Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 8 | 13 | 19 | 10 | 24 | 74 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
767 vulnerabilities · Vendor: Google
A memory corruption flaw in ANGLE, the graphics translation layer of Google Chrome, allows a remote attacker to read process memory. The attacker needs the victim to open a crafted HTML page in a vulnerable browser. The vendor rates the Chromium severity as Medium, and the CVSS base score is 8.8 according to the CNA; the impact described is confidentiality, not code execution.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability in the Transactions Platform component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The NVD score is 8.8 (High), and the description does not claim a sandbox escape, so full system compromise would require an additional flaw.
Google · Chrome
A use-after-free vulnerability in ANGLE, the graphics layer of Google Chrome on desktop systems, allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker must lure a user to a crafted HTML page, but no login is required. Code execution is limited to the sandbox, so a separate sandbox escape would be needed for full compromise. Google rates the issue as Low severity, while the CNA and CVSS rate it 8.8 (High).
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw in the WebAppInstalls component. A remote attacker who lures a user to a crafted HTML page may be able to execute arbitrary code outside the browser sandbox. The attack requires user interaction (opening the page) but no login.
Google · Chrome
Google Chrome for desktop (Windows, macOS, Linux) and Android contains a memory corruption flaw in the Extensions component. A remote attacker can potentially read memory inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires the user to open the page; Google rates the issue Medium and no active exploitation is known.
Google · Chrome
A memory corruption flaw in the DevTools component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox. Exploitation requires that a user visits a crafted HTML page, for example through a phishing link or a malicious website. Code execution inside the sandbox is usually only one step; a further flaw is needed to escape it and fully compromise the system. Chromium rates the issue Medium.
Google · Chrome
Memory corruption in the PictureInPicture component of Google Chrome desktop allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs a user to open a crafted HTML page. NVD and Microsoft rate the issue CVSS 8.8 (High), and Chromium rates it High. No exploitation in the wild was found in the sources checked.
Google · Chrome
Google Chrome on Windows contains a memory corruption flaw in ANGLE, Chrome's graphics abstraction layer. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVE record gives no sandbox escape, so full system compromise would need a further chained exploit. The NVD and CVSS data show a score of 8.8, but third-party VulDB rates it 6.3 and the exact affected range is disputed.
Google · Chrome
Google Chrome versions prior to 156.0.8078.47 contain a memory corruption flaw in the PlatformIntegration component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, for example while browsing the internet.
Google · Chrome
A memory corruption flaw in the DevTools component of Google Chrome before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits a crafted HTML page. Chromium rates the issue as Low severity, while the CNA scored it CVSS 8.8 (High).
Google · Chrome
Memory corruption in the Bluetooth component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, and no authentication is required. Code execution is limited to the sandbox, so a full compromise would likely also require a sandbox escape. The CVSS 3.1 base score is 8.8 (HIGH) according to the data provided, but this should be verified on NVD.
Google · Chrome
A use-after-free memory error in the Actor component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, so the risk is mainly drive-by exposure through links or compromised websites. The vendor rates the issue Low, and no active exploitation is known. The NVD description and the CNA description differ slightly in wording, so the NVD record should be used as the reference.
Google · Chrome
Research and translation in progress – available shortly.
A missing authorization check in the Animation component of Chrome's Blink rendering engine allows a remote attacker to bypass the web origin policy. The attacker needs a victim to open a crafted HTML page, so user interaction is required. The Chromium tracker classifies the impact as a security-mechanism bypass with information disclosure, so confidentiality impact should be assumed until Google clarifies the advisory.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw (CWE-119) in the Browser component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and no authentication is required.
Google · Chrome
Memory corruption in the PolicyContainer component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attacker needs a victim to open a crafted HTML page, so web browsing and email links are the main risk. NVD and Microsoft rate the issue 9.6 (Critical), while VulDB rates it 6.3 (Medium); Chromium rates it Medium. No exploitation in the wild is known.
Google · Chrome
Google Chrome versions prior to 156.0.8078.47 contain a memory corruption flaw in the built-in DevTools component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack needs no authentication but requires user interaction, such as opening the page.
Google · Chrome
Memory corruption in the DataTransfer component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. An attacker may be able to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, and the sandbox limits the impact, so a further vulnerability would normally be needed for full system compromise. The CNA rates the issue 8.8 (High), while Google rates it Medium.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw in the GPU component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, such as visiting the page.
Google · Chrome
Research and translation in progress – available shortly.
A memory corruption flaw in the ContextMenu component of Google Chrome for Android before 156.0.8078.47 may allow a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker must lure a user to open a crafted HTML page, and no login is required. Google rates the issue Low, and CISA SSVC lists exploitation as none and the flaw as not automatable.
Google · Chrome for Android
Improper input validation in the Media component of Google Chrome before 156.0.8078.47 can be exploited by a remote attacker. A user who opens a crafted HTML page may allow the attacker to potentially execute arbitrary code inside the browser sandbox. The CVSS base score is 8.8 (High); the attack requires user interaction, such as visiting a malicious or compromised website.
Google · Chrome
A use-after-free flaw in the Network component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to visit a crafted HTML page, so user interaction is needed. The CVSS base score is 8.8 (High). Code execution is limited to the sandbox, so a full system compromise normally requires a second sandbox-escape flaw.
Google · Chrome
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
