By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 4 of 41

• CVE-2026-12090MEDIUM 6.5

  A SQL injection vulnerability exists in the Taskbuilder WordPress plugin (versions up to 5.0.8) that allows authenticated users with subscriber-level access to extract sensitive database information. The vulnerability is in the project filtering functionality and doesn't require additional verification tokens, meaning anyone with basic WordPress account access can exploit it without further prerequisites.

• CVE-2026-12105MEDIUM 6.5

  Devolutions Server contains an access control weakness that allows authenticated users to view attachments they shouldn't have permission to access. The issue occurs when a folder is duplicated—the inherited permissions aren't properly restricted, giving users unintended access to sensitive files. An attacker would need valid login credentials to exploit this, but once authenticated, they could escalate their view into restricted attachment areas without additional authorization.

• CVE-2026-12110MEDIUM 6.5

  A WordPress plugin called Taskbuilder, which provides project and task management features with a Kanban board, contains a SQL injection vulnerability in how it processes task search requests. The vulnerability allows authenticated users—even those with basic Subscriber account privileges—to inject malicious SQL commands to extract sensitive data from the website's database. This is particularly concerning because the vulnerable AJAX function that handles task searches doesn't verify user permissions or validate session tokens, making it accessible to any logged-in user regardless of their intended role.

• CVE-2026-12119MEDIUM 6.5

  The Simple File List WordPress plugin contains a flaw that allows authenticated users with basic contributor privileges to perform unauthorized file operations on a server. An attacker can exploit this by creating a draft post, extracting a security token from its preview, and then using that token to delete files, move files, create folders, or download files—bypassing the plugin's intended access controls. This affects all versions up to 6.3.7.

• CVE-2026-12270MEDIUM 6.5

  Everest Forms, a popular WordPress plugin, contains a flaw in how it protects certain administrative API endpoints used during initial setup. The plugin checks user permissions, but only when a specific HTTP header is present in requests—attackers can simply omit or change this header to bypass the check entirely. This allows unauthenticated visitors to view setup information, change plugin settings, and trigger emails sent to addresses of the attacker's choosing.

• CVE-2026-12302MEDIUM 6.5

  A security bypass vulnerability exists in Firefox and Thunderbird's DOM security component that could allow an attacker to circumvent built-in protections. The vulnerability requires no user interaction and can be exploited over the network, though it is limited to information disclosure and integrity impacts without causing system unavailability. Mozilla has addressed this in recent versions of both browser products.

• CVE-2026-12309MEDIUM 6.5

  A memory safety vulnerability has been identified and patched in Mozilla Firefox and Thunderbird. The flaw allows an attacker to crash the affected application or potentially leak sensitive information without requiring user interaction or special privileges. Mozilla has released fixes in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 to address this issue.

• CVE-2026-12319MEDIUM 6.5

  A denial-of-service vulnerability in Firefox and Thunderbird's audio and video playback component allows an unauthenticated attacker to crash the application by sending a malicious media file or crafting a specially designed media resource. The attacker needs only to trick a user into opening or viewing the content—no special privileges or complex interaction is required. While this does not expose data or allow unauthorized access, it can disrupt productivity and user experience.

• CVE-2026-12325MEDIUM 6.5

  A denial-of-service vulnerability exists in Firefox and Thunderbird's image processing component. An attacker can craft a malicious image that, when viewed by a user, causes the application to crash or become unresponsive. The vulnerability requires user interaction—specifically, the user must open or view the malicious image—but no special privileges are needed. This is a localized impact issue affecting availability rather than data confidentiality or integrity.

• CVE-2026-12388MEDIUM 6.5

  A vulnerability in Keycloak's identity provider mapper system allows administrators with limited permissions to escalate their access to full realm control. By creating a 'Hardcoded Role' mapper, a restricted admin can assign themselves high-level administrative roles like realm-admin, circumventing the permission boundaries that were supposed to limit their authority. This is a privilege escalation vulnerability that turns a controlled administrative account into an unrestricted one.

• CVE-2026-12428MEDIUM 6.5

  The Blocks for ACF Fields plugin for WordPress has a flaw that lets authenticated users view sensitive ACF field data they shouldn't be able to see. Anyone with Author-level access or higher can read field values from private posts, drafts, or other posts belonging to different users by making requests to a specific REST API endpoint. The plugin only checks if a user can publish posts (a very broad permission) rather than verifying they actually own or have permission to view the specific content they're trying to access.

