffer overflow in the Brotli decoder used by Google Brotli versions 1.0.3 through 1.2.0, and it also covers a set of Node.js security issues. The Node.js Project says the Brotli-related flaw in Node.js can allow remote code execution, and it rates the highest fixed Node.js issues as high severity. The recommended action is to upgrade to the fixed Node.js releases named in the advisory, namely v22.23.4, v24.22.1, or v26.12.1. Technical summary The Brotli flaw is a buffer overflow in c/dec/decode.c, and the advisory says a remote unauthenticated attacker can exploit it, though the rest of that sentence is cut off, so the full attack conditions are not stated. In the Node.js issue, malformed Brotli input causes an invalid block switch to be treated as needing more input, so the decoder keeps writing into an eight-byte buffer, which the advisory says can lead to crash, memory disclosure, or remote code execution. The Node.js advisory names fixed versions v22.23.4, v24.22.1, and v26.12.1, and states that the 22.x, 24.x, and 26.x lines are affected. The advisory does not state a workaround, and it does not give a Brotli fixed version or any detection guidance for the Brotli issue. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…e-2026-111497---high Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Google Node.js Google Brotli Node.js NIST National Vulnerability DatabasePublished Oct 22, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-103090	Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at... GoogleGoogle SAM	NVD	Oct 21 23:17 UTC
CVE-2026-103090Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at... From the advisory Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 allow an unauthenticated remote attacker to retrieve an approved bootstrap-enrolled peer's signed Biscuit identity token by supplying a peer_id obtainable from the unauthenticated GET /info endpoint. A related flaw in POST /enroll allowed any bootstrap-token holder to re-fetch another peer's credential. An attacker can replay the disclosed Biscuit token as a bearer credential on /policies to read mesh authorization policies and on /routers/lease to overwrite advertised router multiaddrs. Users should upgrade to version 0.1.0-alpha.9 or later, which requires cryptographic proof of possession of the enrollment private key on credential-releasing endpoints, enforces rate limiting, and validates router lease addresses. Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Google Google SAM NIST National Vulnerability DatabasePublished Oct 21, 2026 23:17 UTC Read the advisory
	High	8.8	CVE-2026-113344	Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113344Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113343	Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113343Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Memory corruption in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Critical	9.6	CVE-2026-113342	Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113342Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page From the advisory Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Medium	6.5	CVE-2026-113341	Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113341Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page From the advisory Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Medium	6.5	CVE-2026-113340	Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113340Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page From the advisory Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113339	Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113339Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113338	Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113338Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113337	Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113337Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Memory corruption in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Critical	9.6	CVE-2026-113336	Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113336Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page From the advisory Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113335	Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113335Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113334	Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via... GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113334Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via... From the advisory Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Medium	6.5	CVE-2026-113333	Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113333Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page From the advisory Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113332	Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113332Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113331	Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113331Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113330	Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113330Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a... From the advisory Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Medium	6.5	CVE-2026-113329	Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113329Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page From the advisory Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Critical	9.6	CVE-2026-113328	Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113328Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted... From the advisory Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	High	8.8	CVE-2026-113327	Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113327Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page From the advisory Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory
	Medium	6.5	CVE-2026-113326	Memory corruption in Core in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page GoogleGoogle Chrome	NVD	Oct 20 22:19 UTC
CVE-2026-113326Memory corruption in Core in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page From the advisory Memory corruption in Core in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affects Google Google Chrome NIST National Vulnerability DatabasePublished Oct 20, 2026 22:19 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects