Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Mon, 2 Nov 2026 | 2 | 0 | 1 | 0 | 0 | 3 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
767 vulnerabilities · Vendor: Google
A use-after-free vulnerability in the Input component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open a crafted HTML page, so the risk is drive-by via malicious or compromised websites. Full compromise typically requires an additional sandbox escape, which is not described in this CVE.
Google · Chrome
A use-after-free vulnerability in the Chromoting component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a victim to open a crafted HTML page. Chromium rates the issue as low severity, and CISA SSVC assessments show no exploitation and no automatable attack path.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the Media component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs the victim to load a crafted HTML page, so ordinary web browsing is enough to be exposed. The CVSS base score is 8.8, while Chromium rates the bug Medium. The sources reviewed report no exploitation.
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw in the OptimizationGuide component. A remote attacker can craft an HTML page that may lead to arbitrary code execution inside the browser sandbox. The attack requires that a user visits the malicious page; the CVSS base score is 8.8 (High).
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain an improper input validation flaw (CWE-20) in Chromoting, the component behind Chrome Remote Desktop. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must visit the malicious page, and the description does not show a sandbox escape. NVD lists a CVSS 3.1 base score of 8.8 (High), while Chromium rates the issue Low.
Google · Chrome
Google Chrome before 156.0.8078.47 contains an improper input validation flaw in its API, rated Medium by Google. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must visit the malicious page, for example through a compromised website or a link in a phishing email. The sources do not describe a sandbox escape.
Google · Chrome
A memory corruption flaw in the Chromoting component of Google Chrome before 156.0.8078.47 can be triggered by a remote attacker using a crafted HTML page. Successful exploitation could allow arbitrary code execution inside the browser sandbox. The victim must load the crafted page, and a separate sandbox escape would be needed for full compromise. Google rates the bug Low, while the CVSS score in the NVD entry is 8.8 (High).
Google · Chrome
Google Chrome contains an improper input validation flaw in its Bluetooth component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CNA rates the issue as CVSS 3.1 8.8 (High), with user interaction required. The sources do not state whether an additional prerequisite, such as a compromised renderer, is needed.
Google · Chrome
A memory corruption flaw in the Sensor component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker could potentially execute arbitrary code inside the browser sandbox. The victim must visit the malicious page, and the Chromium bug report describes a sandbox escape that requires an already compromised renderer.
Google · Chrome
A use-after-free flaw in the WebUI component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, for example through a phishing link or a malicious advertisement. The CVE record rates the issue High (CVSS 8.8) and describes code execution inside the sandbox only, without a sandbox escape.
Google · Chrome
CVE-2026-113057 is an improper access control flaw in the ComputePressure web API of Google Chrome. A remote attacker can use a crafted HTML page to bypass the web origin policy, which is possible when a user visits that page. The CVE record rates it 8.8 (CVSS 3.1, high), while Chromium rates it Medium and VulDB rates it 6.3, so the severity is disputed.
Google · Chrome
Google Chrome desktop builds before 156.0.8078.47 contain a memory corruption flaw in the PerformanceAPIs component (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack only requires that a user visits the malicious page, and no login is needed. Google rates the Chromium severity as Low, while NVD scores the CVE 9.6 (Critical).
Google · Chrome
A type confusion flaw in the FullScreen component of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, and no authentication is required. The description does not cover a sandbox escape, so full device compromise is not described. Google rates the issue Medium severity in Chromium.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free vulnerability (CWE-416) in the Cookies component of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the user to open a crafted HTML page. The CVSS base score is 8.8 (High).
Google · Chrome
Google Chrome contains a memory corruption flaw in the V8 JavaScript engine, classified as CWE-119. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The victim must visit the page, and the description does not say whether a sandbox escape exists for full compromise.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in the Core component (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page. The CNA rates the CVSS score 8.8, while Chromium rates the severity as Medium.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in DevTools, the built-in developer tooling. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the attacker's page, and the record does not describe a sandbox escape or full system compromise. NVD rates the issue CVSS 8.8 (High), while VulDB rates it 6.3 (Medium).
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions prior to 156.0.8078.47 contain an improper input validation flaw in the Passwords component. A remote attacker could potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Google rates the issue Low, while the CVE record scores it 8.8 (High) under CVSS 3.1.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page; no login is required. The vulnerability is rated High by Chromium (CVSS 3.1 base score 8.8), and a full system compromise would normally require a further sandbox escape.
Google · Chrome
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
