Search
Find a vulnerability
Search criteria
32844 vulnerabilities by google
CVE-2026-62139 (GCVE-0-2026-62139)
Vulnerability from nvd – Published: 2026-09-11 18:12 – Updated: 2026-09-11 19:29
VLAI
EPSS
VEX
Title
WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
Summary
Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 19:28 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Site Kit by Google |
Affected:
n/a , ≤ 1.186.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T19:28:56.262560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T19:29:07.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "google-site-kit",
"product": "Site Kit by Google",
"vendor": "Google",
"versions": [
{
"changes": [
{
"at": "1.187.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.186.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google \u003c= 1.186.0 versions."
}
],
"value": "Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google \u003c= 1.186.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T18:12:14.315Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/google-site-kit/vulnerability/wordpress-site-kit-by-google-plugin-1-186-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Site Kit by Google Plugin to the latest available version (at least 1.187.0)."
}
],
"value": "Update the WordPress Site Kit by Google Plugin to the latest available version (at least 1.187.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Site Kit by Google plugin \u003c= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62139",
"datePublished": "2026-09-11T18:12:14.315Z",
"dateReserved": "2026-07-13T06:15:23.737Z",
"dateUpdated": "2026-09-11T19:29:07.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83530 (GCVE-0-2026-83530)
Vulnerability from nvd – Published: 2026-09-09 14:56 – Updated: 2026-09-09 15:15
VLAI
EPSS
VEX
Title
Uncontrolled Memory Allocation in cel-go
Summary
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:15 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:15:05.009764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:15:12.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cel-go",
"vendor": "Google",
"versions": [
{
"lessThan": "0.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ali Firas (thesmartshadow)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A user could provide an expression whose string length is longer than the \u003ccode\u003eParserExpressionSizeLimit()\u003c/code\u003e configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced."
}
],
"value": "A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:56:22.918Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"url": "https://github.com/cel-expr/cel-go/pull/1302"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Uncontrolled Memory Allocation in cel-go",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2026-83530",
"datePublished": "2026-09-09T14:56:22.918Z",
"dateReserved": "2026-08-31T16:27:40.016Z",
"dateUpdated": "2026-09-09T15:15:12.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87658 (GCVE-0-2026-87658)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 17:29
VLAI
EPSS
VEX
Summary
Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 17:27 UTC
CWE
- CWE-200 - Information leak
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T17:27:52.236877Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T17:29:14.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information leak",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:40.470Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/496615345"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87658",
"datePublished": "2026-09-09T00:09:40.470Z",
"dateReserved": "2026-09-08T22:44:25.919Z",
"dateUpdated": "2026-09-09T17:29:14.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87657 (GCVE-0-2026-87657)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 20:04
VLAI
EPSS
VEX
Summary
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 20:02 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T20:02:19.407084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T20:04:39.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:38.891Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/542146471"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87657",
"datePublished": "2026-09-09T00:09:38.891Z",
"dateReserved": "2026-09-08T22:44:24.679Z",
"dateUpdated": "2026-09-09T20:04:39.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87656 (GCVE-0-2026-87656)
Vulnerability from nvd – Published: 2026-09-09 00:10 – Updated: 2026-09-09 00:10
VLAI
EPSS
VEX
Summary
Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Severity
No CVSS data available.
