Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 6 | 5 | 12 | 5 | 27 | 55 |
| Sat, 31 Oct 2026 | 11 | 41 | 44 | 0 | 16 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
766 vulnerabilities · Vendor: Google
Memory corruption in the DevTools component of Google Chrome before 156.0.8078.47 can be exploited by a remote attacker. A victim who opens a crafted HTML page may have arbitrary code executed inside the browser sandbox. Google rates the issue Low in its own severity scale, while the NVD CVSS score is 8.8 (High).
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains an improper input validation flaw in its UI component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, for example through a phishing link. Google rates the issue Low, while NVD scores it 8.8.
Google · Chrome
A memory corruption flaw in the DOM component of Google Chrome before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker may potentially execute arbitrary code inside the browser sandbox. The victim must visit the malicious page. NVD rates the issue 8.8 (High), while Chromium rates it Medium.
Google · Chrome
Google Chrome on Windows before 156.0.8078.47 contains a memory corruption flaw in ANGLE, Chromium's graphics translation layer. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, but no authentication. Chromium rates the issue High, and the CVSS score is 8.8.
Google · Chrome
A memory corruption flaw in the Toolbar component of Google Chrome for Android before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, for example via a malicious or compromised website. The CVSS score is 8.8 (NVD), while Chromium rates the bug Low.
Google · Chrome
A use-after-free vulnerability (CWE-416) in the Chromecast component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the sandbox. Exploitation requires the victim to visit a crafted HTML page, for example a malicious or compromised website or advertisement. Google has fixed the issue in the Chrome 156 stable releases listed below; the NVD CVSS score is 8.8.
Google · Chrome
A range error in SiteIsolation, Chrome's per-site process separation, affects Google Chrome on Android before 156.0.8078.47. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the user must open the page. The CVSS score is 8.8, while Google rates the bug Medium, and no exploitation is known.
Google · Chrome
Google Chrome for Android before 156.0.8078.47 contains a memory corruption flaw in CustomTabs, the feature that shows web pages inside third-party apps. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user opens such a page. Chromium rates the issue as Medium severity.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome for iOS prior to 156.0.8078.47 contains a use-after-free flaw (CWE-416) in its Navigation component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. User interaction is required, and the CVSS 3.1 base score is 8.8.
Google · Chrome for iOS
Improper input validation in the Passwords component of Google Chrome before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attacker needs the victim to visit a crafted HTML page, and no authentication is required. Google rates the flaw Medium, while the NVD CVSS score is 9.6 Critical, and no public exploitation or proof of concept was known at the time of research.
Google · Chrome
Memory corruption in ANGLE, the graphics translation layer of Google Chrome, can be triggered by a crafted HTML page. A remote attacker may be able to execute code inside the browser sandbox. The attack requires no authentication, but a user must visit the malicious page, for example via a link in phishing mail. Chromium rates the issue High, and the CVSS base score is 8.8.
Google · Chrome
Google Chrome for Android before 156.0.8078.47 contains an out-of-bounds read in the Core component (CWE-125). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the page, and the sources do not confirm whether a further sandbox escape is needed for full compromise.
Google · Chrome for Android
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw (CWE-119) in the Search component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack needs only that a user visits the malicious page, with no privileges required, so any user browsing the web is in scope.
Google · Chrome
Improper input validation in the Extensions component of desktop Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, and the CVSS score is 8.8 (high). Code execution inside the sandbox alone does not give full control of the system, but it is a serious browser flaw. No exploitation or public proof-of-concept was found in the sources reviewed.
Google · Chrome
Improper input validation in the Browser component of Google Chrome before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox. Exploitation requires that a user visits a crafted HTML page. Chromium-based browsers such as Microsoft Edge use the same Chromium code and are therefore also affected. The Chromium security severity is rated Medium.
Google · Chrome
A use-after-free vulnerability (CWE-416) in the Loader component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires the victim to visit a crafted HTML page, for example via phishing or a compromised website. The CVE description does not state a sandbox escape, and Chromium rates the issue Low severity.
Google · Chrome
A use-after-free vulnerability in the Network component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, so user interaction is required. The CVSS score is 8.8 (HIGH); Google rates the Chromium security severity as Medium.
Google · Chrome
A use-after-free vulnerability in the Editing component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that a victim opens a crafted HTML page, for example via a phishing link or a malicious website. Chromium rates the issue Low, and no exploitation in the wild or public proof of concept has been reported.
Google · Chrome
A memory corruption flaw in the Model component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a user to open a crafted HTML page; no authentication is needed. Chromium rates the issue Low, and the sources describe impact only within the sandbox, with no sandbox escape documented.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome desktop versions before 156.0.8078.47 contain a Use-after-Free flaw in the V8 JavaScript engine, rated High severity with a CVSS score of 9.6. A remote attacker can host a crafted HTML page and may execute arbitrary code outside the browser sandbox. No user interaction beyond visiting the page is described in the record, although the CVSS vector requires user interaction (UI:R), so the victim must open the page.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw in the Google Lens component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. No login is required, but the victim must load the malicious page, for example through a link in an email or while browsing.
Google · Chrome
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
