Skip to content
← All tracked CVEs

Updated 08:00

High severity

High15d SLA

Our service-level agreement (SLA) gives a high vulnerability a fix within 15 days of publication. 416 CVEs are tracked here: open, or fixed in the last 30 days.

Status
CVEStatusSummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAChrome Mac Audio use-after-free enables sandbox escape after renderer compromise via crafted HTML (pre-151.0.7922.72)secure-packages-25.11Aug 5, 2026Aug 20, 2026Aug 5, 2026same day
Fixed within SLAInsufficient input validation in Chrome Variations enables heap corruption by privileged network attackersecure-packages-25.11Aug 5, 2026Aug 20, 2026Aug 5, 2026same day
Fixed within SLAFFmpeg 4.4–8.1.2 ADX decoder OOB read/write on mid-stream channel layout changesecure-packages-25.11Jul 29, 2026Aug 13, 2026Aug 5, 20267 days
Fixed within SLAFFmpeg 0.6.3–8.1.2 RTP/ASF demuxer infinite loop DoS on crafted streamsecure-packages-25.11Jul 29, 2026Aug 13, 2026Aug 5, 20267 days
Fixed within SLAFFmpeg 0.7.1–8.1.2 S/PDIF muxer out-of-bounds read via crafted DTS core_sizesecure-packages-25.11Jul 29, 2026Aug 13, 2026Aug 5, 20267 days
Fixed within SLAFFmpeg 4.4–8.1.2 NVDEC nvdec.c double-free allows memory corruption via crafted videosecure-packages-25.11Jul 29, 2026Aug 13, 2026Aug 5, 20267 days
Fixed within SLAFFmpeg 8.0–8.1.2 Vulkan HEVC decoder stack buffer overflow via oversized vps_num_hrd_parameters causing RCEsecure-packages-25.11Jul 29, 2026Aug 13, 2026Aug 5, 20267 days
Fixed within SLAFFmpeg 2.1–8.1.2 VobSub demuxer heap overflow via crafted .sub/.idx stream IDssecure-packages-25.11Jul 29, 2026Aug 13, 2026Aug 5, 20267 days
Fixed within SLAChrome <151.0.7922.72 Dawn use-after-free enables sandboxed RCE via crafted HTML, low severitysecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72: PDFium use-after-free enables sandboxed code execution via crafted PDFsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLARemote out-of-bounds memory read in Chrome Dawn via crafted HTML before 151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLARace in Chrome Updater on Windows allows local privilege escalation pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 V8 type confusion allows sandboxed code execution via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAV8 race condition in Chrome <151.0.7922.72 enables remote code execution in sandbox via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 Frame implementation allows remote OOB memory access via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome Passwords prior to 151.0.7922.72 allows remote sandbox RCE via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome iOS pre-151.0.7922.72 enables remote heap corruption via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome pre-151.0.7922.72 Scheduling flaw enables sandbox RCE via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome V8 pre-151.0.7922.72 allows sandbox code execution via malicious extensionsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome WebRTC heap buffer overflow enables remote out-of-bounds read via crafted HTML pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome Mac Safe Browsing bug pre-151.0.7922.72 allows RCE via malicious filesecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome V8 type confusion enables sandboxed code execution via malicious extension (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAHeap buffer overflow in Chrome Codecs enables sandboxed RCE via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAPre-151.0.7922.72 Chrome Extensions untrusted input validation flaw allows renderer privilege escalation via HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome Enterprise <151.0.7922.72 inappropriate implementation enables remote code execution via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome V8 use-after-free enables sandboxed code execution via malicious extension pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome Sync allows sandboxed code execution via crafted HTML pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAInsufficient Settings policy enforcement allows compromised renderer privilege escalation in Chrome <151.0.7922.72 via crafted HTML.secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAInsufficient DevTools policy enforcement enables Chrome extension privilege escalation before 151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome DevTools use-after-free enables sandboxed code execution via malicious extension pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome DevTools allows sandboxed RCE via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome pre-151.0.7922.72 WebUI input validation flaw enables sandbox escape via malicious network trafficsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 TabStrip use-after-free enables heap corruption via crafted HTML and UI gesturessecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome Enterprise pre-151.0.7922.72 enables remote heap corruption via HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome WebRTC lifecycle bug pre-151.0.7922.72 allows remote heap corruption via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAWebXR integer overflow in Chrome <151.0.7922.72 enables sandboxed remote code execution via crafted HTML pagesecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAPDFium use-after-free enables sandboxed RCE via crafted PDF in Chrome <151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 WebXR out-of-bounds read enables remote memory disclosuresecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome USB policy enforcement bug (<151.0.7922.72) allows remote privilege escalation via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAInsufficient input validation in Chrome Dawn allows remote sandbox escape via crafted HTML pagesecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome Mac Updater pre-151.0.7922.72 local OS-level privilege escalation via malicious filesecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome Windows pre-151.0.7922.72: Local privilege escalation via malicious filesecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome Windows Tracing use-after-free allows local privilege escalation via malicious file (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAInsufficient input validation in Chrome Updater allows local privilege escalation via malicious file (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 V8 use-after-free enables sandboxed remote code execution via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAAndroid Chrome Speech policy enforcement bug enables compromised renderer privilege escalation via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome ANGLE on Windows allows sandbox escape via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAChrome V8 use-after-free enables sandboxed RCE via crafted HTML before 151.0.7922.72secure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome Extensions pre-151.0.7922.72 enables sandboxed arbitrary code executionsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day
Fixed within SLAUse-after-free in Chrome Views on Mac pre-151.0.7922.72 enables remote heap corruption via crafted HTMLsecure-packages-26.05Aug 4, 2026Aug 19, 2026Aug 4, 2026same day