By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 22 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-78524No exploit	Microsoft Office Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.8%	Sep 8, 2026
35Monitor	CVE-2026-81352No exploit	Web Media Extensions Remote Code Execution Vulnerabilitymicrosoft · web media extensions · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.5%	Sep 8, 2026
31Monitor	CVE-2026-81396No exploit	Microsoft Excel Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-121 RCE Memory safety	High7.8	—	0.4%	Sep 8, 2026
36Monitor	CVE-2026-53581No exploit	ntp: write path traversalopnsense · core · CWE-22 Path traversal	Critical9.0	—	0.4%	Sep 8, 2026
34Monitor	CVE-2026-55250No exploit	Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Cachesmacropay-solutions · maravel-framework · CWE-294 Pre-auth Auth bypass	High8.7	—	0.8%	Sep 8, 2026
39Monitor	CVE-2026-66302No exploit	Skype for Business Remote Code Execution Vulnerabilitymicrosoft · skype for business server · CWE-73 pre-auth RCE Path traversal	Critical9.8	—	0.9%	Sep 8, 2026
32Monitor	CVE-2026-53938No exploit	OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)openidc · cjose · CWE-122 Pre-auth Memory safety	High8.2	—	0.2%	Sep 8, 2026
36Monitor	CVE-2026-53939No exploit	OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryptionopenidc · cjose · CWE-321 Pre-auth Hard-coded credentials	Critical9.1	—	0.2%	Sep 8, 2026
40Plan	CVE-2026-28659No exploit	In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check.google · android xr · CWE-269 Pre-auth	Critical10.0	—	0.1%	Sep 8, 2026
28Monitor	CVE-2026-78545No exploit	Improper Input Sanitization in Okta Access Gateway Application Label Configurationokta · access gateway · CWE-94 RCE	High7.2	—	0.3%	Sep 8, 2026
28Monitor	CVE-2026-78550No exploit	Improper Input Handling in Okta Access Gateway Management Console Exception Handlerokta · access gateway · CWE-95 RCE	High7.2	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-87430No exploit	Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside thegoogle · chrome · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.5%	Sep 8, 2026
30Monitor	CVE-2026-87431No exploit	Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-87433No exploit	Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypagoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Sep 8, 2026
38Monitor	CVE-2026-87438No exploit	Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outsigoogle · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87440No exploit	Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vgoogle · chrome · CWE-125 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87444No exploit	Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vgoogle · chrome · CWE-119 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87448No exploit	Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox vgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
30Monitor	CVE-2026-87450No exploit	Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87455No exploit	Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87457No exploit	Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside tgoogle · chrome · CWE-367 RCE Race condition	High8.1	—	0.1%	Sep 8, 2026
35Monitor	CVE-2026-87460No exploit	Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87464No exploit	Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Sep 8, 2026
32Monitor	CVE-2026-87467No exploit	Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary cogoogle · chrome · CWE-362 RCE Race condition	High8.1	—	0.1%	Sep 8, 2026
38Monitor	CVE-2026-87470No exploit	Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbigoogle · chrome · CWE-1284 pre-auth RCE	Critical9.6	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87471No exploit	Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87474No exploit	Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside tgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87479No exploit	Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendgoogle · chrome · CWE-807 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87480No exploit	Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87481No exploit	Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the rgoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87487No exploit	Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87488No exploit	Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87489No exploit	Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sgoogle · chrome · CWE-119 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 8, 2026
66This week	CVE-2026-87491Weaponized	Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	KEV	3.5%	Sep 8, 2026
38Monitor	CVE-2026-87492Proof of concept	Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code google · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical9.6	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87494No exploit	Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to egoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87499No exploit	Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87500No exploit	Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitragoogle · chrome · CWE-129 pre-auth RCE	Critical9.6	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-30754No exploit	A memory corruption vulnerability exists in FFmpeg before 8.1.ffmpeg · ffmpeg · CWE-787 Pre-auth Memory safety	High8.8	—	0.5%	Sep 8, 2026
38Monitor	CVE-2026-87504No exploit	Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87505No exploit	Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.1	—	0.2%	Sep 8, 2026
33Monitor	CVE-2026-87506No exploit	Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pgoogle · chrome · CWE-250 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87509No exploit	Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code google · chrome · CWE-863 RCE Broken access control (IDOR)	High8.1	—	0.1%	Sep 8, 2026
33Monitor	CVE-2026-87510No exploit	Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-20 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87512No exploit	Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Sep 8, 2026
32Monitor	CVE-2026-87514No exploit	Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via agoogle · chrome · CWE-416 RCE Memory safety	High8.1	—	0.1%	Sep 8, 2026
38Monitor	CVE-2026-87520No exploit	Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thegoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87524No exploit	Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87526No exploit	Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially egoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87527No exploit	Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox viagoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Sep 8, 2026
38Monitor	CVE-2026-87528No exploit	Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codegoogle · chrome · CWE-843 pre-auth RCE	Critical9.6	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87529No exploit	Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code ougoogle · chrome · CWE-197 pre-auth RCE	Critical9.6	—	0.5%	Sep 8, 2026
32Monitor	CVE-2026-87530No exploit	Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to exegoogle · chrome · CWE-427 RCE	High8.1	—	0.1%	Sep 8, 2026
32Monitor	CVE-2026-87533No exploit	Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox vigoogle · chrome · CWE-416 RCE Memory safety	High8.1	—	0.1%	Sep 8, 2026
39Monitor	CVE-2026-87534No exploit	Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineerigoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.2%	Sep 8, 2026
35Monitor	CVE-2026-87536No exploit	Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87537No exploit	Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.1	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87542No exploit	Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
39Monitor	CVE-2026-87544No exploit	Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictionsgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87547No exploit	Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeringgoogle · chrome · CWE-706 pre-auth RCE	Critical9.6	—	0.5%	Sep 8, 2026
