By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 58 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-101824No exploit	Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).oracle corporation · document management and collaboration · CWE-284 Broken access control (IDOR)	High8.7	—	0.2%	Oct 20, 2026
30Monitor	CVE-2026-101825No exploit	Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle hcm common architecture · CWE-284 Broken access control (IDOR)	High7.5	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101826No exploit	Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle hcm common architecture · CWE-284 Broken access control (IDOR)	High7.5	—	0.3%	Oct 20, 2026
28Monitor	CVE-2026-101827No exploit	Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle hcm common architecture · CWE-284 Broken access control (IDOR)	High7.1	—	0.2%	Oct 20, 2026
29Monitor	CVE-2026-101829No exploit	Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).oracle corporation · oracle mobile application server · CWE-284 Pre-auth Broken access control (IDOR)	High7.4	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101830No exploit	Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle project contracts · CWE-284 Broken access control (IDOR)	High7.7	—	0.3%	Oct 20, 2026
32Monitor	CVE-2026-101831No exploit	Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle quality · CWE-284 Broken access control (IDOR)	High8.1	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101833No exploit	Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle shipping execution · CWE-284 Broken access control (IDOR)	High7.6	—	0.2%	Oct 20, 2026
32Monitor	CVE-2026-101834No exploit	Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).oracle · shipping execution · CWE-284 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101835No exploit	Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).oracle · shipping execution · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101837No exploit	Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).oracle · shipping execution · CWE-284 Broken access control (IDOR)	High7.7	—	0.2%	Oct 20, 2026
28Monitor	CVE-2026-101840No exploit	Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).oracle corporation · oracle contract lifecycle management for public sector · CWE-284 Broken access control (IDOR)	High7.2	—	0.4%	Oct 20, 2026
32Monitor	CVE-2026-101841No exploit	Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).oracle corporation · global order promising · CWE-284 Broken access control (IDOR)	High8.2	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-101842No exploit	Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).oracle corporation · strategic network optimization · CWE-284 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101847No exploit	Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).oracle corporation · oracle bills of material · CWE-200 Info leak	High7.5	—	0.3%	Oct 20, 2026
30Monitor	CVE-2026-101849No exploit	Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).oracle corporation · installed base · CWE-200 Info leak	High7.6	—	0.2%	Oct 20, 2026
28Monitor	CVE-2026-101851No exploit	Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).oracle corporation · installed base · CWE-200 Info leak	High7.1	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-101852No exploit	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).oracle · product hub · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-101853No exploit	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).oracle · product hub · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-101854No exploit	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).oracle · product hub · CWE-284 Broken access control (IDOR)	High8.8	—	0.4%	Oct 20, 2026
38Monitor	CVE-2026-112992No exploit	Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted Hgoogle · chrome · CWE-203 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-112993No exploit	Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass webgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-112994No exploit	UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-112995No exploit	Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a google · chrome · CWE-203 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-112996No exploit	Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftegoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-112997No exploit	Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML pgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-112998No exploit	Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-112999No exploit	Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113000No exploit	Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML pgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113001No exploit	Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113003No exploit	Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside thegoogle · chrome · CWE-119 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113004No exploit	Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted figoogle · chrome · CWE-843 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113005No exploit	Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113006No exploit	Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictionsgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113007No exploit	Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions google · chrome · CWE-682 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113008No exploit	Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113009No exploit	UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeringoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113011No exploit	Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromgoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113012No exploit	Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execgoogle · chrome · CWE-459 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113013No exploit	Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtaigoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113014No exploit	Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via agoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113015No exploit	Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113016No exploit	Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systegoogle · chrome · CWE-362 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113017No exploit	Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113018No exploit	Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113019No exploit	Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
38Monitor	CVE-2026-113020No exploit	Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113021No exploit	Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering togoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113022No exploit	Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftegoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113023No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictionsgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113024No exploit	Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftegoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113025No exploit	UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113027No exploit	Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside thgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.6%	Oct 20, 2026
35Monitor	CVE-2026-113028No exploit	Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside tgoogle · chrome · CWE-457 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113029No exploit	Out of bounds write in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to pgoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113030No exploit	Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sgoogle · chrome · CWE-457 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113031No exploit	Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113032No exploit	Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social enginegoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113033No exploit	Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside tgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113034No exploit	Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendegoogle · chrome · CWE-706 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113036No exploit	Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113037No exploit	Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outsidegoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113039No exploit	Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113040No exploit	Use after free in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113041No exploit	Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113042No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113043No exploit	Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sagoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113044No exploit	Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113046No exploit	UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113048No exploit	Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113049No exploit	Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtaigoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113052No exploit	Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandgoogle · chrome · CWE-362 pre-auth RCE Race condition	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113053No exploit	Incorrect authorization in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineegoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113055No exploit	UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113056No exploit	Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a google · chrome · CWE-203 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113057No exploit	Observable discrepancy in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information google · chrome · CWE-203 Pre-auth	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113058No exploit	Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113059No exploit	Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potengoogle · chrome · CWE-362 pre-auth RCE Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113060No exploit	UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoogoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113061No exploit	Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bgoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113062No exploit	Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113063No exploit	Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elemegoogle · chrome · CWE-1021 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113064No exploit	Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113065No exploit	Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code ogoogle · chrome · CWE-20 pre-auth RCE	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113067No exploit	UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113068No exploit	UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML pagegoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113069No exploit	Missing authorization in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113071No exploit	Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoogoogle · chrome · CWE-330 Pre-auth Weak crypto	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113072No exploit	Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113073No exploit	Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTgoogle · chrome · CWE-459 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113074No exploit	Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113075No exploit	Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypasgoogle · chrome · CWE-346 Pre-auth	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113076No exploit	Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
