← All tracked CVEs
Updated 05:00
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | Chrome Windows PlatformIntegration bug pre-154.0.8037.57 allows social-engineered HTML to bypass system access restrictions | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Transactions Platform race in Google Chrome <154.0.8037.57 leaks sensitive data via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome <154.0.8037.57 Auth validation flaw lets renderer-compromised attacker steal data via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome BrowserTag auth flaw lets compromised renderer bypass web origin policy via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect authorization in Chrome Network enables origin policy bypass via crafted HTML (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Missing authorization in Chrome Views on Mac <154.0.8037.57 allows UI spoofing by compromised renderer | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome NFC vulnerability allowed remote system access restrictions bypass via crafted HTML pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome DevTools authorization bug (<154.0.8037.57) allows social-engineered cross-origin data exposure | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | DataTransfer information leak in Chrome <154.0.8037.57 via crafted HTML, renderer compromise, social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Core use-after-free lets compromised renderer bypass web origin policy pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Passwords pre-154.0.8037.57 improper input validation enables remote UI spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome FileSystem UI misrepresentation pre-154.0.8037.57 enables spoofed UI via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome DevTools confused deputy enables web origin policy bypass via crafted HTML (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome <154.0.8037.57 Editing race condition leaks sensitive data via crafted HTML and social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome for Android <154.0.8037.57 authorization flaw lets co-installed app access privileged page | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome DevTools improper authorization allows origin policy bypass via crafted extension pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chromoting UI misrepresentation in Chrome pre-154.0.8037.57 enables remote UI spoofing via crafted network traffic | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome V8 missing authorization allows remote origin policy bypass via crafted HTML pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Picture-in-Picture authorization flaw enabled origin policy bypass pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome Messages UI spoofing via crafted HTML with social engineering (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Transactions Platform sensitive information leak via crafted HTML (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android <154.0.8037.57 Tint uninitialized variable enables remote outside-sandbox memory read via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Downloads improper state validation before 154.0.8037.57 enables system access restriction bypass via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android confused-deputy let co-installed app access sensitive data via social engineering pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Networking info leak via crafted HTML pre-154.0.8037.57; low-severity remote data exposure | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | iOS Chrome <154.0.8037.57 UI misrepresentation enables address bar spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Remote UI spoofing in Chrome Android Payments via crafted HTML before 154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <154.0.8037.57 missing navigation auth enables crafted HTML address bar spoofing | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | UI misrepresentation allows UI spoofing in iOS Chrome <154.0.8037.57 via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome ExtensionsMenu UI misrepresentation enables remote UI spoofing pre-154.0.8037.57 via crafted HTML, social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chromoting UI spoofing via crafted traffic in Chrome <154.0.8037.57 (Low severity) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome SmartCard cleanup bug enables social-engineered HTML to bypass system access restrictions | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome DevTools missing authorization enables system access bypass via socially engineered crafted traffic (pre-154.0.8037.57) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <154.0.8037.57 Contextual Tasks auth flaw allows web origin policy bypass via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Missing Core authorization in Mac Chrome pre-154.0.8037.57 enables cross-origin data exfiltration via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | iOS Chrome <154.0.8037.57 information leak via local attacker with physical access | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome pre-154.0.8037.57 UI misrepresentation allows remote spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome GPU uninitialized resource enables remote out-of-sandbox memory read via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <154.0.8037.57 Safe Browsing auth flaw enabled remote access restrictions bypass via crafted traffic | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | iOS Chrome <154.0.8037.57 SecurityIndicators UI bug allows address bar spoofing | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome NFC missing authorization pre-154.0.8037.57 lets compromised renderer bypass system access via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect Scroll authorization pre-154.0.8037.57 enables cross-origin data theft via crafted page | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | UI misrepresentation in iOS Chrome <154.0.8037.57 enables remote HTML-based UI spoofing | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Missing Navigation authorization lets compromised renderer bypass site isolation in Chrome <154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome Omnibox UI misrepresentation allows remote address bar spoofing via crafted HTML, pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome MediaStream reference resolution bug allows web origin bypass to privileged page pre-154.0.8037.57 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect API calculation in Google Chrome Windows <155.0.8059.39 allows UI spoofing via extension | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Extensions before 155.0.8059.39 allow code injection enabling UI spoofing via crafted extension | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Enterprise sensitive info leak via crafted HTML allows remote attacker before 155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Race condition enables UI spoofing in Chrome Browser pre-155.0.8059.39 via compromised renderer | secure-packages-25.11 | Oct 9, 2026 |