Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Mon, 2 Nov 2026 | 17 | 43 | 90 | 14 | 46 | 210 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 45 | 217 | 259 | 30 | 118 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 223 | 214 | 31 | 123 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 132 | 247 | 56 | 282 | 738 |
| Sun, 25 Oct 2026 | 3 | 33 | 66 | 26 | 3 | 131 |
| Sat, 24 Oct 2026 | 12 | 20 | 35 | 6 | 0 | 73 |
| Fri, 23 Oct 2026 | 40 | 170 | 90 | 27 | 165 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
767 vulnerabilities · Vendor: Google
Google Chrome on Android before 155.0.8059.39 contains an information leak in the Passwords component. A remote attacker can obtain sensitive information via a crafted HTML page if a user is tricked into opening it through social engineering. The NVD/CNA score is 8.8, while Google rates the issue as Low severity.
Google · Chrome
Google Chrome versions before 155.0.8059.39 contain a race condition in the V8 JavaScript engine. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires the victim to open that page, and according to the NVD description the impact is limited to the sandbox; escaping it would normally need a second flaw.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome versions before 155.0.8059.39 contain an incorrect comparison in the Fonts component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Incorrect authorization checks in the Autofill feature of Google Chrome on Android allow a remote attacker to obtain sensitive information. The attacker needs the victim to open a crafted HTML page, and no login is required. The impact is confidentiality only, mainly for data stored by Autofill such as addresses, contact details and payment data.
Google · Chrome
Google Chrome versions prior to 155.0.8059.39 contain a use-after-free vulnerability in the Bindings component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no privileges, but user interaction is needed (UI:R). Google rates the Chromium security severity as High and NVD scores it 8.8.
Google · Chrome
Google Chrome before 155.0.8059.39 contains a buffer overflow in ANGLE, the open-source graphics library that Chrome uses for WebGL and OpenGL rendering. An attacker who has already compromised the renderer process could use a crafted HTML page to potentially execute arbitrary code outside the Chrome sandbox. The attacker must first gain control of the renderer, and the user must open the malicious page.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome on Android before 155.0.8059.39 contains an incorrect authorization flaw in Search (CWE-863, CVE-2026-106241). A remote attacker who uses social engineering to get a user to open a crafted HTML page could potentially execute arbitrary code outside the Chrome sandbox. Google rates the issue Medium, while the NVD score is 9.6 (Critical), and no exploitation has been reported.
Google · Chrome
Google Chrome prior to 155.0.8059.39 contains a type confusion flaw in the V8 JavaScript engine (CWE-843). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user visits the page, for example via a link in email or chat. Code execution is limited to the sandbox; the advisory does not describe a sandbox escape.
Google · Chrome
An integer overflow in the WebGL component of Google Chrome for Android (CWE-190) allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. Exploitation requires that a victim opens a crafted HTML page, so user interaction is needed, but no login is required. The vendor rates the issue as high severity and the CVSS base score is 9.6 (critical).
Google · Chrome
A race condition in the Fonts component of Google Chrome before 155.0.8059.39 can be triggered by a remote attacker using a crafted HTML page. The attacker must first have compromised the renderer process, after which the flaw can allow code execution outside the browser sandbox. Chromium rates the issue Medium, while NVD scores it 8.3 (High).
Google · Chrome
Google Chrome before 155.0.8059.39 contains an information leak in the Permissions component. A remote attacker can use a crafted HTML page to bypass site isolation, which is meant to separate websites from each other in the browser. Google's own severity rating is Low, while the NVD entry lists CVSS 9.6 (critical); the impact described is information disclosure, not code execution.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome before 155.0.8059.39 contains a use-after-free vulnerability in the WebAudio component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires that the victim opens the page and the browser is not updated; the sandbox limits the impact, so full system compromise would require a second flaw.
Google · Chrome
Google Chrome desktop versions before 155.0.8059.39 contain a use-after-free vulnerability in the Network component (CWE-416). A remote attacker who uses social engineering to get a victim to install or use a crafted Chrome extension could potentially execute arbitrary code outside the browser sandbox. Google rates the Chromium security severity as Low, while the CVSS 3.1 base score is 9.6 (Critical).
Google · Chrome
Google Chrome before 155.0.8059.39 contains a use-after-free vulnerability in the Metrics component. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires a chained attack and user interaction, and the CVSS score is 8.3 (High).
Google · Chrome
Research and translation in progress – available shortly.
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
