By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 59 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-113086No exploit	Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to executgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113087No exploit	Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrarygoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113088No exploit	UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113089No exploit	Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information vigoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113090No exploit	UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spogoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113091No exploit	Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive infogoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113092No exploit	Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the rgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113093No exploit	Use after free in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113094No exploit	Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-841 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113095No exploit	Use after free in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113096No exploit	UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderegoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113097No exploit	Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypasgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113099No exploit	Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to ogoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113100No exploit	Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside tgoogle · chrome · CWE-457 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113101No exploit	Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer google · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113103No exploit	Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and google · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113104No exploit	Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox viagoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113105No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113106No exploit	Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain google · chrome · CWE-843 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113107No exploit	Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113108No exploit	Information loss in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML google · chrome · CWE-221 Pre-auth	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113109No exploit	Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass sysgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113110No exploit	Missing authorization in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113111No exploit	Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer google · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113112No exploit	Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systegoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113113No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113114No exploit	Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113115No exploit	Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
38Monitor	CVE-2026-113116No exploit	Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113117No exploit	Out of bounds read in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox vgoogle · chrome · CWE-125 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113118No exploit	Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web google · chrome · CWE-441 Pre-auth	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113119No exploit	Improper certificate validation in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitivegoogle · chrome · CWE-295 Pre-auth Weak crypto	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113120No exploit	Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside tgoogle · chrome · CWE-457 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113121No exploit	Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engoogle · chrome · CWE-672 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113123No exploit	Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113124No exploit	Improper input validation in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering togoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113125No exploit	Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113126No exploit	Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy google · chrome · CWE-668 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113127No exploit	Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged pgoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113128No exploit	Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted google · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113130No exploit	Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass wgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113131No exploit	Incorrect authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113132No exploit	Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypasgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113133No exploit	Use after free in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113134No exploit	Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbgoogle · chrome · CWE-125 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113135No exploit	Use after free in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to executgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113136No exploit	Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113137No exploit	Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtaigoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 20, 2026
38Monitor	CVE-2026-113138No exploit	UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spgoogle · chrome · CWE-451 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113140No exploit	Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a cgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113141No exploit	Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113143No exploit	Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data vigoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113145No exploit	UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113146No exploit	Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113147No exploit	Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-20 pre-auth RCE	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113148No exploit	Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113149No exploit	UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTMLgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113150No exploit	Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafgoogle · chrome · CWE-362 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113152No exploit	Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origgoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113153No exploit	Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113154No exploit	Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113155No exploit	Missing authorization in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113156No exploit	UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113158No exploit	Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to potentially execute arbitrary code insidgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113160No exploit	Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbgoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113161No exploit	Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113162No exploit	Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113163No exploit	Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary cogoogle · chrome · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113164No exploit	Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions google · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113165No exploit	Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-841 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113166No exploit	Improper input validation in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised thegoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113167No exploit	Observable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted google · chrome · CWE-203 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113168No exploit	Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass google · chrome · CWE-459 Pre-auth	High8.8	—	0.4%	Oct 20, 2026
38Monitor	CVE-2026-113169No exploit	UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engigoogle · chrome · CWE-451 Pre-auth	Critical9.6	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113170No exploit	UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113171No exploit	UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineeringgoogle · chrome · CWE-451 Pre-auth	Critical9.6	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113172No exploit	Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a cgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113173No exploit	UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113174No exploit	Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113175No exploit	Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-20 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113176No exploit	Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted netwgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113177No exploit	Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113179No exploit	Missing authorization in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Hgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113180No exploit	Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive informatgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113181No exploit	Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandboxgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113182No exploit	UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof Ugoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113183No exploit	Incorrect authorization in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftedgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113184No exploit	Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113185No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113186No exploit	Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113187No exploit	Missing authorization in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTMgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113188No exploit	Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to google · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113189No exploit	Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-20 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113190No exploit	Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass wgoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113191No exploit	UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a cragoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113192No exploit	Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113194No exploit	Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113195No exploit	Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113197No exploit	Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain segoogle · chrome · CWE-203 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113198No exploit	Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026

CVE-2026-113086
35Monitor
Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execut
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113087
35Monitor
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113088
35Monitor
UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a cr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113089
38Monitor
Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information vi
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113090
35Monitor
UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spo
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113091
35Monitor
Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive info
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113092
35Monitor
Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the r
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113093
35Monitor
Use after free in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sand
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113094
35Monitor
Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113095
35Monitor
Use after free in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113096
35Monitor
UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendere
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113097
35Monitor
Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypas
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113099
35Monitor
Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to o
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113100
35Monitor
Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside t
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113101
35Monitor
Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113103
35Monitor
Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113104
35Monitor
Use after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113105
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113106
35Monitor
Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113107
35Monitor
Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the rende
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113108
35Monitor
Information loss in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113109
35Monitor
Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass sys
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113110
35Monitor
Missing authorization in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craft
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113111
35Monitor
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113112
35Monitor
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass syste
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113113
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to byp
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113114
35Monitor
Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113115
35Monitor
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113116
38Monitor
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113117
35Monitor
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox v
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113118
35Monitor
Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113119
35Monitor
Improper certificate validation in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
google · chromeOct 20, 2026
CVE-2026-113120
35Monitor
Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside t
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113121
35Monitor
Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social en
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113123
35Monitor
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113124
35Monitor
Improper input validation in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113125
35Monitor
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a cr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113126
38Monitor
Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113127
35Monitor
Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged p
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113128
35Monitor
Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113130
35Monitor
Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass w
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113131
35Monitor
Incorrect authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113132
35Monitor
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypas
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113133
35Monitor
Use after free in PlatformIntegration in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to pot
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113134
35Monitor
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandb
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113135
35Monitor
Use after free in PictureInPicture in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execut
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113136
35Monitor
Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to pot
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113137
35Monitor
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtai
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113138
38Monitor
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to sp
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113140
35Monitor
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113141
35Monitor
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113143
35Monitor
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data vi
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113145
35Monitor
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113146
35Monitor
Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-ori
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113147
35Monitor
Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113148
35Monitor
Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113149
35Monitor
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113150
35Monitor
Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113152
35Monitor
Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web orig
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113153
35Monitor
Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113154
35Monitor
Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113155
35Monitor
Missing authorization in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass syst
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113156
35Monitor
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113158
35Monitor
Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to potentially execute arbitrary code insid
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113160
35Monitor
Out of bounds write in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandb
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113161
35Monitor
Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113162
35Monitor
Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113163
35Monitor
Buffer overflow in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary co
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113164
35Monitor
Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113165
35Monitor
Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the ren
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113166
35Monitor
Improper input validation in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113167
35Monitor
Observable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113168
35Monitor
Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113169
38Monitor
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engi
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113170
35Monitor
UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113171
38Monitor
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113172
35Monitor
Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a c
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113173
35Monitor
UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113174
35Monitor
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113175
35Monitor
Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113176
35Monitor
Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted netw
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113177
35Monitor
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113179
35Monitor
Missing authorization in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted H
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113180
35Monitor
Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive informat
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113181
35Monitor
Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113182
35Monitor
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof U
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113183
35Monitor
Incorrect authorization in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113184
35Monitor
Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113185
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113186
38Monitor
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113187
35Monitor
Missing authorization in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTM
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113188
35Monitor
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113189
38Monitor
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113190
35Monitor
Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass w
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113191
35Monitor
UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a cra
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113192
35Monitor
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113194
35Monitor
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113195
35Monitor
Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113197
35Monitor
Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain se
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113198
35Monitor
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026