• CVE-2026-12450MEDIUM 6.5

  A flaw in Google Chrome's media handling allows attackers to extract sensitive information from your browser's memory through a specially crafted webpage. An attacker could trick you into visiting a malicious site and potentially access data that shouldn't be exposed—passwords, tokens, or other secrets processed by the browser. This requires user interaction (clicking or visiting the page) but no special permissions, making it a realistic threat for targeted attacks.

• CVE-2026-12461MEDIUM 6.5

  A memory reading flaw in Google Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that extracts sensitive data from the browser's process memory. The vulnerability affects Windows users running Chrome versions prior to 149.0.7827.155. An attacker would need user interaction—specifically, the user must visit a crafted HTML page—but no special privileges or system access are required on the victim's end.

• CVE-2026-12568MEDIUM 6.5

  CVE-2026-12568 is a path traversal vulnerability in the postman_download module that allows attackers to write arbitrary files to a user's system. The flaw stems from improper handling of workspace names retrieved from the Postman API. When a workspace name contains special characters designed to traverse directories (such as ../ sequences), the module fails to sanitize the input before using it to construct file paths. An attacker who controls a malicious Postman workspace can craft a name that causes files to be written outside the intended directory, potentially overwriting or injecting malicious content into the user's system.

• CVE-2026-12620MEDIUM 6.5

  GridTime 3000 GNSS Time Server contains a credential exposure vulnerability where access tokens are inadvertently leaked through URL parameters on certain endpoints. An authenticated attacker can potentially capture or intercept these tokens, gaining unauthorized access to sensitive functionality. This affects versions 1.0r0.03 through 1.1r0.0 of the firmware.

• CVE-2026-12706MEDIUM 6.5

  FFmpeg, a widely used multimedia framework, contains a use-after-free vulnerability in its RASC video decoder. When processing a specially crafted AVI file with malicious RASC video data, the decoder's move-table handling can inadvertently free memory that is still being read by the decode function. This causes the application to access invalid memory locations, typically resulting in a crash. An attacker needs only to trick a user into opening or playing a malicious video file—no special privileges or complex attack setup required.

• CVE-2026-12760MEDIUM 6.5

  The Tapo C200 v3 camera contains a flaw in how it processes fragmented network traffic that allows an attacker on the same local network to disable the device temporarily. By sending specially crafted packets, an attacker can consume excessive resources on the camera, causing it to stop responding and interrupting video monitoring and recording. No authentication or user interaction is required—the attacker simply needs network adjacency to the device.

• CVE-2026-12993MEDIUM 6.5

  Apicurio Registry contains a flaw in its XML parsing logic that allows authenticated users to cause service disruption. While the application blocks certain XML attack vectors like external entity references, it fails to disable internal entity expansion—specifically the 'billion-laughs' attack where deeply nested XML entities force the parser to consume massive amounts of CPU and memory. An attacker with permission to write artifacts can exploit this by uploading a specially crafted XML document. The Java XML parser has a built-in limit that provides partial protection, but it is not guaranteed to prevent all denial-of-service scenarios.

• CVE-2026-13010MEDIUM 6.5

  The JoomSport plugin for WordPress contains a SQL injection vulnerability in its shortcode functionality that allows authenticated users with contributor-level permissions or higher to extract sensitive database information. An attacker with basic WordPress posting privileges can embed a malicious shortcode in a page or post that injects SQL commands to bypass normal database queries and access unauthorized data. The vulnerability affects all versions up to 5.7.9 and requires an attacker to already have legitimate WordPress access.

• CVE-2026-13011MEDIUM 6.5

  The WP ERP (Enterprise Resource Planning) plugin for WordPress contains a SQL injection vulnerability in its employee list functionality. An attacker with HR Manager privileges or higher can manipulate a sorting parameter to inject malicious SQL commands, potentially extracting sensitive company data from the database. While the vulnerability requires authenticated access at a specific privilege level, the ability to exfiltrate data makes it a meaningful risk for organizations running this plugin.