33Monitor	CVE-2026-87553No exploit	Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderegoogle · chrome · CWE-20 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
32Monitor	CVE-2026-87554No exploit	Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outsidgoogle · chrome · CWE-367 RCE Race condition	High8.1	—	0.1%	Sep 8, 2026
38Monitor	CVE-2026-87558No exploit	Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thegoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87569No exploit	Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sysgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-87570No exploit	Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Sep 8, 2026
33Monitor	CVE-2026-87572No exploit	Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentiagoogle · chrome · CWE-74 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
21Monitor	CVE-2026-87575Proof of concept	Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Medium5.4	—	0.2%	Sep 8, 2026
33Monitor	CVE-2026-87578No exploit	Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbogoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.1%	Sep 8, 2026
35Monitor	CVE-2026-87579No exploit	Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.5%	Sep 8, 2026
38Monitor	CVE-2026-87581No exploit	Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially exgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87582No exploit	Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tgoogle · chrome · CWE-441 pre-auth RCE	High8.3	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-87585No exploit	Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code google · chrome · CWE-415 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-87587No exploit	Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87588No exploit	Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
39Monitor	CVE-2026-87595No exploit	Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypgoogle · chrome · CWE-918 Pre-auth SSRF	Critical9.8	—	0.4%	Sep 8, 2026
30Monitor	CVE-2026-87601No exploit	Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-362 pre-auth RCE Race condition	High7.5	—	0.2%	Sep 8, 2026
33Monitor	CVE-2026-87604No exploit	Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pogoogle · chrome · CWE-125 pre-auth RCE Memory safety	High8.3	—	0.3%	Sep 8, 2026
32Monitor	CVE-2026-87606No exploit	Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87607No exploit	Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code ogoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
30Monitor	CVE-2026-87608No exploit	Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to google · chrome · CWE-295 Pre-auth Weak crypto	High7.5	—	0.2%	Sep 8, 2026
38Monitor	CVE-2026-87609No exploit	Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87612No exploit	Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 8, 2026
36Monitor	CVE-2026-87613No exploit	Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrgoogle · chrome · CWE-706 pre-auth RCE	Critical9.0	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87616No exploit	Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-665 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87617No exploit	Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87618No exploit	Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromisegoogle · chrome · CWE-706 pre-auth RCE	High8.3	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87621No exploit	Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrargoogle · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 8, 2026
35Monitor	CVE-2026-87625No exploit	Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary cogoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 8, 2026
33Monitor	CVE-2026-87628No exploit	Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside thgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.1%	Sep 8, 2026
34Monitor	CVE-2026-87633No exploit	Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via Ugoogle · chrome · CWE-416 RCE Memory safety	High8.6	—	0.1%	Sep 8, 2026
38Monitor	CVE-2026-87634No exploit	Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsigoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
35Monitor	CVE-2026-87636No exploit	Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sangoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87637No exploit	Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside tgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87638No exploit	Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsidegoogle · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87639No exploit	Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.4%	Sep 8, 2026
38Monitor	CVE-2026-87643No exploit	Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codgoogle · chrome · CWE-190 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026
33Monitor	CVE-2026-87644No exploit	Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87646No exploit	Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thegoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Sep 8, 2026
33Monitor	CVE-2026-87648No exploit	Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.3%	Sep 8, 2026
38Monitor	CVE-2026-87650No exploit	Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside google · chrome · CWE-125 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 8, 2026

CVE-2026-78524
35Monitor
Microsoft Office Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · 365 appsSep 8, 2026
CVE-2026-81352
35Monitor
Web Media Extensions Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · web media extensionsSep 8, 2026
CVE-2026-81396
31Monitor
Microsoft Excel Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
microsoft · 365 appsSep 8, 2026
CVE-2026-53581
36Monitor
ntp: write path traversal
CriticalCVSS 9.0No exploitEPSS 0%
- Path traversal
opnsense · coreSep 8, 2026
CVE-2026-55250
34Monitor
Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
macropay-solutions · maravel-frameworkSep 8, 2026
CVE-2026-66302
39Monitor
Skype for Business Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Path traversal
microsoft · skype for business serverSep 8, 2026
CVE-2026-53938
32Monitor
OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
openidc · cjoseSep 8, 2026
CVE-2026-53939
36Monitor
OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
openidc · cjoseSep 8, 2026
CVE-2026-28659
40Plan
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
google · android xrSep 8, 2026
CVE-2026-78545
28Monitor
Improper Input Sanitization in Okta Access Gateway Application Label Configuration
HighCVSS 7.2No exploitEPSS 0%
- RCE
okta · access gatewaySep 8, 2026
CVE-2026-78550
28Monitor
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
HighCVSS 7.2No exploitEPSS 0%
- RCE
okta · access gatewaySep 8, 2026
CVE-2026-87430
35Monitor
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87431
30Monitor
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87433
35Monitor
Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypa
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeSep 8, 2026
CVE-2026-87438
38Monitor
Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outsi
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87440
35Monitor
Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox v
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87444
35Monitor
Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox v
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87448
38Monitor
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox v
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87450
30Monitor
Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to ob
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87455
38Monitor
Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the s
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87457
32Monitor
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside t
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Race condition
google · chromeSep 8, 2026
CVE-2026-87460
35Monitor
Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87464
38Monitor
