← All tracked CVEs
Updated 13:01
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| In progress | Incomplete GetUserMedia cleanup allows UI spoofing in Chrome <155.0.8059.39 after renderer compromise | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 SignIn validation flaw allows access restriction bypass via malicious extension | secure-packages-rolling | — | |
| In progress | Missing authorization in WebAuthn allows UI spoofing in Chrome <155.0.8059.39 via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 File component UI misrepresentation enables spoofing via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 WebAppInstalls auth flaw enables remote UI spoofing via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome Chromoting UI misrepresentation pre-155.0.8059.39 on Windows enables UI spoofing via crafted traffic, social engineering | secure-packages-rolling | — | |
| In progress | Chrome Video uninitialized resource before 155.0.8059.39 allows sandbox memory read post-renderer compromise | secure-packages-rolling | — | |
| In progress | Android Chrome GPU uninitialized resource allows memory read outside sandbox via crafted HTML (pre-155.0.8059.39) | secure-packages-rolling | — | |
| In progress | Chrome Payments UI spoofing via crafted HTML (pre-155.0.8059.39) enables social engineering | secure-packages-rolling | — | |
| In progress | Chrome Animation info leak lets remote attacker access cross-origin data via crafted HTML pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Incorrect PermissionElement authorization allows web origin policy bypass via crafted HTML in Chrome <155.0.8059.39 | secure-packages-rolling | — | |
| In progress | WebOTP UI misrepresentation enables remote UI spoofing in Chrome before 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Printing OOB read in Chrome Windows <155.0.8059.39 allows sandbox memory disclosure via crafted HTML | secure-packages-rolling | — | |
| In progress | UI misrepresentation in Chrome WebAppInstalls pre-155 enables system access restriction bypass via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 missing authorization lets crafted HTML via social engineering bypass system restrictions | secure-packages-rolling | — | |
| In progress | FedCM missing authorization in Chrome <155.0.8059.39 enables web origin policy bypass via crafted HTML | secure-packages-rolling | — | |
| In progress | Android Chrome GPU bug allows compromised renderer to read outside-sandbox memory (pre-155.0.8059.39) | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 Unbounded Element auth bug allows UI spoofing after renderer compromise | secure-packages-rolling | — | |
| In progress | Chrome Mac UI privilege flaw pre-155.0.8059.39 allows remote bypass of system restrictions via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome WebAudio input validation flaw before 155.0.8059.39 let compromised renderer process bypass system access restrictions | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 CacheStorage race condition enables compromised renderer memory read outside sandbox via crafted HTML | secure-packages-rolling | — | |
| In progress | PermissionElement UI misrepresentation in Chrome <155.0.8059.39 allows crafted HTML social engineering spoofing | secure-packages-rolling | — | |
| In progress | Chrome Autofill AI discrepancy pre-155.0.8059.39 enabled sensitive data leak via crafted HTML after renderer compromise | secure-packages-rolling | — | |
| In progress | ANGLE out-of-bounds read in Chrome <155.0.8059.39 enables remote sandbox memory disclosure via HTML | secure-packages-rolling | — | |
| In progress | Mobile Chrome on Android <155.0.8059.39 UI misrepresentation allows spoofing via crafted HTML by remote attacker | secure-packages-rolling | — | |
| In progress | Chrome DevTools auth bug pre-155.0.8059.39 lets local attackers bypass system access via crafted HTML page | secure-packages-rolling | — | |
| In progress | Chrome pre-155.0.8059.39 Network authorization flaw lets compromised renderer bypass system access | secure-packages-rolling | — | |
| In progress | Use-after-free in Chrome FontAccess allows web origin policy bypass via compromised renderer pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Clickjacking in Chrome PermissionElement enables UI spoofing via crafted page before 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Chrome SignIn missing authorization pre-155.0.8059.39 enables data leak via crafted extension | secure-packages-rolling | — | |
| In progress | Incorrect authorization in Android Chrome before 155.0.8059.39 enables local data leak via co-installed app | secure-packages-rolling | — | |
| In progress | Chrome Chromoting UI misrepresentation allows remote spoofing via crafted traffic on Mac pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Android Chrome <155.0.8059.39 fullscreen UI bug allows address bar spoofing | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 UI use-after-free lets compromised renderer spoof UI via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome pre-155.0.8059.39 Editing sensitive data leak via crafted HTML, remote social engineering | secure-packages-rolling | — | |
| In progress | Open redirect in Chrome AppManifest allowed origin bypass via crafted HTML (pre-155.0.8059.39) | secure-packages-rolling | — | |
| In progress | Chrome Android pre-155.0.8059.39 WebAppInstalls auth bug allows remote system access restrictions bypass via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome Core incorrect reference resolution enables cross-origin data leak before 155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Android Chrome UI confused deputy lets local app bypass access to privileged pages pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Incorrect PDF authorization in Chrome Android <155.0.8059.39 exposes sensitive data via co-installed app | secure-packages-rolling | — | |
| In progress | Chrome Paint info leak via crafted HTML enables remote data exposure (Medium; pre-155.0.8059.39) | secure-packages-rolling | — | |
| In progress | High-severity Chrome Compositing integer overflow leaks cross-origin data pre-155.0.8059.39 | secure-packages-rolling | — | |
| In progress | Google Chrome prior to 155.0.8059.39 Input auth flaw enables UI spoofing via crafted HTML | secure-packages-rolling | — | |
| In progress | Pre-155.0.8059.39 Chrome Paint flaw allows remote cross-origin data leak via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome for Android <155.0.8059.39 allows remote UI spoofing via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome Android <155.0.8059.39: PiP UI misrepresentation allows address bar spoofing via crafted HTML | secure-packages-rolling | — | |
| In progress | ANGLE uninitialized resource in Chrome Windows <155.0.8059.39 allows remote out-of-sandbox memory read | secure-packages-rolling | — | |
| In progress | Skia uninitialized resource in Chrome pre-155.0.8059.39 enables cross-origin data exposure via crafted HTML | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 UI spoofing via crafted HTML, social engineering | secure-packages-rolling | — | |
| In progress | Chrome <155.0.8059.39 Site Isolation bypass via missing authorization after renderer compromise | secure-packages-rolling | — |