• CVE-2026-13022MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.197 contain a flaw in the Autofill feature that allows an attacker with control of the browser's renderer process to extract sensitive data across website boundaries using a specially crafted web page. This is a moderate-severity issue that requires both the renderer process to be compromised and user interaction to exploit.

• CVE-2026-13208MEDIUM 6.5

  KubeVirt's virt-handler service has a flaw in how it validates incoming event messages from virt-launcher pods running on the same node. When a virt-launcher process sends updates about a virtual machine instance (VMI), the handler accepts the VMI identity directly from the message content without verifying that the sender is actually authorized to update that specific VMI. A compromised virt-launcher could exploit this to send fake lifecycle events for other VMIs on the same node, causing the handler to incorrectly update their state and disrupt normal operations.

• CVE-2026-13226MEDIUM 6.5

  The Groundhogg WordPress plugin for CRM, newsletters, and marketing automation contains a SQL injection vulnerability in its contact table AJAX handler. An authenticated user—regardless of their role—can inject malicious SQL commands through the 'after' parameter to access sensitive database information. This vulnerability exists because the parameter isn't properly escaped, the SQL query lacks preparation defenses, and the security checks that should restrict access have been disabled. While exploitation requires an existing user account, the lack of role restrictions makes this a significant risk for organizations running the plugin.

• CVE-2026-13331MEDIUM 6.5

  The Groundhogg CRM and marketing automation plugin for WordPress contains a SQL injection vulnerability in its search functionality. An authenticated user with marketer-level permissions or higher can craft malicious search queries to extract sensitive data from the WordPress database. The vulnerability exists because the search parameter is not properly escaped before being used in SQL queries. While an attacker needs valid WordPress credentials, the risk is significant because marketers and similar roles often have access to customer data, making unauthorized database extraction a realistic threat.

• CVE-2026-13333MEDIUM 6.5

  A SQL injection vulnerability exists in the Groundhogg WordPress plugin (versions up to 4.5.5) that allows attackers with Sales Representative access or higher to extract sensitive data from the website's database. The vulnerability stems from improper handling of query parameters combined with a bypass mechanism—attackers can submit malformed filter requests that trigger an exception, causing the system to fall back to legacy code that doesn't properly sanitize user input. While authentication is required, the low privilege threshold and straightforward exploitation method make this a meaningful risk for organizations using this plugin.

• CVE-2026-13437MEDIUM 6.5

  Devolutions PowerShell Universal version 2026.2.0 contains a vulnerability where authentication tokens (App Tokens) are exposed in plaintext within job API responses. An authenticated user with permission to read AI Agent jobs can capture these tokens and reuse them to gain unauthorized access to protected resources, potentially with higher privileges than their own account. This affects any organization using the vulnerable version where job APIs are accessible to users with lower privilege levels.

• CVE-2026-13454MEDIUM 6.5

  A flaw in the MotoPress Appointment Booking WordPress plugin allows database extraction attacks. The vulnerability exists in how the plugin processes search parameters, failing to properly filter or prepare user input before passing it to database queries. Any WordPress user with the mpa_appointment_employee role can exploit this to read sensitive data from the database—customer contact information, appointment details, payment records, or other stored information. The flaw affects all versions up to 2.4.5.

• CVE-2026-13593MEDIUM 6.5

  CSS::Minifier::XS is a Perl library that compresses CSS code by removing unnecessary characters like whitespace and comments. Versions before 0.14 contain a memory leak that occurs specifically when the minify function processes CSS files that consist entirely of removable content—essentially documents that should compress to nothing. This causes the application to consume memory that is never released, potentially degrading performance over time if such documents are processed repeatedly.

• CVE-2026-1365MEDIUM 6.5

  A flaw in Sayax Energy Technologies Inc.'s OSOS product allows an authenticated user to bypass security controls by causing sensitive information to be exposed in outgoing data traffic. This means someone with valid login credentials could potentially access systems or data they should not be able to reach. The vulnerability affects OSOS versions through 09072026, and Sayax did not respond to early vendor notification attempts.

• CVE-2026-13790MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's Scroll feature allows attackers to extract sensitive cross-origin data by tricking users into visiting a malicious webpage. The flaw exploits timing or behavioral patterns in how the browser handles scroll operations, potentially exposing information from websites the user has visited or is logged into. Chrome versions prior to 150.0.7871.47 are vulnerable.

