By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 60 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-113200No exploit	Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the sangoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113202No exploit	Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to google · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113203No exploit	Observable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a craftegoogle · chrome · CWE-203 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113204No exploit	UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging socigoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113205No exploit	Insufficient verification of data authenticity in Variations in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to bypass google · chrome · CWE-345 Pre-auth	High8.8	—	0.1%	Oct 20, 2026
35Monitor	CVE-2026-113206No exploit	UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML pagoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113207No exploit	Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass system acgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113208No exploit	Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leakgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113210No exploit	Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.4%	Oct 20, 2026
38Monitor	CVE-2026-113211No exploit	Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
33Monitor	CVE-2026-113212No exploit	Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113213No exploit	Injection in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements vgoogle · chrome · CWE-74 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113214No exploit	Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113215No exploit	Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113216No exploit	Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-672 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113217No exploit	Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineerigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113218No exploit	Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process angoogle · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113219No exploit	Missing authorization in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113220No exploit	Missing authorization in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enginegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113221No exploit	Privilege elevation in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-250 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113222No exploit	Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTMLgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113226No exploit	UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113227No exploit	Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113228No exploit	Incorrect authorization in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113229No exploit	Improper signature verification in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via google · chrome · CWE-347 Pre-auth Weak crypto	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113230No exploit	UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113231No exploit	Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtaigoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113232No exploit	Use after free in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execugoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113233No exploit	Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-367 pre-auth RCE Race condition	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113234No exploit	Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a cgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113235No exploit	Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113236No exploit	Improper input validation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker who had compromised the google · chrome · CWE-20 pre-auth RCE	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113238No exploit	Information loss in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origoogle · chrome · CWE-221 Pre-auth	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113239No exploit	Race condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data google · chrome · CWE-367 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113240No exploit	Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113241No exploit	UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a cgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113242No exploit	Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113243No exploit	Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTMLgoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113244No exploit	Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113245No exploit	Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113247No exploit	Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitgoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113248No exploit	Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113249No exploit	Missing authorization in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113250No exploit	Integer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside thgoogle · chrome · CWE-190 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113251No exploit	Improper input validation in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy vgoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113252No exploit	Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendgoogle · chrome · CWE-908 Pre-auth Memory safety	Critical9.6	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113253No exploit	Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a craftegoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113254No exploit	Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak google · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113255No exploit	Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrargoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113256No exploit	Improper privilege management in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeringgoogle · chrome · CWE-269 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113257No exploit	Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and levergoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113258No exploit	Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to egoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113259No exploit	Missing authorization in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113260No exploit	Improper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof Ugoogle · chrome · CWE-754 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113261No exploit	Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering google · chrome · CWE-20 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113262No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113263No exploit	Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113264No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113265No exploit	Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113266No exploit	Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbgoogle · chrome · CWE-125 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113267No exploit	Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113268No exploit	Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to google · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113269No exploit	Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113270No exploit	Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113271No exploit	Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113272No exploit	Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113273No exploit	Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside thegoogle · chrome · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113274No exploit	Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTMgoogle · chrome · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113275No exploit	Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113276No exploit	Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113278No exploit	UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof google · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113279No exploit	Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113280No exploit	Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-113281No exploit	Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113282No exploit	Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-362 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
38Monitor	CVE-2026-113283No exploit	Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to executgoogle · chrome · CWE-269 pre-auth RCE	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113284No exploit	Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113285No exploit	Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113286No exploit	Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113287No exploit	Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypassgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113288No exploit	Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive igoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113289No exploit	Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data viagoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113290No exploit	Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113291No exploit	UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTMLgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113292No exploit	UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a cgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113293No exploit	Out of bounds write in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outsigoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113294No exploit	Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craftegoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113298No exploit	UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113299No exploit	Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictionsgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
38Monitor	CVE-2026-113300No exploit	Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensgoogle · chrome · CWE-203 Pre-auth	Critical9.6	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113301No exploit	Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions viagoogle · chrome · CWE-441 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113302No exploit	Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113303No exploit	Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.6%	Oct 20, 2026
