Vulnerabilities
Tracked app vulnerabilities
9,433 CVEs affect a tracked app or OS (all severities, macOS). 106 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 9,433
- Actively exploited
- 106
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-113037
HIGH 8.8
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a … |
|
CVE-2026-113036
HIGH 8.8
Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromiu… |
|
CVE-2026-113035
MEDIUM 6.5
Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute … |
|
CVE-2026-113034
HIGH 8.8
Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and lev… |
|
CVE-2026-113033
HIGH 8.8
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via craf… |
|
CVE-2026-113032
HIGH 8.8
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bypass web… |
|
CVE-2026-113031
HIGH 8.8
Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to pot… |
|
CVE-2026-113030
HIGH 8.8
Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafte… |
|
CVE-2026-113029
HIGH 8.8
Out of bounds write in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute … |
|
CVE-2026-113028
HIGH 8.8
Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a cr… |
|
CVE-2026-113027
HIGH 8.8
Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a cra… |
|
CVE-2026-113026
MEDIUM 6.5
Information loss in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (C… |
|
CVE-2026-113025
HIGH 8.8
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements v… |
|
CVE-2026-113024
HIGH 8.8
Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom… |
|
CVE-2026-113023
CRITICAL 9.6
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chro… |
|
CVE-2026-113022
HIGH 8.8
Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted PDF file. (Chromi… |
|
CVE-2026-113021
HIGH 8.8
Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive i… |
|
CVE-2026-113020
CRITICAL 9.6
Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. … |
|
CVE-2026-113019
HIGH 8.8
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pa… |
|
CVE-2026-113018
HIGH 8.8
Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolatio… |
|
CVE-2026-113017
HIGH 8.8
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbit… |
|
CVE-2026-113016
HIGH 8.8
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictio… |
|
CVE-2026-113015
HIGH 8.8
Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web ori… |
|
CVE-2026-113014
CRITICAL 9.6
Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.… |
|
CVE-2026-113013
HIGH 8.8
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive informa… |
|
CVE-2026-113012
HIGH 8.8
Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code … |
|
CVE-2026-113011
HIGH 8.8
Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromised the renderer p… |
|
CVE-2026-113010
MEDIUM 6.5
Incomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isol… |
|
CVE-2026-113009
HIGH 8.8
UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially sp… |
|
CVE-2026-113008
HIGH 8.8
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leverage… |
|
CVE-2026-113007
CRITICAL 9.6
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML … |
|
CVE-2026-113006
HIGH 8.8
Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged … |
|
CVE-2026-113005
HIGH 8.8
Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
|
CVE-2026-113004
HIGH 8.8
Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted file. (Chromium secur… |
|
CVE-2026-113003
HIGH 8.8
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craf… |
|
CVE-2026-113002
MEDIUM 6.5
Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sens… |
|
CVE-2026-113001
HIGH 8.8
Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chro… |
|
CVE-2026-113000
HIGH 8.8
Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium secu… |
|
CVE-2026-112999
HIGH 8.8
Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. … |
|
CVE-2026-112998
HIGH 8.8
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
|
CVE-2026-112997
HIGH 8.8
Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium secu… |
|
CVE-2026-112996
HIGH 8.8
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom… |
|
CVE-2026-112995
HIGH 8.8
Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. … |
|
CVE-2026-112994
HIGH 8.8
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a craf… |
|
CVE-2026-112993
HIGH 8.8
Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via … |
|
CVE-2026-112992
CRITICAL 9.6
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
|
CVE-2026-86949
HIGH 8.8
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of… |
|
CVE-2026-86948
HIGH 8.8
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sand… |
|
CVE-2026-86875
MEDIUM 4.3
An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexp… |
|
CVE-2026-86874
LOW 3.3
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpecte… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.