Skip to content
← All tracked CVEs

Updated 05:00

Medium severity

Medium45d SLA

Our service-level agreement (SLA) gives a medium vulnerability a fix within 45 days of publication. 446 CVEs are tracked here: open, or fixed in the last 30 days.

Status
CVEStatusSummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAChrome Payments insufficient input validation allows UI spoofing via compromised renderer prior to 151.0.7922.72secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome iOS pre-151.0.7922.72 input validation flaw enables remote navigation restriction bypasssecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLABlink vulnerability allowed cross-origin data leak via crafted HTML in Chrome <151.0.7922.72secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAInappropriate DevTools implementation enables same-origin policy bypass before Chrome 151.0.7922.72 via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAUninitialized use in ANGLE allowed cross-origin data leak in Chrome <151.0.7922.72 via crafted HTML pagesecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome pre-151.0.7922.72 Loader bug leaks cross-origin data via crafted HTML pagesecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome iOS <151.0.7922.72: Omnibox URL spoofing via crafted HTML pagesecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Isolated Web Apps navigation restriction bypass via crafted HTML (pre-151.0.7922.72)secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome prior to 151.0.7922.72: Remote Site Isolation bypass via crafted HTML pagesecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Autofill pre-151.0.7922.72 cross-origin data leak via crafted HTML pagesecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome <151.0.7922.72 Receiver policy bypass allows sandbox escape via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome <151.0.7922.72 PresentationAPI vulnerability allows cross-origin data leak via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Cast insufficient input validation allowed cross-origin data leak via crafted HTML (pre-151.0.7922.72)secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome WebGL out-of-bounds read pre-151.0.7922.72 enables remote memory disclosure via crafted HTML pagesecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAUninitialized Skia use in Chrome <151.0.7922.72 leaks cross-origin data via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome macOS Media out-of-bounds read enables sandbox escape after renderer compromise (pre-151.0.7922.72)secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Cast insufficient input validation leaks cross-origin data via crafted HTML (pre-151.0.7922.72)secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAAndroid Chrome WebView <151.0.7922.72: insufficient input validation enables cross-origin data leaksecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAFedCM in Chrome <151.0.7922.72 allows remote same-origin policy bypass via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAiOS Chrome pre-151.0.7922.72 cross-origin data leak via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome iOS <151.0.7922.72: Insufficient input validation enables UXSS script/HTML injection via malicious trafficsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome before 151.0.7922.72 Presentation policy flaw allowed remote navigation bypass via crafted HTMLsecure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Extensions security UI bug allowed spoofing via malicious extension before 151.0.7922.72secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLABlink same-origin policy bypass via crafted HTML in Chrome before 151.0.7922.72secure-packages-rollingAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome pre-151.0.7922.72 SiteIsolation flaw allows compromised renderer to bypass isolation via crafted HTMLsecure-packages-rollingAug 7, 2026Sep 21, 2026Aug 11, 20264 days
Fixed within SLAWindows Chrome Updater vulnerability enables local UI spoofing via malicious file (pre-151.0.7922.72)secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLADevTools input validation flaw allowed remote attacker to bypass navigation via crafted HTML before 151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 11, 20267 days
Fixed within SLAChrome Android GPU side-channel leaks cross-origin data via crafted HTML page pre-151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Cast pre-151.0.7922.72 allows remote cross-origin data leak via crafted HTMLsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome pre-151.0.7922.72 CSS implementation enables UXSS script/HTML injection via crafted pagesecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAGetUserMedia flaw leaks cross-origin data via crafted page after renderer compromise in Chrome <151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLACredential Management UI spoofing via crafted HTML in Chrome prior to 151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAInsufficient input validation in Chrome Payments pre-151.0.7922.72 enables UI spoofing from compromised renderersecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome iOS pre-151.0.7922.72: Untrusted input validation flaw enables remote navigation restrictions bypasssecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLABlink cross-origin data leak via crafted HTML in Chrome before 151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome DevTools SOP bypass via crafted HTML before 151.0.7922.72; remote attacker, Mediumsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAANGLE uninitialized use in Chrome <151.0.7922.72 enables cross-origin data leak via crafted HTML pagesecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAPre-151.0.7922.72 Chrome Loader leaks cross-origin data via crafted HTMLsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome iOS prior to 151.0.7922.72 Omnibox spoofing via crafted HTML (incorrect security UI)secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Isolated Web Apps allowed remote bypass of navigation restrictions via crafted HTML pre-151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAGoogle Chrome Site Isolation bypass before 151.0.7922.72 via crafted HTML pagesecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Autofill flaw pre-151.0.7922.72 enables remote cross-origin data leak via crafted HTMLsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAReceiver policy bypass in Chrome pre-151.0.7922.72 enables sandbox escape from compromised renderer via crafted HTMLsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAPresentationAPI in Chrome <151.0.7922.72 leaked cross-origin data via crafted HTML pagesecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAGoogle Chrome Cast input validation flaw leaks cross-origin data via crafted HTMLsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAWebGL out-of-bounds read in Chrome pre-151.0.7922.72 allows remote memory disclosuresecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLASkia uninitialized use in Chrome <151.0.7922.72 leaks cross-origin data via crafted HTMLsecure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAChrome Mac Media out-of-bounds read allows sandbox escape after renderer compromise pre-151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAInsufficient untrusted input validation in Chrome Cast enables cross-origin data leak via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAAndroid Chrome WebView untrusted input validation flaw leaks cross-origin data via compromised renderer pre-151.0.7922.72secure-packages-26.05Aug 5, 2026Sep 19, 2026Aug 11, 20266 days