CWE
- CWE-754 - Improper state validation
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "Improper state validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:10:01.633Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/513245072"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87656",
"datePublished": "2026-09-09T00:10:01.633Z",
"dateReserved": "2026-09-08T22:44:23.155Z",
"dateUpdated": "2026-09-09T00:10:01.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87655 (GCVE-0-2026-87655)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 19:42
VLAI
EPSS
VEX
Summary
Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 19:39 UTC
CWE
- CWE-1021 - Clickjacking
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87655",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T19:39:17.538771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T19:42:34.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "Clickjacking",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:50.426Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/514023309"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87655",
"datePublished": "2026-09-09T00:09:50.426Z",
"dateReserved": "2026-09-08T22:44:21.957Z",
"dateUpdated": "2026-09-09T19:42:34.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87654 (GCVE-0-2026-87654)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-122 - Buffer overflow
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:55.454Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Buffer overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:34.590Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/536444790"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87654",
"datePublished": "2026-09-09T00:09:34.590Z",
"dateReserved": "2026-09-08T22:44:20.222Z",
"dateUpdated": "2026-09-10T03:55:55.454Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87653 (GCVE-0-2026-87653)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 19:40
VLAI
EPSS
VEX
Summary
UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 19:39 UTC
CWE
- CWE-451 - UI misrepresentation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T19:39:10.369507Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T19:40:24.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "UI misrepresentation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:59.784Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/40058710"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87653",
"datePublished": "2026-09-09T00:09:59.784Z",
"dateReserved": "2026-09-08T22:44:11.492Z",
"dateUpdated": "2026-09-09T19:40:24.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87652 (GCVE-0-2026-87652)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 17:10
VLAI
EPSS
VEX
Summary
Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 17:09 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T17:09:44.638487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T17:10:01.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:43.142Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/499425100"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87652",
"datePublished": "2026-09-09T00:09:43.142Z",
"dateReserved": "2026-09-08T22:44:09.818Z",
"dateUpdated": "2026-09-09T17:10:01.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87651 (GCVE-0-2026-87651)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 15:09
VLAI
EPSS
VEX
Summary
Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:09 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:09:53.573935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:09:57.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:36.323Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/550141694"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87651",
"datePublished": "2026-09-09T00:09:36.323Z",
"dateReserved": "2026-09-08T22:44:08.330Z",
"dateUpdated": "2026-09-09T15:09:57.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87650 (GCVE-0-2026-87650)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-125 - Out of bounds read
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87650",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:56.180Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out of bounds read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:34.305Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/534912743"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87650",
"datePublished": "2026-09-09T00:09:34.305Z",
"dateReserved": "2026-09-08T22:44:04.347Z",
"dateUpdated": "2026-09-10T03:55:56.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87649 (GCVE-0-2026-87649)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 15:38
VLAI
EPSS
VEX
Summary
UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 15:38 UTC
CWE
- CWE-451 - UI misrepresentation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87649",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T15:38:30.347009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T15:38:47.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "UI misrepresentation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:50.717Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/514055890"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87649",
"datePublished": "2026-09-09T00:09:50.717Z",
"dateReserved": "2026-09-08T22:44:02.848Z",
"dateUpdated": "2026-09-10T15:38:47.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87648 (GCVE-0-2026-87648)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:56
VLAI
EPSS
VEX
Summary
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:56:09.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:47.953Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/513048243"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87648",
"datePublished": "2026-09-09T00:09:47.953Z",
"dateReserved": "2026-09-08T22:44:01.118Z",
"dateUpdated": "2026-09-10T03:56:09.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87647 (GCVE-0-2026-87647)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 20:05
VLAI
EPSS
VEX
Summary
Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 20:02 UTC
CWE
- CWE-908 - Uninitialized resource
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T20:02:21.987615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T20:05:13.076Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Uninitialized resource",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:35.090Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/536673946"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87647",
"datePublished": "2026-09-09T00:09:35.090Z",
"dateReserved": "2026-09-08T22:43:59.670Z",
"dateUpdated": "2026-09-09T20:05:13.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87646 (GCVE-0-2026-87646)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87646",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:53.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:35.253Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/539754136"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87646",
"datePublished": "2026-09-09T00:09:35.253Z",
"dateReserved": "2026-09-08T22:43:58.305Z",
"dateUpdated": "2026-09-10T03:55:53.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87645 (GCVE-0-2026-87645)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 18:46
VLAI
EPSS
VEX
Summary
Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 18:46 UTC
CWE
- CWE-754 - Improper state validation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T18:46:07.750739Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T18:46:36.173Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "Improper state validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:44.517Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/502611474"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87645",
"datePublished": "2026-09-09T00:09:44.517Z",
"dateReserved": "2026-09-08T22:43:54.074Z",