• CVE-2026-13793MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it enforces security policies for SVG (Scalable Vector Graphics) content. An attacker can craft a malicious web page that, when visited, leaks data from other websites the user has accessed or logged into. The attack requires user interaction—the victim must visit the attacker's page—but does not require special browser settings or privileges. This is a cross-origin data exposure vulnerability, meaning it breaks the browser's fundamental protection that prevents one website from accessing another's private information.

• CVE-2026-13795MEDIUM 6.5

  A vulnerability in Google Chrome for iOS allows attackers to bypass browser navigation restrictions through a specially crafted webpage. An affected user would need to visit a malicious page, but once there, the attacker can force navigation to restricted destinations that the browser normally blocks. This affects Chrome on iOS up to version 149 and is resolved in version 150.0.7871.47 and later.

• CVE-2026-13809MEDIUM 6.5

  A flaw in Google Chrome's Safe Browsing feature on iOS allows attackers who have already compromised Chrome's rendering process to steal sensitive data from other websites through a specially crafted web page. The vulnerability enables cross-origin information leakage—meaning an attacker could potentially access data that should be isolated between different websites. This requires the attacker to have already gained control of the renderer process, which limits the immediate threat scope but represents a serious escalation risk if other vulnerabilities are chained together.

• CVE-2026-13810MEDIUM 6.5

  A flaw in how Google Chrome on Linux handles user input can allow attackers to steal sensitive information from the browser's memory. An attacker would craft a malicious webpage and trick a user into visiting it; the browser would then leak data that should have been protected. This affects Chrome versions prior to 150.0.7871.47 on Linux systems.

• CVE-2026-13816MEDIUM 6.5

  A vulnerability in Google Chrome for Android allows attackers to steal private data from different websites through a crafted web page. The flaw exists in how Chrome handles file inputs without properly validating untrusted data. An attacker would need to trick a user into visiting a malicious page, but once that happens, sensitive cross-origin information—data meant to be isolated between websites—can be extracted. This affects Chrome versions prior to 150.0.7871.47 on Android devices.

• CVE-2026-13818MEDIUM 6.5

  Google Chrome contained a flaw in its password management feature that could allow an attacker to trick users into navigating to unintended websites through a specially crafted web page. The vulnerability affects Chrome versions prior to 150.0.7871.47 and requires user interaction to exploit. While the attacker cannot steal passwords or crash the browser, the ability to redirect users to malicious sites poses a meaningful risk, particularly for phishing campaigns or drive-by downloads.

• CVE-2026-13820MEDIUM 6.5

  A flaw in Skia, Google Chrome's graphics library, allows an attacker who has already compromised Chrome's renderer process to read memory outside intended boundaries. By serving a specially crafted webpage, the attacker can extract sensitive information that crosses origin boundaries—data they should not have access to. This requires the attacker to first gain control of the renderer process, which typically happens when a user visits a malicious or compromised website. The vulnerability affects Chrome on macOS prior to version 150.0.7871.47.

• CVE-2026-13822MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it handles extensions that allows attackers to bypass the same-origin policy—a critical browser security boundary. An attacker would need to trick a user into installing a malicious extension, after which the attacker could access or modify data from websites the user visits, potentially stealing credentials, session tokens, or sensitive information. This affects Chrome versions before 150.0.7871.47 on Android devices.

• CVE-2026-13826MEDIUM 6.5

  A flaw in Chrome's autofill feature on Android could allow an attacker who has already compromised your browser's rendering process to steal sensitive data from other websites you visit. The attacker would need to trick you into visiting a specially crafted webpage, but once you do, they can extract information that should normally be hidden between different websites.

• CVE-2026-13828MEDIUM 6.5

  A flaw in Google Chrome's Enterprise implementation allows attackers to extract sensitive data from browser memory by tricking users into visiting a specially crafted webpage. The vulnerability requires user interaction (clicking a link or viewing a page) but does not require any special privileges. While the underlying browser processes are not compromised or harmed, the attacker gains unauthorized access to information that may be confidential. This affects Chrome versions prior to 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-13833MEDIUM 6.5

  A memory initialization flaw in Chrome's graphics engine (ANGLE) on macOS allows attackers to steal sensitive data from websites you visit. An attacker hosting a malicious webpage can craft it to trigger the vulnerability when you visit—no special user interaction beyond normal browsing is required beyond clicking a link. The leaked data remains confined to your current browser session, but the confidentiality risk is material.