38Monitor	CVE-2026-113078No exploit	Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to google · chrome · CWE-367 pre-auth RCE Race condition	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113079No exploit	UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113080No exploit	UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113081No exploit	Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandboxgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113083No exploit	Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 20, 2026
38Monitor	CVE-2026-113084No exploit	Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bygoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113085No exploit	Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026

CVE-2026-101824
34Monitor
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · document management and collaborationOct 20, 2026
CVE-2026-101825
30Monitor
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle hcm common architectureOct 20, 2026
CVE-2026-101826
30Monitor
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle hcm common architectureOct 20, 2026
CVE-2026-101827
28Monitor
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle hcm common architectureOct 20, 2026
CVE-2026-101829
29Monitor
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle corporation · oracle mobile application serverOct 20, 2026
CVE-2026-101830
30Monitor
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle project contractsOct 20, 2026
CVE-2026-101831
32Monitor
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle qualityOct 20, 2026
CVE-2026-101833
30Monitor
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle shipping executionOct 20, 2026
CVE-2026-101834
32Monitor
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · shipping executionOct 20, 2026
CVE-2026-101835
30Monitor
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · shipping executionOct 20, 2026
CVE-2026-101837
30Monitor
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
oracle · shipping executionOct 20, 2026
CVE-2026-101840
28Monitor
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · oracle contract lifecycle management for public sectorOct 20, 2026
CVE-2026-101841
32Monitor
Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).
HighCVSS 8.2No exploitEPSS 0%
- Broken access control (IDOR)
oracle corporation · global order promisingOct 20, 2026
CVE-2026-101842
35Monitor
Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle corporation · strategic network optimizationOct 20, 2026
CVE-2026-101847
30Monitor
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 7.5No exploitEPSS 0%
- Info leak
oracle corporation · oracle bills of materialOct 20, 2026
CVE-2026-101849
30Monitor
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).
HighCVSS 7.6No exploitEPSS 0%
- Info leak
oracle corporation · installed baseOct 20, 2026
CVE-2026-101851
28Monitor
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).
HighCVSS 7.1No exploitEPSS 0%
- Info leak
oracle corporation · installed baseOct 20, 2026
CVE-2026-101852
35Monitor
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · product hubOct 20, 2026
CVE-2026-101853
35Monitor
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · product hubOct 20, 2026
CVE-2026-101854
35Monitor
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
oracle · product hubOct 20, 2026
CVE-2026-112992
38Monitor
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted H
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-112993
35Monitor
Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-112994
35Monitor
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-112995
35Monitor
Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-112996
35Monitor
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-112997
35Monitor
Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML p
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-112998
35Monitor
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-112999
35Monitor
Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113000
35Monitor
Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML p
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113001
35Monitor
Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craft
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113003
35Monitor
Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113004
35Monitor
Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted fi
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113005
35Monitor
Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113006
35Monitor
Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113007
38Monitor
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113008
35Monitor
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113009
35Monitor
UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineerin
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113011
35Monitor
Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had comprom
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113012
35Monitor
Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to exec
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113013
35Monitor
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtai
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113014
38Monitor
Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113015
35Monitor
Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113016
35Monitor
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass syste
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113017
35Monitor
Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potent
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113018
35Monitor
Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to b
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113019
35Monitor
Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113020
38Monitor
Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113021
35Monitor
Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113022
35Monitor
Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113023
38Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113024
35Monitor
Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113025
35Monitor
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113027
35Monitor
Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside th
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113028
35Monitor
Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside t
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113029
35Monitor
Out of bounds write in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to p
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113030
35Monitor
Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the s
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113031
35Monitor
Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the rend
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113032
35Monitor
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engine
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113033
35Monitor
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside t
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113034
35Monitor
Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the rende
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113036
35Monitor
Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113037
35Monitor
Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113039
35Monitor
Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113040
35Monitor
Use after free in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113041
35Monitor
Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-orig
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113042
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to byp
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113043
35Monitor
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sa
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113044
35Monitor
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113046
35Monitor
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113048
35Monitor
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113049
35Monitor
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtai
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113052
35Monitor
Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sand
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 20, 2026
CVE-2026-113053
35Monitor
Incorrect authorization in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enginee
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113055
35Monitor
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113056
38Monitor
Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113057
35Monitor
Observable discrepancy in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113058
35Monitor
Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113059
35Monitor
Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to poten
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 20, 2026
CVE-2026-113060
35Monitor
UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoo
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113061
35Monitor
Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to b
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113062
35Monitor
Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to b
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113063
35Monitor
Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI eleme
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113064
35Monitor
Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a cr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113065
35Monitor
Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code o
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113067
35Monitor
UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113068
35Monitor
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113069
35Monitor
Missing authorization in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113071
35Monitor
Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoo
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
google · chromeOct 20, 2026
CVE-2026-113072
38Monitor
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113073
35Monitor
Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HT
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113074
35Monitor
Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the ren
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113075
35Monitor
Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypas
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113076
35Monitor
Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to b
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113078
38Monitor
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 20, 2026
CVE-2026-113079
35Monitor
UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113080
35Monitor
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113081
35Monitor
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113083
35Monitor
Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113084
38Monitor
Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to by
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113085
35Monitor
Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HT
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026