"dateUpdated": "2026-09-10T18:46:36.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87644 (GCVE-0-2026-87644)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:56
VLAI
EPSS
VEX
Summary
Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:56:07.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:55.398Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/521616899"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87644",
"datePublished": "2026-09-09T00:09:55.398Z",
"dateReserved": "2026-09-08T22:43:53.011Z",
"dateUpdated": "2026-09-10T03:56:07.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87642 (GCVE-0-2026-87642)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 17:29
VLAI
EPSS
VEX
Summary
Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 17:27 UTC
CWE
- CWE-908 - Uninitialized resource
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87642",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T17:27:50.930988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T17:29:00.197Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Uninitialized resource",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:43.889Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/501644790"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87642",
"datePublished": "2026-09-09T00:09:43.889Z",
"dateReserved": "2026-09-08T22:43:50.591Z",
"dateUpdated": "2026-09-09T17:29:00.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87641 (GCVE-0-2026-87641)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 14:06
VLAI
EPSS
VEX
Summary
Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 14:05 UTC
CWE
- CWE-362 - Race condition
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T14:05:45.690519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T14:06:02.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:55.856Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/523091391"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87641",
"datePublished": "2026-09-09T00:09:55.856Z",
"dateReserved": "2026-09-08T22:43:49.106Z",
"dateUpdated": "2026-09-10T14:06:02.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87639 (GCVE-0-2026-87639)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:56
VLAI
EPSS
VEX
Summary
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87639",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:56:17.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:36.023Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/544415098"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87639",
"datePublished": "2026-09-09T00:09:36.023Z",
"dateReserved": "2026-09-08T22:43:40.671Z",
"dateUpdated": "2026-09-10T03:56:17.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87638 (GCVE-0-2026-87638)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-787 - Out of bounds write
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:43.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out of bounds write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:58.591Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/540024134"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87638",
"datePublished": "2026-09-09T00:09:58.591Z",
"dateReserved": "2026-09-08T22:43:36.323Z",
"dateUpdated": "2026-09-10T03:55:43.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87637 (GCVE-0-2026-87637)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87637",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:41.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:57.226Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/534863145"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87637",
"datePublished": "2026-09-09T00:09:57.226Z",
"dateReserved": "2026-09-08T22:43:35.068Z",
"dateUpdated": "2026-09-10T03:55:41.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87636 (GCVE-0-2026-87636)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-843 - Type confusion
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:30.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Type confusion",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:39.673Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/495541478"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87636",
"datePublished": "2026-09-09T00:09:39.673Z",
"dateReserved": "2026-09-08T22:43:33.945Z",
"dateUpdated": "2026-09-10T03:55:30.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87635 (GCVE-0-2026-87635)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 19:40
VLAI
EPSS
VEX
Summary
UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 19:39 UTC
CWE
- CWE-451 - UI misrepresentation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T19:39:11.210589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T19:40:40.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "UI misrepresentation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:55.700Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/522304737"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87635",
"datePublished": "2026-09-09T00:09:55.700Z",
"dateReserved": "2026-09-08T22:43:32.695Z",
"dateUpdated": "2026-09-09T19:40:40.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87634 (GCVE-0-2026-87634)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:55
VLAI
EPSS
VEX
Summary
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:55:38.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:59.930Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/349994197"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87634",
"datePublished": "2026-09-09T00:09:59.930Z",
"dateReserved": "2026-09-08T22:43:31.433Z",
"dateUpdated": "2026-09-10T03:55:38.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87633 (GCVE-0-2026-87633)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-10 03:56
VLAI
EPSS
VEX
Summary
Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87633",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T03:56:27.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:32.528Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/516996291"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87633",
"datePublished": "2026-09-09T00:09:32.528Z",
"dateReserved": "2026-09-08T22:43:30.067Z",
"dateUpdated": "2026-09-10T03:56:27.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87632 (GCVE-0-2026-87632)
Vulnerability from nvd – Published: 2026-09-09 00:09 – Updated: 2026-09-09 17:25
VLAI
EPSS
VEX
Summary
Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 17:25 UTC
CWE
- CWE-79 - Cross-site scripting
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87632",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T17:25:06.090934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T17:25:25.319Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "153.0.8010.36",
"status": "affected",
"version": "153.0.8010.36",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-site scripting",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T00:09:57.965Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"url": "https://issues.chromium.org/issues/538197156"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-87632",
"datePublished": "2026-09-09T00:09:57.965Z",
"dateReserved": "2026-09-08T22:43:24.930Z",
"dateUpdated": "2026-09-09T17:25:25.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62139 (GCVE-0-2026-62139)
Vulnerability from cvelistv5 – Published: 2026-09-11 18:12 – Updated: 2026-09-11 19:29
VLAI
EPSS
VEX
Title
WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
Summary
Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 19:28 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Site Kit by Google |
Affected:
n/a , ≤ 1.186.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T19:28:56.262560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T19:29:07.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "google-site-kit",
"product": "Site Kit by Google",
"vendor": "Google",
"versions": [
{
"changes": [
{
"at": "1.187.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.186.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google \u003c= 1.186.0 versions."
