By vendor

Apple vulnerabilities

Known CVEs affecting Apple products, prioritized by severity, with SEC.co remediation and detection guidance.

504 published vulnerabilities · page 6 of 6

• CVE-2026-11691LOW 3.1

  Google Chrome contained a flaw in its New Tab Page that could allow attackers who had already compromised Chrome's renderer process to steal data from websites across different origins. The vulnerability required an attacker to have already broken into the renderer—the sandboxed component that runs web content—and then trick a user into visiting a malicious HTML page. While the Chromium security team rated this High severity internally, the calculated CVSS score is Low (3.1) because the attack requires both prior renderer compromise and user interaction.

• CVE-2026-12017LOW 3.1

  Google Chrome versions before 149.0.7827.115 contain a flaw in how browser extensions are implemented that could allow an attacker who has already compromised Chrome's rendering engine to escape site isolation—the security boundary that prevents malicious websites from accessing data belonging to other websites. The attacker would need to trick a user into viewing a specially crafted webpage, but the core vulnerability requires prior control of the renderer process, which significantly limits real-world attack scope.

• CVE-2026-9944LOW 3.1

  CVE-2026-9944 is a memory safety issue in the ANGLE graphics library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious webpage to leak sensitive data from other websites or origins. The vulnerability requires the renderer to be compromised first, limiting the attack surface, but the data leakage potential is real once that initial foothold exists. Chrome versions before 148.0.7778.216 are vulnerable on Windows, macOS, and Linux.

• CVE-2026-9950LOW 3.1

  A same-origin policy bypass vulnerability exists in Google Chrome on iOS versions prior to 148.0.7778.216. The flaw stems from insufficient validation of untrusted input that allows an attacker who has already compromised Chrome's renderer process to craft a malicious HTML page that circumvents browser security boundaries. This means an attacker could potentially access data or perform actions from a different website origin than the one a user is visiting, but only if the renderer process has already been compromised through another attack vector.