← All tracked CVEs
Updated 06:01
Medium severity
Medium45d SLAWe fix a medium vulnerability within 45 days of publication, under our service-level agreement (SLA). We track 889 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | Missing authorization in Chrome Permissions allows UI spoofing via renderer compromise (pre-155.0.8059.39) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Missing authorization in iOS Chrome <155.0.8059.39 allows social-engineered UI spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect authorization in Chrome Extensions <155.0.8059.39 allows UI spoofing via crafted extension | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android <155.0.8059.39 Messages clickjacking enables UI spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Media auth flaw pre-155.0.8059.39 leaks cross-origin data via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Glic cleanup bug enables cross-origin data leak via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Information leak in Chrome WebAudio before 155.0.8059.39 enables cross-origin data exposure via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android WebShare auth bug pre-155.0.8059.39 allows UI spoofing via compromised renderer | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect SanitizerAPI implementation in Chrome <155.0.8059.39 leaks sensitive data via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 DataTransfer missing auth allows compromised renderer sensitive data exfiltration via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 UI misrepresentation allows UI spoofing via social-engineered HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Uninitialized Skia resource allows cross-origin data exfiltration via crafted HTML (Chrome <155.0.8059.39) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android <155.0.8059.39 PiP UI bug allows address bar spoofing via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android before 155.0.8059.39 vulnerability enables remote UI spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Paint discrepancy before 155.0.8059.39 enables remote cross-origin data leak via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Compositing integer overflow exposed cross-origin data pre-155.0.8059.39 via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Sensitive info leak in Chrome Paint pre-155.0.8059.39 via crafted HTML page | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome PDF auth flaw pre-155.0.8059.39 enabled local co-app data theft via social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome UI confused deputy lets co-installed app access privileged pages pre-155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Core reference resolution bug leaks cross-origin data via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android WebAppInstalls auth flaw before 155.0.8059.39 enabled remote system access bypass | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Google Chrome Editing information leak before 155.0.8059.39 via crafted HTML social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 UI use-after-free enables compromised renderer to spoof UI via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome fullscreen UI flaw enables address bar spoofing pre-155.0.8059.39, low severity | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chromoting UI misrepresentation allows spoofed UI via crafted traffic on Mac Chrome <155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect authorization in Chrome Android <155.0.8059.39 leaks sensitive data to co-installed app via social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome SignIn missing authorization before 155.0.8059.39 exposes sensitive data via crafted Chrome extension social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome PermissionElement clickjacking allowed UI spoofing via crafted HTML pre-155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155 FontAccess use of released resource enables renderer-compromised origin policy bypass via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Android Chrome prior to 155.0.8059.39 allows UI element spoofing via crafted HTML (low severity) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome ANGLE out-of-bounds read allows remote memory disclosure via crafted HTML (pre-155.0.8059.39) | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Autofill AI discrepancy in Chrome <155.0.8059.39 enables renderer attacker data exfiltration via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome PermissionElement UI spoofing vulnerability prior to 155.0.8059.39 via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | CacheStorage race in Chrome <155.0.8059.39 lets compromised renderer read memory outside sandbox | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Unbounded Element auth flaw enables compromised renderer UI spoofing via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 WebAppInstalls UI misrepresentation enables social engineering access bypass | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome WebOTP UI spoofing via crafted HTML before 155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Animation info leak before 155.0.8059.39 lets remote attackers exfiltrate cross-origin data via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | UI spoofing vulnerability in Chrome Payments via crafted HTML pre-155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome pre-155.0.8059.39 WebAppInstalls auth bug enabled remote UI spoofing via HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome pre-155.0.8059.39 File UI misrepresentation allows remote spoofing via crafted HTML, social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome WebAuthn missing authorization allows remote UI spoofing via crafted HTML page pre-155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incomplete GetUserMedia cleanup enabled UI spoofing via crafted HTML in Chrome prior to 155.0.8059.39 | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect DevTools authorization pre-155.0.8059.39 enables cross-origin data leak via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Android <155.0.8059.39 sensitive info leak via co-installed app by local attacker | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome Extensions pre-155.0.8059.39 authorization flaw permits cross-origin data exfiltration via crafted extension | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chromoting UI spoofing in macOS Chrome pre-155.0.8059.39 via crafted traffic, social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Chrome <155.0.8059.39 Actor authorization missing enables access restriction bypass via crafted HTML social engineering | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | Incorrect authorization allows Chrome <155.0.8059.39 address bar spoof via crafted HTML | secure-packages-25.11 | Oct 9, 2026 | |
| Fixed | ANGLE uninitialized resource allows cross-origin data exposure in Chrome <155.0.8059.39 via crafted HTML | secure-packages-25.11 | Oct 9, 2026 |