}
],
"value": "Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google \u003c= 1.186.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-62",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-62 Cross Site Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T18:12:14.315Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/google-site-kit/vulnerability/wordpress-site-kit-by-google-plugin-1-186-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Site Kit by Google Plugin to the latest available version (at least 1.187.0)."
}
],
"value": "Update the WordPress Site Kit by Google Plugin to the latest available version (at least 1.187.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Site Kit by Google plugin \u003c= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62139",
"datePublished": "2026-09-11T18:12:14.315Z",
"dateReserved": "2026-07-13T06:15:23.737Z",
"dateUpdated": "2026-09-11T19:29:07.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83530 (GCVE-0-2026-83530)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:56 – Updated: 2026-09-09 15:15
VLAI
EPSS
VEX
Title
Uncontrolled Memory Allocation in cel-go
Summary
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:15 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:15:05.009764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:15:12.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cel-go",
"vendor": "Google",
"versions": [
{
"lessThan": "0.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ali Firas (thesmartshadow)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A user could provide an expression whose string length is longer than the \u003ccode\u003eParserExpressionSizeLimit()\u003c/code\u003e configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced."
}
],
"value": "A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:56:22.918Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"url": "https://github.com/cel-expr/cel-go/pull/1302"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Uncontrolled Memory Allocation in cel-go",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2026-83530",
"datePublished": "2026-09-09T14:56:22.918Z",
"dateReserved": "2026-08-31T16:27:40.016Z",
"dateUpdated": "2026-09-09T15:15:12.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1158
Vulnerability from certfr_avis - Published: 2026-09-10 - Updated: 2026-09-10
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions 14, 15, 16, 16-qpr2, 17 sans le correctif du 05 septembre 2026",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-21552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21552"
},
{
"name": "CVE-2026-45198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45198"
},
{
"name": "CVE-2026-24090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24090"
},
{
"name": "CVE-2026-28664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28664"
},
{
"name": "CVE-2026-49918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49918"
},
{
"name": "CVE-2026-45529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45529"
},
{
"name": "CVE-2026-0001",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0001"
},
{
"name": "CVE-2026-28627",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28627"
},
{
"name": "CVE-2026-28618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28618"
},
{
"name": "CVE-2026-20502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20502"
},
{
"name": "CVE-2026-20460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20460"
},
{
"name": "CVE-2026-34192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34192"
},
{
"name": "CVE-2026-20473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20473"
},
{
"name": "CVE-2026-28582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28582"
},
{
"name": "CVE-2026-49895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49895"
},
{
"name": "CVE-2025-48566",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48566"
},
{
"name": "CVE-2026-24080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24080"
},
{
"name": "CVE-2026-28603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28603"
},
{
"name": "CVE-2026-58846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58846"
},
{
"name": "CVE-2026-28584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28584"
},
{
"name": "CVE-2026-28600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28600"
},
{
"name": "CVE-2026-45519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45519"
},
{
"name": "CVE-2026-52993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52993"
},
{
"name": "CVE-2026-58820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58820"
},
{
"name": "CVE-2026-49932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49932"
},
{
"name": "CVE-2026-41158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41158"
},
{
"name": "CVE-2026-49926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49926"
},
{
"name": "CVE-2026-28657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28657"
},
{
"name": "CVE-2026-28606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28606"
},
{
"name": "CVE-2026-28638",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28638"
},
{
"name": "CVE-2026-28642",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28642"
},
{
"name": "CVE-2026-28634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28634"
},
{
"name": "CVE-2026-28581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28581"
},
{
"name": "CVE-2026-34196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34196"
},
{
"name": "CVE-2026-25259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25259"
},
{
"name": "CVE-2026-34193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34193"
},
{
"name": "CVE-2026-28658",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28658"
},
{
"name": "CVE-2026-28620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28620"
},
{
"name": "CVE-2026-28613",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28613"
},
{
"name": "CVE-2026-28622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28622"
},
{
"name": "CVE-2025-48565",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48565"
},
{
"name": "CVE-2026-55294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55294"
