Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Mon, 2 Nov 2026 | 6 | 8 | 5 | 6 | 56 | 81 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
767 vulnerabilities · Vendor: Google
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in the Input Method Editor (IME) component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No user privileges are needed, but the victim must visit the malicious page.
Google · Chrome
A use-after-free flaw in the Views component (the browser UI toolkit) of Google Chrome allows a remote attacker to execute arbitrary code inside the sandbox. The attacker needs a victim to open a crafted HTML page, for example through a phishing link or a compromised website. Chromium rates the bug Low severity, but the CVSS base score is 8.8 (High).
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an input validation flaw in the Extensions component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, and NVD and Microsoft rate it as CVSS 8.8 (High).
Google · Chrome
A use-after-free vulnerability (CWE-416) in the Workers component of Google Chrome before 156.0.8078.47 can be exploited remotely. An attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page, with no authentication required. The sources describe code execution inside the sandbox only; full compromise would probably need a second sandbox-escape flaw, which is an inference and not confirmed.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the PerformanceAPIs component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack requires that a user visits the page, but no authentication. Google rates the issue Medium, while the CVSS score is 9.6 (Critical).
Google · Chrome
A memory corruption flaw (CWE-119) in the DevTools component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, so user interaction is required, and the description limits the impact to the sandbox. NVD rates the issue 8.8 (High), while Chromium rates it Low.
Google · Chrome
Google Chrome before 156.0.8078.47 contains an improper input validation flaw in the GPU component. A remote attacker can craft an HTML page that may lead to arbitrary code execution inside the browser sandbox. Exploitation requires the victim to visit the malicious page; no privileges are needed.
Google · Chrome
A use-after-free vulnerability (CWE-416) in the CredentialProvider component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The victim must open a crafted HTML page, and no login is required. The CVSS score is 8.8 (High), and Google rates the Chromium security severity as Medium. No in-the-wild exploitation was found at the time of research.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the WindowControlsOverlay feature of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page and interact with it (user interaction required). CISA SSVC rates the exploitation status as proof-of-concept and automatable as 'no'.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw (CWE-119) in the Transactions Platform component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires that the victim opens the page, and the sandbox boundary limits the impact unless it is combined with a further sandbox escape.
Google · Chrome
A memory corruption flaw in the Permissions component of Google Chrome before 156.0.8078.47 can be triggered remotely. A user who visits a crafted HTML page may allow an attacker to potentially execute arbitrary code outside the browser sandbox. NVD rates the issue Critical (CVSS 9.6), while Google rates the Chromium security severity as Medium; no authentication is needed, but user interaction is required.
Google · Chrome
Google Chrome before 156.0.8078.47 contains an out-of-bounds read in the Navigation component (CWE-125). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. NVD rates the flaw CVSS 3.1 8.8 (High), and Google rates it Medium in its own severity scale.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw (CWE-119) in its Bluetooth component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox, but the victim must visit the page and interact with it. Code execution inside the sandbox does not by itself give full system control, and no sandbox escape is described. The upstream tracker entry describes a different bug class, so the root cause is unconfirmed.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw in the Sync component, which syncs bookmarks, history and settings with a Google account. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, and the public record does not describe a sandbox escape. Google rates the Chromium severity as Low, while the CVSS base score is 8.8.
Google · Chrome
A memory corruption flaw in the HID component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker can execute arbitrary code inside the browser sandbox. The victim must open the malicious page, but no privileges are required. NVD and Microsoft rate the issue CVSS 8.8.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free vulnerability in the Workers component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page, for example via a link, advertisement or compromised website. NVD rates the issue as CVSS 3.1 8.8 (High), while Chromium rates it as Medium. Full system compromise would likely require an additional sandbox escape, which is not confirmed by the vendor.
Google · Chrome
Memory corruption in the Paint component of Google Chrome before 156.0.8078.47 can be triggered by a remote attacker using a crafted HTML page. Successful exploitation allows arbitrary code execution inside the renderer sandbox. The user must visit the malicious page, but no login is required; Chromium rates the issue High with a CVSS 3.1 base score of 8.8.
Google · Chrome
A use-after-free vulnerability in the API component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to visit a crafted HTML page, so phishing or a compromised website is the realistic attack path. Chromium rates the issue Medium, and the CVSS base score is 8.8. Full system compromise would normally require a second sandbox-escape vulnerability, which is not described in the sources.
Google · Chrome
Memory corruption in the Views component (Chrome's UI toolkit) in Google Chrome before 156.0.8078.47 can be triggered by a remote attacker using a crafted HTML page. Successful exploitation allows arbitrary code execution inside the browser sandbox. The user must open the malicious page, but no authentication is required. Full system compromise would normally also need a separate sandbox-escape vulnerability.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption bug in CSS handling. A remote attacker may be able to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires user interaction, such as opening a malicious link, and the sources describe no sandbox escape. Chromium-based browsers may inherit the bug.
Google · Chrome
Google Chrome contains a memory corruption flaw in its Loader component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVE record does not describe a sandbox escape, so full system compromise would require an additional vulnerability. NVD rates the issue CVSS 8.8, while Chromium rates it Low.
Google · Chrome
A use-after-free vulnerability in the Animation component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The victim must open a crafted HTML page, and no privileges are required. The sandbox is a separate protection layer, so this flaw alone does not give full control over the system.
Google · Chrome
A memory corruption flaw in the Browser component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a user to visit a crafted HTML page. NVD rates the issue 8.8 (High), while Google rates it Low. The description does not claim a sandbox escape.
Google · Chrome
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
