Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 3 | 2 | 12 | 3 | 6 | 26 |
| Sat, 31 Oct 2026 | 11 | 41 | 44 | 0 | 16 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
765 vulnerabilities · Vendor: Google
Improper input validation in the FileAPI component of Google Chrome desktop allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker must lure a user to a crafted HTML page, and no authentication is required. Chromium rates the flaw Critical, and no known exploitation was reported at the time of the sources.
Google · Chrome
A use-after-free flaw (CWE-416) in the Browser component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user opens a crafted HTML page, and no login is needed. The CVE record names Windows only; secondary sources also list Linux and Mac. The CVE does not describe a sandbox escape, so full system compromise would normally require a second flaw.
Google · Chrome
Google Chrome on macOS before 156.0.8078.73 has an improper input validation flaw in ANGLE, the graphics translation layer inside the browser. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user opens the malicious page, but no login is needed.
Google · Chrome
Improper input validation in the WebRTC component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, so no login is required but user interaction is. Code execution is limited to the sandbox; no sandbox escape for this CVE is publicly known.
Google · Chrome
A memory corruption flaw in the Media component of Google Chrome before 156.0.8078.73 can be triggered by a crafted HTML page. An attacker who lures a user to such a page may potentially execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open the page, and no privileges are needed. Chromium rates the issue as High.
Google · Chrome
Research and translation in progress – available shortly.
An improper input validation flaw in the Core component of Google Chrome on Android allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attack requires a user to visit a crafted HTML page. NVD lists a CVSS score of 9.6 (Critical), while other sources list 8.8 or 6.3, and Google rates the bug High.
Google · Chrome
Memory corruption in the V8 JavaScript engine of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits a crafted HTML page, for example via a phishing link or a compromised website. Code execution inside the sandbox is serious, but a full compromise usually also requires a sandbox escape, and no such chain is known for this CVE.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Memory corruption in the HTML engine of Google Chrome desktop versions before 156.0.8078.73 can be triggered by a crafted web page. A remote attacker may execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, for example through a link, advertisement or compromised website.
Google · Chrome
A flaw in the V8 JavaScript engine of Google Chrome, caused by improper input validation, is rated Critical (CVSS 9.6). A remote attacker can potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. User interaction is required, so the risk mainly affects workstations where users open untrusted links.
Google · Chrome
Google Chrome before 156.0.8078.73 contains an input validation flaw in its SVG handling. A remote attacker can craft an HTML page that may execute arbitrary code inside the browser sandbox. The attack requires the victim to open the malicious page, and Chromium rates the issue High, not Critical.
Google · Chrome
Google Chrome for Android before 156.0.8078.73 contains an improper input validation flaw in the UI component (CWE-20). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits the malicious page, and the CVSS score is 8.8 (High).
Google · Chrome for Android
A use-after-free vulnerability in the Video component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker must lure a user to a crafted HTML page, and no account is required. Chromium rates the severity as High, no exploitation has been reported, and a sandbox escape has not been confirmed.
Google · Chrome
A memory corruption flaw in the Paint component of Google Chrome before 156.0.8078.73 can be triggered by a crafted HTML page. A remote attacker could potentially execute arbitrary code outside the browser sandbox. The attack requires that a user opens the crafted page and does not require authentication. Google rates the issue Medium; the NVD CVSS 9.6 score supplied with the data could not be verified against other sources.
Google · Chrome
Google Chrome for desktop contains a memory corruption flaw (CWE-119) in the Media component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, such as visiting a malicious site or opening a link in a phishing email. Chromium rates the issue High, and CISA SSVC lists technical impact as total.
Google · Chrome
Google Chrome on Windows contains an improper input validation flaw in its Views component (CWE-20), fixed in 156.0.8078.73. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack requires a user to visit the malicious page and needs no authentication. Chromium rates the issue High, while NVD scores it 9.6 (Critical).
Google · Chrome
Improper input validation in the user interface of Google Chrome for Android allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attack requires a victim to open a crafted HTML page, so no prior authentication is needed but user interaction is. NVD rates the issue CVSS 9.6 (critical), while other trackers rate it lower, so the score is contested.
Google · Chrome
A use-after-free flaw in the SVG handling of Google Chrome for desktop allows a remote attacker to potentially execute arbitrary code outside the sandbox. The attacker only needs to lure a user to a crafted HTML page, so no account or prior access is required. The official description refers to escaping the sandbox, which is usually chained with a separate renderer flaw; the Chromium bug report should be checked to confirm this.
Google · Chrome
Google Chrome versions before 156.0.8078.73 contain a use-after-free vulnerability in the Paint component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that a user visits the malicious page, and Google rates the Chromium security severity as High.
Google · Chrome
Google Chrome desktop prior to 156.0.8078.73 contains a memory corruption flaw in the FileSystem component (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The victim only needs to open the malicious page; no authentication is required.
Google · Chrome
A memory corruption flaw in the Turbolev component of Google Chrome prior to 156.0.8078.73 can be triggered by a crafted HTML page. An attacker who lures a user to such a page without authentication could potentially execute arbitrary code outside the Chrome sandbox. Exploitation requires the user to open the malicious page.
Google · Chrome
Google Chrome before 156.0.8078.73 contains an improper input validation flaw (CWE-20) in its SVG handling. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and Chromium rates the flaw High. The CVE record does not describe a sandbox escape, which full compromise usually requires.
Google · Chrome
A buffer overflow in the Brotli decompression library from Google, which many applications and runtimes use, can be triggered by a crafted Brotli-compressed data stream. An unauthenticated remote attacker can corrupt decoder memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code. Exploitation in the wild is confirmed, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. The CVSS v4.0 base score is 9.2 (critical).
Google · Brotli
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
