Vulnerabilities
Tracked app vulnerabilities
354 CVEs affect a tracked app or OS (Low, all platforms). 0 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 354
- Actively exploited
- 0
- Publication window
- 2015-05-21 → 2026-09-17
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-93384
LOW 3.7
Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass … |
|
CVE-2026-93380
LOW 3.1
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social en… |
|
CVE-2026-93378
LOW 3.1
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isol… |
|
CVE-2026-91747
LOW 3.1
Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data v… |
|
CVE-2026-91730
LOW 3.1
Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
|
CVE-2026-91723
LOW 3.1
Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
|
CVE-2026-91708
LOW 3.1
Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin dat… |
|
CVE-2026-86893
LOW 3.3
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be ab… |
|
CVE-2026-86891
LOW 3.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS… |
|
CVE-2026-86888
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, v… |
|
CVE-2026-86887
LOW 3.3
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be abl… |
|
CVE-2026-84626
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gold… |
|
CVE-2026-84530
An information disclosure issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gol… |
|
CVE-2026-65371
LOW 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.… |
|
CVE-2026-87657
LOW 3.1
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandb… |
|
CVE-2026-87652
LOW 3.1
Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web ori… |
|
CVE-2026-87647
LOW 3.4
Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside… |
|
CVE-2026-87614
LOW 3.1
Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass w… |
|
CVE-2026-87611
LOW 3.1
Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-… |
|
CVE-2026-87576
LOW 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read … |
|
CVE-2026-87539
LOW 3.1
Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chrom… |
|
CVE-2026-87531
LOW 3.1
Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data… |
|
CVE-2026-87525
LOW 2.7
Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local … |
|
CVE-2026-87521
LOW 3.1
Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin da… |
|
CVE-2026-87517
LOW 3.1
Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy … |
|
CVE-2026-87498
LOW 3.1
Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin … |
|
CVE-2026-87485
LOW 3.1
Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin… |
|
CVE-2026-87456
LOW 3.4
Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outsi… |
|
CVE-2026-87452
LOW 3.1
Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentia… |
|
CVE-2026-87451
LOW 3.1
Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin… |
|
CVE-2026-87442
LOW 3.1
Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass w… |
|
CVE-2026-87434
LOW 3.1
Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin p… |
|
CVE-2026-55290
LOW 3.3
In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with … |
|
CVE-2026-49895
LOW 3.5
In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (… |
|
CVE-2026-45525
LOW 3.3
In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no… |
|
CVE-2026-45521
LOW 3.3
In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosur… |
|
CVE-2026-45519
LOW 3.3
In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local i… |
|
CVE-2026-28671
LOW 3.3
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure … |
|
CVE-2026-28660
LOW 3.3
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with… |
|
CVE-2026-28652
LOW 3.1
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure … |
|
CVE-2026-28638
LOW 3.3
In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local informat… |
|
CVE-2026-28630
LOW 3.3
In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure… |
|
CVE-2026-28623
LOW 3.3
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could … |
|
CVE-2026-28622
LOW 3.3
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local i… |
|
CVE-2026-28582
LOW 3.3
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permiss… |
|
CVE-2026-0054
LOW 3.3
In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead… |
|
CVE-2026-85052
LOW 3.1
Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory … |
|
CVE-2026-84359
LOW 3.1
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
|
CVE-2026-84355
LOW 3.1
Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web … |
|
CVE-2026-84331
LOW 3.1
Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.