Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
767 vulnerabilities · Vendor: Google
Google Chrome contains a memory corruption flaw in the DisplayLocking component (CWE-119). A remote attacker who lures a user to a crafted HTML page could potentially execute arbitrary code inside the browser sandbox. The attack requires user interaction, such as visiting the page, but no login or privileges. Google rates the Chromium severity as High and the CVSS 3.1 base score is 8.8.
Google · Chrome
A use-after-free flaw in the Passwords component of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, so exposure comes from ordinary web browsing. Per the CVSS vector and CISA SSVC data, exploitation is not automatable and no exploitation has been reported.
Google · Chrome
A use-after-free flaw in the PerformanceAPIs component of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the user to open a crafted HTML page, for example through a phishing link or a compromised website. Google rates the bug Low in its internal Chromium severity, while the CVSS base score is 8.8. The fix is included in Chrome for Android 156.0.8078.47.
Google · Chrome for Android
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw in the Interstitials component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the victim visits the page, for example via a phishing link or a compromised website. Code execution limited to the sandbox does not by itself give full control of the system.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the PrintPreview component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the Chrome sandbox. The attack requires a user to open the malicious page, for example through phishing or a compromised website. Chromium rates the flaw Medium, while NVD scores it 9.6 (Critical).
Google · Chrome
Memory corruption in the Mobile component of Google Chrome on Android allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user opens a crafted HTML page. Google rates the Chromium security severity as Low, and the CVSS score is 8.8. Exploitation in the wild is not known.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the Actor component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires that the user opens the page, for example through a malicious link or a compromised website. Full compromise would normally require a second flaw to escape the sandbox.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the Input component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. No user interaction beyond visiting the page is required according to the CVSS vector, which is rated UI:R, so a victim must still open the page.
Google · Chrome
A use-after-free flaw in the Media component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that a user opens a crafted HTML page. Chromium rates the issue Low, and the CVSS score is 8.8. No evidence of exploitation was found, and the impact is limited to the sandboxed renderer unless the flaw is chained with another vulnerability.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the Permissions component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack requires that a user visits the malicious page; no account is needed. Chromium rates the issue Medium, while NVD and Microsoft score it CVSS 9.6 (Critical).
Google · Chrome
A memory corruption flaw in the 'Actor' component of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a user to open a crafted HTML page, for example through a phishing link or malicious advertisement. Google rates the Chromium severity as Low, while the CVSS base score is 8.8 (High).
Google · Chrome for Android
Research and translation in progress – available shortly.
A use-after-free vulnerability in the Compositing component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to visit a crafted HTML page, so no account is required but user interaction is necessary. Full system compromise would additionally require a separate sandbox escape.
Google · Chrome
A use-after-free flaw in the WebAppInstalls component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, and no login is required. Google rates the Chromium security severity as Low, while the CVSS base score is 8.8. No exploitation in the wild is known.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free flaw in SiteIsolation, the component that isolates websites in separate processes. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the renderer sandbox. The attack requires a user to open the malicious page, and a full compromise would normally also need a sandbox escape, which is not confirmed for this CVE.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain an improper input validation flaw (CWE-20) in the Compositing component. A remote attacker can create a crafted HTML page that could potentially execute arbitrary code outside the browser sandbox. The victim must open the page, and the attack would likely need to be combined with a further flaw to escape the sandbox, which has not been verified.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free vulnerability in the Toolbar component of Google Chrome on Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, so no authentication is required but user interaction is. The vendor rates the issue as Medium severity in Chromium terms.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in DevTools. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No authentication is needed, but the user must load the page. Code execution is limited to the sandbox, and no sandbox escape is described for this CVE.
Google · Chrome
A use-after-free flaw in the Media component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, so the risk is a drive-by attack through any web page. According to the CVE record, the impact is limited to the sandbox; a full system compromise would additionally require a sandbox escape, which is not described.
Google · Chrome
A use-after-free vulnerability (CWE-416) in the Browser component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user visits a crafted HTML page, for example through phishing or a compromised website. NVD rates the issue CVSS 8.8 (High). The Chromium tracker linked in the CVE record appears to describe a different flaw, so the mapping is not confirmed.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the CSS engine (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Exploitation requires that a user visits the page, for example through a link in a phishing email. Google rates the issue Critical; no public exploit and no known exploitation have been reported.
Google · Chrome
A use-after-free vulnerability in the Notifications component of Google Chrome for Android before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, for example through a phishing link or a compromised website, but no login is required. Chromium rates the issue as Medium severity, and no exploitation has been reported. Some root-cause details differ between sources and remain unconfirmed.
Google · Chrome for Android
Research and translation in progress – available shortly.
Memory corruption in the Compositing component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page, for example on a malicious or compromised website. Google rates the Chromium security severity as Medium; the CVSS base score of 8.8 could not be verified against NVD. No exploitation in the wild is known.
Google · Chrome
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
