Tracked app vulnerabilities

MEDIUM 6.5

2026-10-20

Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system acce…

MEDIUM 6.5

2026-10-20

Missing authorization in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information…

MEDIUM 6.5

2026-10-20

Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged …

MEDIUM 6.5

2026-10-20

Incorrect authorization in Autofill in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged so…

MEDIUM 6.5

2026-10-20

Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chro…

MEDIUM 6.5

2026-10-20

Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chrom…

MEDIUM 6.5

2026-10-20

Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitiv…

MEDIUM 6.5

2026-10-20

Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…

MEDIUM 6.5

2026-10-20

Integer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML…

MEDIUM 6.5

2026-10-20

Incorrect authorization in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and levera…

MEDIUM 6.5

2026-10-20

Use after free in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execut…

MEDIUM 6.5

2026-10-20

Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to read memory outside the sandbox via …

MEDIUM 6.5

2026-10-20

Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass s…

MEDIUM 6.5

2026-10-20

Incorrect authorization in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium…

MEDIUM 6.5

2026-10-20

Incomplete cleanup in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engin…

MEDIUM 6.5

2026-10-20

Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to leak cross-or…

MEDIUM 6.5

2026-10-20

Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via…

MEDIUM 6.5

2026-10-20

Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions…

MEDIUM 6.5

2026-10-20

Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute …

MEDIUM 6.5

2026-10-20

Information loss in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (C…

MEDIUM 6.5

2026-10-20

Incomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isol…

MEDIUM 6.5

2026-10-20

Incorrect authorization in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sens…

MEDIUM 5.4

Mozilla Thunderbird

2026-10-20

When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message loa…

MEDIUM 5.3

Mozilla Thunderbird

2026-10-20

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could se…

MEDIUM 5.9

Mozilla Thunderbird

2026-10-20

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unenc…

MEDIUM 5.4

2026-10-20

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same da…

MEDIUM 6.5

2026-10-20

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

MEDIUM 5.4

2026-10-20

Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

MEDIUM 4.3

Xcode

2026-10-20

An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexp…

MEDIUM 5.4

Safari

2026-10-20

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web conte…

MEDIUM 4.3

2026-10-15

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity…

MEDIUM 4.3

2026-10-15

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity:…

MEDIUM 4.3

2026-10-13

Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromi…

MEDIUM 4.2

2026-10-13

Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged s…

MEDIUM 5.5

2026-10-13

Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local pro…

MEDIUM 6.5

2026-10-13

Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information v…

MEDIUM 4.3

2026-10-13

Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sa…

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.