Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Mon, 2 Nov 2026 | 9 | 8 | 12 | 9 | 56 | 94 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
767 vulnerabilities · Vendor: Google
A use-after-free flaw in the WebRTC component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a user to visit a crafted or compromised HTML page. The NVD description does not describe a sandbox escape, so the impact is limited to the sandbox unless it is chained with a second flaw.
Google · Chrome
Google Chrome on Windows, macOS and Linux contains a use-after-free flaw in its PDF component. A remote attacker can use a crafted HTML page to execute arbitrary code outside the browser sandbox. The attacker needs only that the victim opens the page, and Google rates the bug Critical.
Google · Chrome
Google Guava allocates memory based on a size value in serialized data when deserializing CompactHashMap, CompactHashSet and MapMakerInternalMap objects, without limits. An attacker who can supply crafted Java serialization data to an application can exhaust memory and cause an OutOfMemoryError, resulting in a denial of service. Confidentiality and integrity are not affected. The issue is only reachable if the application deserializes untrusted data.
Google · Guava
A use-after-free in the virtual filesystem (VFS) of Google gVisor allows a local attacker with standard container privileges to execute code in the host sentry process. The attacker triggers a double free of the backing MemoryFile of an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries, and the CNA rates exploitation as not automatable.
Google · gVisor
A use-after-free vulnerability in the Android Bluetooth component (bluetooth_ccc.cc, BluetoothCccHandlerCallbackImpl) affects Pixel devices. The CVE record describes possible remote code execution without user interaction or extra privileges, but Google's October 2026 Pixel bulletin classifies the issue as elevation of privilege (EoP), so the RCE claim is unconfirmed. The CVSS vector lists network access, which is questionable for Bluetooth, and an attacker would likely need to be in radio range. No exploitation is documented.
Google · Android (Pixel devices)
Research and translation in progress – available shortly.
A race condition in the font handling of Google Chrome before 155.0.8059.39 can be exploited by a remote attacker via a crafted HTML page. Successful exploitation may allow arbitrary code execution outside the browser sandbox. The attack requires the victim to open the malicious page, for example through phishing or a compromised website. Google rates the issue as High severity, and no exploitation in the wild is known.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome before 155.0.8059.39 contains a use-after-free vulnerability (CWE-416) in the Media component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No account is required, but the user must open the malicious page. Chromium rates the issue as High severity.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the PDF component of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open a crafted HTML page, for example through phishing or a malicious website. Google rates the Chromium security severity as High and the CVSS base score is 8.8; the CVE description does not document a sandbox escape.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the ANGLE graphics layer of Google Chrome on Android allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to open a crafted HTML page, for example via a malicious website or phishing link. The CVSS score is 9.6 (Critical), and the vendor rates the Chromium severity as High.
Google · Chrome
Research and translation in progress – available shortly.
An integer overflow (CWE-190) in the Media component of Google Chrome before 155.0.8059.39 can be triggered by a crafted HTML page. A remote attacker may potentially execute code outside the browser sandbox. The attack requires that a user visits the malicious page, and code execution outside the sandbox typically requires chaining with a separate browser flaw. NVD rates the issue 9.6 (Critical), while Google rates it Low in its Chromium severity field.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Improper input validation in the Mobile component of Google Chrome for iOS (before 155.0.8059.39) can be abused by a remote attacker. A user must first be tricked by social engineering into opening a crafted HTML page. If successful, the attacker could potentially execute arbitrary code outside the Chrome sandbox. NVD rates the issue 9.6 (critical), while Google rates it Medium.
Google · Chrome
Research and translation in progress – available shortly.
A race condition in the Core component of Google Chrome on macOS can be abused by an attacker who has already compromised the renderer process. The attacker uses social engineering and a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Exploitation requires user interaction, a high attack complexity and a prior renderer compromise, so the bug is a chained vulnerability and not a standalone entry point.
Google · Chrome
Google Chrome before 155.0.8059.39 contains a use-after-free flaw in its HTML parser (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by tricking a user into opening a crafted HTML page. The CNA rates the issue at CVSS 8.8 (High). Chromium Security rates it as High severity.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome for macOS contains an incorrect reference resolution flaw in WebAppInstalls, the component that installs web applications. A remote attacker who has already compromised the renderer process can use crafted network traffic to execute arbitrary code outside the browser sandbox. The attack requires a separate browser exploit first and user interaction, and it is considered complex to execute.
Google · Chrome
Research and translation in progress – available shortly.
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