35Monitor	CVE-2026-113305No exploit	Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potegoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113306No exploit	Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypagoogle · chrome · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113307No exploit	UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrogoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113308No exploit	Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-841 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113311No exploit	Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTMgoogle · chrome · CWE-362 Pre-auth Race condition	High8.8	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-113312No exploit	UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafgoogle · chrome · CWE-451 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-113313No exploit	Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypasgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 20, 2026

CVE-2026-113200
35Monitor
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory outside the san
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113202
35Monitor
Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113203
35Monitor
Observable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113204
35Monitor
UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging soci
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113205
35Monitor
Insufficient verification of data authenticity in Variations in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker to bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113206
35Monitor
UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML pa
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113207
35Monitor
Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass system ac
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113208
35Monitor
Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113210
35Monitor
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the s
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113211
38Monitor
Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113212
33Monitor
Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113213
35Monitor
Injection in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements v
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113214
35Monitor
Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to byp
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113215
35Monitor
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113216
35Monitor
Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113217
35Monitor
Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineeri
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113218
35Monitor
Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process an
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113219
35Monitor
Missing authorization in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113220
35Monitor
Missing authorization in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engine
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113221
35Monitor
Privilege elevation in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113222
38Monitor
Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113226
35Monitor
UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI el
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113227
35Monitor
Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113228
35Monitor
Incorrect authorization in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113229
35Monitor
Improper signature verification in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
google · chromeOct 20, 2026
CVE-2026-113230
35Monitor
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113231
35Monitor
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtai
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113232
35Monitor
Use after free in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execu
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113233
35Monitor
Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 20, 2026
CVE-2026-113234
35Monitor
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113235
38Monitor
Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113236
35Monitor
Improper input validation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker who had compromised the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113238
35Monitor
Information loss in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web ori
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113239
35Monitor
Race condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113240
35Monitor
Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113241
35Monitor
UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a c
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113242
35Monitor
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the s
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113243
35Monitor
Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113244
35Monitor
Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to sp
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113245
35Monitor
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113247
35Monitor
Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensit
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113248
35Monitor
Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113249
35Monitor
Missing authorization in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrict
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113250
35Monitor
Integer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside th
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113251
35Monitor
Improper input validation in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy v
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113252
38Monitor
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the rend
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113253
35Monitor
Incorrect authorization in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113254
35Monitor
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113255
35Monitor
Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrar
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113256
35Monitor
Improper privilege management in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113257
35Monitor
Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and lever
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113258
35Monitor
Use after free in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to e
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113259
35Monitor
Missing authorization in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113260
35Monitor
Improper state validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof U
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113261
38Monitor
Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113262
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obt
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113263
38Monitor
Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113264
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to byp
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113265
35Monitor
Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113266
35Monitor
Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandb
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113267
35Monitor
Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113268
35Monitor
Information leak in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113269
35Monitor
Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113270
38Monitor
Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113271
35Monitor
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandb
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113272
35Monitor
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113273
35Monitor
Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113274
35Monitor
Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTM
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
google · chromeOct 20, 2026
CVE-2026-113275
35Monitor
Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass syste
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113276
35Monitor
Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social enginee
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113278
35Monitor
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113279
35Monitor
Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandb
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113280
35Monitor
Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113281
35Monitor
Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113282
35Monitor
Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113283
38Monitor
Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execut
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 20, 2026
CVE-2026-113284
35Monitor
Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113285
35Monitor
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the s
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113286
35Monitor
Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113287
35Monitor
Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113288
35Monitor
Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive i
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 20, 2026
CVE-2026-113289
35Monitor
Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113290
35Monitor
Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113291
35Monitor
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113292
35Monitor
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a c
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113293
35Monitor
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outsi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113294
35Monitor
Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113298
35Monitor
UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the rend
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113299
35Monitor
Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113300
38Monitor
Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sens
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113301
35Monitor
Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113302
35Monitor
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026
CVE-2026-113303
35Monitor
Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113305
35Monitor
Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to pote
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 20, 2026
CVE-2026-113306
35Monitor
Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypa
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113307
35Monitor
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chro
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113308
35Monitor
Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113311
35Monitor
Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTM
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeOct 20, 2026
CVE-2026-113312
35Monitor
UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 20, 2026
CVE-2026-113313
35Monitor
Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypas
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 20, 2026