},
{
"name": "CVE-2026-28614",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28614"
},
{
"name": "CVE-2026-28590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28590"
},
{
"name": "CVE-2026-28663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28663"
},
{
"name": "CVE-2026-20469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20469"
},
{
"name": "CVE-2025-48651",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48651"
},
{
"name": "CVE-2026-22164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22164"
},
{
"name": "CVE-2026-20504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20504"
},
{
"name": "CVE-2026-20497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20497"
},
{
"name": "CVE-2026-24079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24079"
},
{
"name": "CVE-2026-24092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24092"
},
{
"name": "CVE-2026-0054",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0054"
},
{
"name": "CVE-2026-20458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20458"
},
{
"name": "CVE-2026-25289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25289"
},
{
"name": "CVE-2026-22166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22166"
},
{
"name": "CVE-2026-28666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28666"
},
{
"name": "CVE-2026-21733",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21733"
},
{
"name": "CVE-2026-28668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28668"
},
{
"name": "CVE-2026-24091",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24091"
},
{
"name": "CVE-2026-28607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28607"
},
{
"name": "CVE-2026-20477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20477"
},
{
"name": "CVE-2026-28602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28602"
},
{
"name": "CVE-2026-21734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21734"
},
{
"name": "CVE-2026-45197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45197"
},
{
"name": "CVE-2026-28596",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28596"
},
{
"name": "CVE-2026-20503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20503"
},
{
"name": "CVE-2026-27280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27280"
},
{
"name": "CVE-2026-45517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45517"
},
{
"name": "CVE-2026-28660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28660"
},
{
"name": "CVE-2026-24088",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24088"
},
{
"name": "CVE-2026-28671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28671"
},
{
"name": "CVE-2026-55256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55256"
},
{
"name": "CVE-2026-34194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34194"
},
{
"name": "CVE-2026-28633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28633"
},
{
"name": "CVE-2026-12387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12387"
},
{
"name": "CVE-2026-45527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45527"
},
{
"name": "CVE-2026-28662",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28662"
},
{
"name": "CVE-2026-5729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5729"
},
{
"name": "CVE-2026-28631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28631"
},
{
"name": "CVE-2026-55277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55277"
},
{
"name": "CVE-2026-45196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45196"
},
{
"name": "CVE-2026-0084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0084"
},
{
"name": "CVE-2026-20481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20481"
},
{
"name": "CVE-2026-28655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28655"
},
{
"name": "CVE-2026-55273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55273"
},
{
"name": "CVE-2026-28656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28656"
},
{
"name": "CVE-2026-45521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45521"
},
{
"name": "CVE-2026-45531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45531"
},
{
"name": "CVE-2026-55285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55285"
},
{
"name": "CVE-2026-49882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49882"
},
{
"name": "CVE-2026-45195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45195"
},
{
"name": "CVE-2026-49927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49927"
},
{
"name": "CVE-2026-25260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25260"
},
{
"name": "CVE-2026-28650",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28650"
},
{
"name": "CVE-2026-28594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28594"
},
{
"name": "CVE-2026-21548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21548"
},
{
"name": "CVE-2026-45520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45520"
},
{
"name": "CVE-2026-24087",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24087"
},
{
"name": "CVE-2026-7639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7639"
},
{
"name": "CVE-2026-45203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45203"
},
{
"name": "CVE-2026-25294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25294"
},
{
"name": "CVE-2026-49744",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49744"
},
{
"name": "CVE-2026-7476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7476"
},
{
"name": "CVE-2026-28583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28583"
},
{
"name": "CVE-2026-20501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20501"
},
{
"name": "CVE-2026-28623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28623"
},
{
"name": "CVE-2026-28609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28609"
},
{
"name": "CVE-2026-28653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28653"
},
{
"name": "CVE-2026-20461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20461"
},
{
"name": "CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"name": "CVE-2026-4967",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4967"
},
{
