Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 8 | 11 | 14 | 9 | 29 | 71 |
| Sat, 31 Oct 2026 | 11 | 41 | 44 | 0 | 16 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
767 vulnerabilities · Vendor: Google
A use-after-free vulnerability in the Permissions component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page. Google rates the Chromium security severity as Low, and the reviewed sources report no exploitation.
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw in the Network component (CWE-119). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVSS 3.1 base score is 8.8, but Chromium rates the issue as Low severity, and the description limits the impact to code execution inside the sandbox.
Google · Chrome
A memory corruption flaw in the History component of Google Chrome for Android before 156.0.8078.47 can be triggered by a crafted HTML page. An attacker who lures a user to such a page can execute arbitrary code inside the browser sandbox. The victim must open the page, and sandbox-only code execution usually needs a second flaw to escape the sandbox.
Google · Chrome for Android
A use-after-free flaw (CWE-416) in the Core component of Google Chrome on macOS allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a crafted HTML page that the user must open, but no authentication. Chromium rates the severity as Medium and CVSS 3.1 as 8.8 (High). Full system compromise would normally require a second sandbox-escape flaw.
Google · Chrome
Memory corruption in the Voice component of Google Chrome for Android before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker can use it to execute arbitrary code inside the browser sandbox. The attack requires the victim to open the malicious page; the sandbox limits the impact, and CVSS rates it 8.8 (High).
Google · Chrome for Android
A use-after-free flaw in the WebGL component of Google Chrome on Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user opens a crafted HTML page. Code execution inside the sandbox is not a full browser escape, and no sandbox escape has been reported in the sources reviewed.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the component named "Actor". A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, for example through a phishing link or a compromised website. NVD rates the issue with CVSS 3.1 8.8 (High), while Google rates it Medium.
Google · Chrome
A use-after-free flaw in the WebRTC component of Google Chrome allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attacker needs the victim to visit a crafted HTML page, and no login is required. Full compromise would also need a sandbox escape, which this description does not cover. No in-the-wild exploitation or public proof-of-concept was found.
Google · Chrome
Google Chrome on desktop and Android contains a use-after-free vulnerability in the Turbolev component, tracked as CVE-2026-113160 and rated High (CVSS 3.1: 8.8). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no login, but the victim must open the page, so phishing links and malicious advertisements are the likely delivery routes. Whether a separate sandbox escape is needed for full system compromise is unknown.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the Streaming component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. User interaction is required, and the record does not describe a sandbox escape needed for full system compromise. Chromium rates the severity as Medium.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome for Android contains a use-after-free vulnerability (CWE-416) in the Messages component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, and no privileges or account are needed. NVD rates the issue 8.8 (High), while Google rates it Low in its internal Chromium severity.
Google · Chrome
A use-after-free vulnerability in the Glic component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to load a crafted HTML page, so user interaction is required. The NVD rates the CVE at CVSS 3.1 8.8 (High), and the description does not state that the sandbox escape is possible without further conditions.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw (CWE-119) in the Canvas component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. User interaction is required, and no public exploit or known exploitation was found. The NVD CVSS score is 8.8 (High).
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw (CWE-119) in SiteIsolation, Chrome's process-separation mechanism for web content. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user opens the malicious page; the code execution described is confined to the sandbox, so a full compromise would normally need a second flaw. NVD rates the issue 8.8 (High), while Chromium rates it Medium.
Google · Chrome
Memory corruption in the SignIn component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker could potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user opens the malicious page; the sandbox limits the impact, and the vendor rates the issue Low in Chromium's severity scale while the CVSS score is 8.8.
Google · Chrome
Research and translation in progress – available shortly.
The Google Chrome desktop browser contains a memory corruption flaw (CWE-119) in the Bindings component, which connects web APIs to browser internals. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the page, and no authentication is required. The description limits the impact to the sandbox, and full compromise would normally need a further sandbox escape.
Google · Chrome
Google Chrome for desktop contains a memory corruption flaw in its FullScreen component (CVE-2026-113149). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires a user to open the attacker's page, but no authentication is needed. The Chromium bug tracker describes the underlying issue as fullscreen being granted while a tab-modal dialog is shown, which could enable UI spoofing; the official classification remains memory corruption.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in WebUI (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the page, for example by clicking a link or visiting an attacker-controlled site. Chromium rates the issue Medium; NVD lists CVSS 8.8 High.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an input validation flaw in the WebShare component (CVE-2026-113147, CVSS 8.8). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The user must visit the malicious page (UI:R), and the sources do not describe a sandbox escape, so the CVSS score may reflect a worst case.
Google · Chrome
A memory corruption flaw in the PerformanceAPIs component of Google Chrome before 156.0.8078.47 may allow a remote attacker to execute code inside the renderer sandbox. Exploitation requires the victim to open a crafted HTML page, typically through a malicious or compromised website or a phishing link. Full compromise would normally also require a second sandbox-escape flaw; this is an assessment, not a vendor statement. The NVD CVSS score is 8.8 (High), and Chromium rates the issue Medium.
Google · Chrome
Memory corruption in the Messages component of Google Chrome for Android before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker could potentially execute arbitrary code inside the browser sandbox. The attacker needs the user to open the malicious page, for example via a link or a compromised website. Chromium rates the issue Low, and no exploitation is known.
Google · Chrome for Android
Research and translation in progress – available shortly.
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
