Vulnerabilities
Tracked app vulnerabilities
813 CVEs affect a tracked app or OS (Critical, macOS). 23 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 813
- Actively exploited
- 23
- Publication window
- 2008-01-16 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-118316
CRITICAL 9.6
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
|
CVE-2026-118312
CRITICAL 9.6
Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML pa… |
|
CVE-2026-118310
CRITICAL 9.6
Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandb… |
|
CVE-2026-118309
CRITICAL 9.6
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain se… |
|
CVE-2026-118308
CRITICAL 9.6
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
|
CVE-2026-118306
CRITICAL 9.6
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
|
CVE-2026-118305
CRITICAL 9.6
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pa… |
|
CVE-2026-84539
CRITICAL 9.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app may be able t… |
|
CVE-2026-113897
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. … |
|
CVE-2026-112690
This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2,… |
|
CVE-2026-112552
CRITICAL 9.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7… |
|
CVE-2026-112526
CRITICAL 9.8
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remot… |
|
CVE-2026-112521
CRITICAL 9.3
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandb… |
|
CVE-2026-112514
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Gold… |
|
CVE-2026-112497
CRITICAL 9.0
This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app ma… |
|
CVE-2026-112478
CRITICAL 9.0
An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be abl… |
|
CVE-2026-112443
CRITICAL 9.1
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpecte… |
|
CVE-2026-111497
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthent… |
|
CVE-2026-113342
CRITICAL 9.6
Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via … |
|
CVE-2026-113336
CRITICAL 9.6
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
|
CVE-2026-113328
CRITICAL 9.6
Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (C… |
|
CVE-2026-113300
CRITICAL 9.6
Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information v… |
|
CVE-2026-113283
CRITICAL 9.6
Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code ou… |
|
CVE-2026-113270
CRITICAL 9.6
Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site is… |
|
CVE-2026-113263
CRITICAL 9.6
Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-ori… |
|
CVE-2026-113261
CRITICAL 9.6
Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system ac… |
|
CVE-2026-113252
CRITICAL 9.6
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to rea… |
|
CVE-2026-113235
CRITICAL 9.6
Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
|
CVE-2026-113222
CRITICAL 9.6
Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium se… |
|
CVE-2026-113211
CRITICAL 9.6
Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass s… |
|
CVE-2026-113189
CRITICAL 9.6
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elemen… |
|
CVE-2026-113186
CRITICAL 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (C… |
|
CVE-2026-113171
CRITICAL 9.6
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elemen… |
|
CVE-2026-113169
CRITICAL 9.6
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI… |
|
CVE-2026-113138
CRITICAL 9.6
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via… |
|
CVE-2026-113126
CRITICAL 9.6
Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged p… |
|
CVE-2026-113116
CRITICAL 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a crafted Chrome ex… |
|
CVE-2026-113089
CRITICAL 9.6
Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome … |
|
CVE-2026-113084
CRITICAL 9.6
Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access … |
|
CVE-2026-113078
CRITICAL 9.6
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute… |
|
CVE-2026-113072
CRITICAL 9.6
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
|
CVE-2026-113056
CRITICAL 9.6
Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. … |
|
CVE-2026-113023
CRITICAL 9.6
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chro… |
|
CVE-2026-113020
CRITICAL 9.6
Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. … |
|
CVE-2026-113014
CRITICAL 9.6
Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.… |
|
CVE-2026-113007
CRITICAL 9.6
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML … |
|
CVE-2026-112992
CRITICAL 9.6
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
|
CVE-2026-110916
CRITICAL 9.6
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbo… |
|
CVE-2026-110165
CRITICAL 9.6
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbo… |
|
CVE-2026-110161
CRITICAL 9.6
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network t… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.