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87467
32Monitor
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary co
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Race condition
google · chromeSep 8, 2026
CVE-2026-87470
38Monitor
Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbi
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87471
32Monitor
Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87474
38Monitor
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside t
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87479
33Monitor
Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87480
33Monitor
Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pot
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87481
33Monitor
Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the r
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87487
33Monitor
Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87488
38Monitor
Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside th
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87489
35Monitor
Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the s
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87491
66This week
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8KEVWeaponizedEPSS 3%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87492
38Monitor
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code
CriticalCVSS 9.6Proof of conceptEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87494
38Monitor
Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to e
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87499
32Monitor
Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87500
38Monitor
Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitra
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-30754
35Monitor
A memory corruption vulnerability exists in FFmpeg before 8.1.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
ffmpeg · ffmpegSep 8, 2026
CVE-2026-87504
38Monitor
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87505
32Monitor
Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87506
33Monitor
Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to p
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87509
32Monitor
Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87510
33Monitor
Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87512
38Monitor
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside th
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87514
32Monitor
Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87520
38Monitor
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87524
33Monitor
Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87526
38Monitor
Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially e
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87527
38Monitor
Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87528
38Monitor
Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87529
38Monitor
Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code ou
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87530
32Monitor
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to exe
HighCVSS 8.1No exploitEPSS 0%
- RCE
google · chromeSep 8, 2026
CVE-2026-87533
32Monitor
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox vi
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87534
39Monitor
Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeri
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87536
35Monitor
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87537
32Monitor
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87542
35Monitor
Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87544
39Monitor
Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87547
38Monitor
Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87553
33Monitor
Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendere
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87554
32Monitor
Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outsid
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Race condition
google · chromeSep 8, 2026
CVE-2026-87558
38Monitor
Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87569
35Monitor
Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sys
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87570
35Monitor
Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87572
33Monitor
Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentia
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87575
21Monitor
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass
MediumCVSS 5.4Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87578
33Monitor
Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbo
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87579
35Monitor
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87581
38Monitor
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially ex
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87582
33Monitor
Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process t
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87585
35Monitor
Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87587
35Monitor
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87588
35Monitor
Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87595
39Monitor
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to byp
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SSRF
google · chromeSep 8, 2026
CVE-2026-87601
30Monitor
Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeSep 8, 2026
CVE-2026-87604
33Monitor
Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to po
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87606
32Monitor
Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87607
38Monitor
Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code o
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87608
30Monitor
Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
google · chromeSep 8, 2026
CVE-2026-87609
38Monitor
Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87612
35Monitor
Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87613
36Monitor
Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitr
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87616
33Monitor
Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the ren
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87617
35Monitor
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87618
33Monitor
Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromise
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87621
38Monitor
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrar
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87625
35Monitor
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary co
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87628
33Monitor
Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside th
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87633
34Monitor
Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via U
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87634
38Monitor
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsi
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87636
35Monitor
Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the san
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 8, 2026
CVE-2026-87637
38Monitor
Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside t
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87638
38Monitor
Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87639
33Monitor
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87643
38Monitor
Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary cod
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87644
33Monitor
Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the ren
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 8, 2026
CVE-2026-87646
38Monitor
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87648
33Monitor
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026
CVE-2026-87650
38Monitor
Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 8, 2026