• CVE-2026-13838MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in CSS rendering that could allow an attacker to craft a malicious web page bypassing Chrome's same-origin policy. This is a client-side vulnerability requiring user interaction—a victim must visit the attacker's page—but if successful, it could enable unauthorized access to data or functionality from other websites the user has visited.

• CVE-2026-13839MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how CSS is processed that allows an attacker to bypass the browser's same-origin policy—a critical security boundary that prevents malicious websites from accessing data belonging to other sites. An attacker would need to trick a user into visiting a specially crafted webpage, but once there, the vulnerability could allow unauthorized access to sensitive information from other origins. This is a medium-severity issue that affects user privacy and data confidentiality.

• CVE-2026-13840MEDIUM 6.5

  A flaw in how Google Chrome enforces security policies on the Canvas API allows attackers to extract sensitive information from different websites. An attacker could craft a malicious HTML page that, when visited by a user, reads data intended to be isolated between websites. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction to exploit.

• CVE-2026-13847MEDIUM 6.5

  Google Chrome for iOS contains a flaw in how it validates user-supplied input when rendering web pages. An attacker can craft a malicious HTML page that, when viewed on an affected iOS device, leaks sensitive data from websites the user has visited or logged into—data that should be isolated between different web origins. The vulnerability affects Chrome versions prior to 150.0.7871.47 on iOS and requires user interaction (the user must visit the attacker's page), but once that happens, no additional steps are needed to compromise cross-origin data.

• CVE-2026-13858MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a memory safety flaw in the bundled FFmpeg video decoder. When processing a specially crafted video file, the decoder reads beyond allocated memory boundaries, potentially exposing sensitive data from the browser process's memory to an attacker. The vulnerability requires user interaction—an attacker must trick a user into opening a malicious video—but exploitation is otherwise straightforward.

• CVE-2026-13862MEDIUM 6.5

  Google Chrome on iOS has a flaw in how it enforces security policies for Web Authentication features like passkeys and security keys. An attacker positioned on the same network as a victim could craft a malicious webpage that tricks the browser into leaking sensitive data from other websites the user has visited. The issue requires the attacker to be on a privileged network position and requires user interaction to click on a malicious link, but if successful can expose confidential information across website boundaries.

• CVE-2026-13866MEDIUM 6.5

  A flaw in how Google Chrome on Android handles user input could allow an attacker to bypass the browser's site isolation security feature. If an attacker had already compromised Chrome's rendering engine through another vulnerability, they could use a specially crafted webpage to escape the sandbox that normally keeps different websites separated from each other. This is a secondary attack that depends on a prior breach of the renderer process.

• CVE-2026-13868MEDIUM 6.5

  A flaw in Google Chrome's network implementation on Android allows an attacker who has already compromised the browser's rendering engine to bypass site isolation—a critical security boundary that prevents malicious websites from accessing data belonging to other sites. The vulnerability requires both a compromised renderer process and user interaction to trigger, and affects Chrome versions before 150.0.7871.47 on Android devices.

• CVE-2026-13871MEDIUM 6.5

  A vulnerability in Google Chrome's GuestView feature allowed attackers who had already compromised the browser's renderer process to bypass the site isolation security boundary using a malicious HTML page. Site isolation is Chrome's primary defense against one renderer process reading data from another site; this flaw created a way around that protection. The vulnerability affects Chrome versions before 150.0.7871.47.

• CVE-2026-13873MEDIUM 6.5

  A memory reading flaw in Google Chrome's Layout component allows attackers to trick users into visiting a malicious webpage that reads sensitive data from the browser process. The attacker gains no ability to modify data or crash the system, but can potentially expose information that should remain private. This affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-13876MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles network traffic that allows an attacker positioned to intercept network communications to bypass the browser's Content Security Policy (CSP) protections. An attacker exploiting this would need to be in a position to monitor or modify traffic between a user and the websites they visit, such as on a shared or compromised network. The attacker cannot directly steal data or crash the browser, but can bypass CSP rules that normally prevent malicious scripts from running, potentially enabling further attacks if the attacker can inject their own content.