"name": "CVE-2026-28652",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28652"
},
{
"name": "CVE-2026-20468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20468"
},
{
"name": "CVE-2026-49743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49743"
},
{
"name": "CVE-2026-21383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21383"
},
{
"name": "CVE-2026-28636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28636"
},
{
"name": "CVE-2026-28611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28611"
},
{
"name": "CVE-2026-0010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0010"
},
{
"name": "CVE-2026-21732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21732"
},
{
"name": "CVE-2026-7477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7477"
},
{
"name": "CVE-2025-48564",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48564"
},
{
"name": "CVE-2026-58941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58941"
},
{
"name": "CVE-2026-58848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58848"
},
{
"name": "CVE-2026-58823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58823"
},
{
"name": "CVE-2026-28644",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28644"
},
{
"name": "CVE-2026-28616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28616"
},
{
"name": "CVE-2026-0008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0008"
},
{
"name": "CVE-2026-41156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41156"
},
{
"name": "CVE-2026-49746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49746"
},
{
"name": "CVE-2026-45525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45525"
},
{
"name": "CVE-2026-12285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12285"
},
{
"name": "CVE-2026-49745",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49745"
},
{
"name": "CVE-2026-49887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49887"
},
{
"name": "CVE-2026-28612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28612"
},
{
"name": "CVE-2026-45515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45515"
},
{
"name": "CVE-2026-20500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20500"
},
{
"name": "CVE-2026-25288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25288"
},
{
"name": "CVE-2026-20457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20457"
},
{
"name": "CVE-2026-28599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28599"
},
{
"name": "CVE-2026-41157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41157"
},
{
"name": "CVE-2026-28630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28630"
},
{
"name": "CVE-2026-45200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45200"
},
{
"name": "CVE-2026-49913",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49913"
},
{
"name": "CVE-2026-49881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49881"
},
{
"name": "CVE-2026-21553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21553"
},
{
"name": "CVE-2026-24081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24081"
},
{
"name": "CVE-2026-45202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45202"
},
{
"name": "CVE-2026-24084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24084"
},
{
"name": "CVE-2026-20459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20459"
},
{
"name": "CVE-2026-20464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20464"
},
{
"name": "CVE-2026-0065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0065"
},
{
"name": "CVE-2026-28617",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28617"
},
{
"name": "CVE-2026-45518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45518"
},
{
"name": "CVE-2026-28639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28639"
},
{
"name": "CVE-2026-34195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34195"
},
{
"name": "CVE-2026-20479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20479"
},
{
"name": "CVE-2026-58822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58822"
},
{
"name": "CVE-2026-20474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20474"
},
{
"name": "CVE-2026-45528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45528"
},
{
"name": "CVE-2026-58839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58839"
},
{
"name": "CVE-2026-43049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43049"
},
{
"name": "CVE-2026-28624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28624"
},
{
"name": "CVE-2026-21549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21549"
},
{
"name": "CVE-2026-20475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20475"
},
{
"name": "CVE-2026-25275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25275"
},
{
"name": "CVE-2026-49921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49921"
},
{
"name": "CVE-2026-28626",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28626"
},
{
"name": "CVE-2026-28572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28572"
},
{
"name": "CVE-2026-28593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28593"
},
{
"name": "CVE-2026-21551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21551"
},
{
"name": "CVE-2026-49919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49919"
},
{
"name": "CVE-2026-58874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58874"
},
{
"name": "CVE-2026-21550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21550"
},
{
"name": "CVE-2026-49879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49879"
},
{
"name": "CVE-2026-28604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28604"
},
{
"name": "CVE-2026-31629",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31629"
},
{
"name": "CVE-2026-20467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20467"
},
{
"name": "CVE-2026-49884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49884"
},
{
"name": "CVE-2026-55290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55290"
}
],
"initial_release_date": "2026-09-10T00:00:00",
"last_revision_date": "2026-09-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1158",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2026-09-07",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01?hl=fr"
}
]
}