Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 3 | 2 | 12 | 3 | 6 | 26 |
| Sat, 31 Oct 2026 | 11 | 41 | 44 | 0 | 16 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
766 vulnerabilities · Vendor: Google
A memory corruption flaw in the Navigation component of Google Chrome on iOS allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker must lure a user into opening a crafted HTML page, and no authentication is required. The CVSS 3.1 base score is 8.8 (High), while Google rates the Chromium security severity as Medium.
Google · Chrome for iOS
A use-after-free flaw in the Accessibility component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a victim to visit a crafted HTML page, so phishing or a compromised website is the realistic path. Code execution inside the sandbox is not a full compromise on its own, but it is a foothold that may be combined with a sandbox escape. Chromium rates the issue Medium and CVSS 3.1 rates it 8.8 (High).
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in ServiceWorker. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No authentication is required, but the user must visit the page, for example via a malicious website or phishing link.
Google · Chrome
Google Chrome on macOS contains a memory corruption flaw (CWE-119) in the Accessibility component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and no authentication is required. The NVD-style CVSS 3.1 base score is 8.8 (High), while VulDB rates it 6.3 (Medium).
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain an improper input validation flaw in the Views component, which renders the browser UI. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, such as visiting a malicious link or a compromised ad, and no privileges. Chromium rates the issue High, and NVD scores it CVSS 8.8.
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw in ANGLE, Chrome's graphics abstraction layer. A remote attacker may potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires the victim to open the page, and Chromium-based browsers may be affected as well.
Google · Chrome
A use-after-free flaw in the Media component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. An attacker who lures a user to such a page can execute arbitrary code inside the browser sandbox. NVD rates the issue 8.8 (High), while Google's Chromium severity is Low and the description limits the impact to the sandbox. No exploitation in the wild or public proof of concept was found at the time of research.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw in the DevTools component. A remote attacker can create a crafted HTML page that may lead to arbitrary code execution inside the browser sandbox. The attack requires a user to visit the malicious page, and Chromium rates the severity as Low because the impact is limited to the sandbox.
Google · Chrome
Memory corruption in the Autofill feature of Google Chrome for macOS prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker must lure a user to a crafted HTML page, and no authentication is required. The CVE describes code execution inside the sandbox, not a full system compromise. The CVE record lists CVSS 3.1 8.8 (high), while the vendor rates the severity as Low.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw (CWE-416) in ServiceWorker. A remote attacker can lure a user to a crafted HTML page and execute arbitrary code inside the browser sandbox. No user interaction beyond loading the page is described, and the CVSS vector requires user interaction (UI:R).
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free memory flaw in the Core component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs only to lure a user to a crafted HTML page, so no authentication is required but user interaction is. Full compromise normally requires an additional sandbox escape, and the CVE's linked Chromium bug does not match the description, so the exact scope is still being verified.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the Extensions component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits the malicious page, and Google rates the Chromium severity as Medium. Microsoft Edge, which is Chromium-based, is also affected according to third-party sources.
Google · Chrome
Google Chrome versions prior to 156.0.8078.47 contain an improper input validation flaw in the Network component (CWE-20). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must load the page, for example via a phishing link. Chromium rates the issue Low, and no exploitation in the wild or public proof of concept is known.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw in the Privacy component (CWE-416, NVD CVSS 8.8). A remote attacker can run arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVE record does not describe a sandbox escape, so full compromise would need a further step. Chromium-based browsers such as Microsoft Edge are affected as well.
Google · Chrome
Research and translation in progress – available shortly.
A memory corruption flaw in the WebRTC component of Google Chrome desktop versions before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker may be able to execute arbitrary code inside the browser sandbox. The attack requires a user to visit a malicious page, and no authentication is needed. Google rates the issue as Critical in its Chromium security severity field.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free flaw in the Extensions component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No account is required, but the victim must open the page. CVSS 8.8; Chromium rates the severity as Medium.
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a memory corruption flaw in the WebAppInstalls component (CWE-119). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, such as visiting a malicious or phishing link, and no authentication. Whether a sandbox escape is possible is unknown.
Google · Chrome
Google Chrome desktop versions before 156.0.8078.47 contain an out-of-bounds write in the Forms component (CWE-787). A remote attacker could potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. NVD rates the issue CVSS 9.6 (Critical), while Google rates its own severity as Low; the attack requires user interaction (opening the page).
Google · Chrome
A memory corruption flaw in the WebProtect component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. An attacker could potentially execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits the malicious page. Google rates the issue as Low severity, and the CVSS score of 8.8 could not be verified against NVD.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free flaw in the Transactions Platform component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page; no authentication is needed.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
