Skip to content
← All tracked CVEs

Updated 09:00

Medium severity

Medium45d SLA

Our service-level agreement (SLA) gives a medium vulnerability a fix within 45 days of publication. 446 CVEs are tracked here: open, or fixed in the last 30 days.

Status
CVEStatusSummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLAChrome pre-151.0.7922.72 Autofill policy flaw leaked cross-origin data via crafted pagessecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome <151.0.7922.72 WebAppInstalls vulnerability allows remote UI spoofing via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLARemote UXSS via crafted HTML in Chrome <151.0.7922.72 Network componentsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAPre-151.0.7922.72 Chrome ReportingAndNEL cross-origin data leak via crafted HTML pagesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome GuestView insufficient policy enforcement enables cross-origin data leak pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAiOS Chrome input validation flaw bypasses navigation restrictions via crafted HTML, pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAPolicy enforcement flaw allows navigation bypass in Chrome for iOS <151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 DigitalCredentials flaw enables remote UI spoofing via crafted HTML pagesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Dawn uninitialized use leaks cross-origin data via crafted HTML, pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Extensions input validation bug enables sandbox escape via crafted HTML after renderer compromise (<151.0.7922.72)secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAWebGL uninitialized use leaks cross-origin data in Chrome Android before 151.0.7922.72 via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome Extensions pre-151.0.7922.72 input validation flaw enables renderer sandbox escapesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAInsufficient Glic policy enforcement in Chrome Android <151.0.7922.72 allows remote navigation bypass via HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAPre-151.0.7922.72 Chrome MediaRecording bug leaks process memory via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Safe Browsing input validation bug pre-151.0.7922.72 enables DAC bypass via malicious filesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome WebXR side-channel leak exposes process memory via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAInsufficient input validation enables Chrome Android pre-151.0.7922.72 Omnibox spoofing via crafted HTML after renderer compromisesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLARemote UI spoofing via crafted HTML in Chrome Android Messages pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Windows ANGLE uninitialized use leaks process memory via crafted HTML pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome prior to 151.0.7922.72 extension flaw allows malicious extensions to leak cross-origin datasecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome WebProtect bug pre-151.0.7922.72 lets compromised renderer leak cross-origin data via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 GPU bug allows cross-origin data leak after renderer compromise via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome pre-151.0.7922.72 NoStatePrefetch side-channel allowed remote cross-origin data leaks via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 Codecs uninitialized use leaks memory via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Skia uninitialized use allows cross-origin data leak via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Autofill vulnerability pre-151.0.7922.72: remote cross-origin data leak via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAInsufficient input validation in Chrome Android Payments enables UI spoofing via compromised renderersecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Mac GPU use-after-free allows sandbox escape from compromised renderer via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLASkia out-of-bounds read enables sandbox escape after renderer compromise, Chrome <151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Payments insufficient policy enforcement allows cross-origin data leak via crafted HTML pagesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAANGLE uninitialized use in Chrome <151.0.7922.72 leaks cross-origin data via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAInsufficient policy enforcement allows UXSS via malicious extensions in Chrome pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAAndroid Chrome Bluetooth use-after-free enables sandbox escape by compromised renderer via crafted HTML pre-151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAAndroid Chrome <151 WebView input validation bug lets compromised renderer escape sandbox via HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Android QUIC flaw enabled remote cross-origin data leak via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAAndroid Chrome Autofill prior to 151.0.7922.72 leaks cross-origin data via crafted pagesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome <151 Autofill side-channel allowed cross-origin data leak via crafted page and UI gesturessecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAHigh-severity ANGLE uninitialized use in Chrome pre-151.0.7922.72 enables remote memory disclosure via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Windows pre-151.0.7922.72 Media uninitialized use info leak via crafted HTML requiring renderer compromisesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome iOS <151.0.7922.72 policy enforcement bug allows navigation restriction bypass via crafted HTML remote attackersecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome pre-151.0.7922.72 Actor input validation flaw leaks cross-origin data via compromised renderersecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Media side-channel allows remote cross-origin data leak via crafted HTML (pre-151.0.7922.72)secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAGoogle Chrome <151.0.7922.72 FileSystem policy flaw enables remote cross-origin data leak via crafted pagesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome Android PDF input validation flaw allows local cross-origin data leak via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAHigh-severity ANGLE uninitialized use in Chrome <151.0.7922.72 leaks cross-origin data via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAANGLE implementation flaw leaks process memory via crafted HTML in Chrome <151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAPre-151.0.7922.72 Chrome Print Preview validation flaw leaks cross-origin data via renderer compromisesecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAChrome <151.0.7922.72 ANGLE uninitialized use leaks cross-origin data via crafted HTMLsecure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLARemote cross-origin data leak via crafted HTML exploiting ANGLE uninitialized use in Chrome <151.0.7922.72secure-packages-26.05Aug 4, 2026Sep 18, 2026Aug 4, 2026same day
Fixed within SLAKVM nSVM ignores L1 CR3 restore failure on nested #VMEXIT, corrupting vCPU statesecure-packages-rollingJun 19, 2026Aug 3, 2026Jul 30, 202641 days