• CVE-2026-13879MEDIUM 6.5

  Google Chrome contains a use-after-free memory vulnerability in its Bluetooth implementation that allows attackers on the same local network to extract sensitive data from the browser's memory by using a specially crafted Bluetooth device. This occurs before Chrome version 150.0.7871.47. The vulnerability is rated Medium severity and does not affect system stability or enable attackers to modify data, but it does create a risk of information disclosure from process memory.

• CVE-2026-13881MEDIUM 6.5

  A flaw in how Google Chrome handles web app installations allows attackers to bypass the same-origin policy—a critical browser security boundary—by tricking users into visiting a malicious HTML page. The vulnerability affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux. An attacker could craft a page that tricks Chrome into loading or interacting with resources from a different origin than the user expects, potentially enabling credential theft, session hijacking, or unauthorized data access.

• CVE-2026-13886MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how Isolated Web Apps enforce content security policies. An attacker can craft a malicious HTML page that, when visited by a user, bypasses these protections—potentially allowing unauthorized modifications to web content or application behavior. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require the victim to be logged in or have special privileges.

• CVE-2026-13887MEDIUM 6.5

  This vulnerability affects Google Chrome on Android devices running versions before 150.0.7871.47. An attacker who has already compromised Chrome's renderer process—the component that interprets web pages—can craft a malicious HTML page to extract sensitive data from websites the user visits, even if those sites are on different domains. The attacker cannot modify or delete data, only read it. This is a medium-severity issue that requires the user to visit a malicious page after the renderer is already compromised.

• CVE-2026-13889MEDIUM 6.5

  A vulnerability in Google Chrome on iOS allows attackers to steal sensitive information across different websites through a specially crafted web page. The flaw exists in Chrome's WebAuthentication system and can leak data without requiring any user interaction beyond visiting a malicious page. This affects Chrome versions before 150.0.7871.47 on iOS devices.

• CVE-2026-13892MEDIUM 6.5

  A flaw in Google Chrome for iOS versions before 150.0.7871.47 allows attackers to steal data from websites you visit while using another site, but only if they can trick you into performing specific gestures on their crafted webpage. The vulnerability does not let attackers modify data or crash your browser—it's limited to unauthorized viewing of cross-origin information.

• CVE-2026-13893MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a weakness in the WebUI component where user input is not properly validated. An attacker could craft malicious network traffic to trick a user into visiting a specially prepared page, potentially exposing sensitive data from other websites the user has open. The vulnerability requires user interaction and does not allow attackers to modify data or crash the browser, but the confidentiality risk is significant.

• CVE-2026-13894MEDIUM 6.5

  Google Chrome prior to version 150.0.7871.47 contains a policy enforcement gap that allows an attacker positioned on the same network to manipulate how the browser handles navigation. By serving a specially crafted HTML page, an attacker can circumvent restrictions designed to prevent users from accessing certain sites or resources. The vulnerability requires the attacker to be in a network position to intercept or serve malicious content, and the user must interact with the page (clicking a link or performing an action), but does not result in direct data theft or system access.

• CVE-2026-13896MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in the Glic component that allows attackers to bypass navigation restrictions—mechanisms that prevent unauthorized page transitions or frame navigation. An attacker who crafts a malicious HTML page and tricks a user into visiting it can circumvent these protections, potentially redirecting the user to unintended destinations or manipulating browser navigation in ways that violate security policies. The vulnerability requires user interaction (clicking a link or visiting a page) but needs no special privileges to exploit.

• CVE-2026-13900MEDIUM 6.5

  A vulnerability in Google Chrome's Chromecast implementation allows an attacker who has already compromised the browser's renderer process to bypass navigation security restrictions. The attacker would need to serve a specially crafted web page to exploit this weakness, potentially allowing unauthorized navigation that the browser normally blocks. This requires pre-existing renderer compromise, making it a secondary exploitation path rather than a direct attack vector.

• CVE-2026-13904MEDIUM 6.5

  Google Chrome on iOS has a flaw in its Safe Browsing feature that allows attackers to bypass navigation restrictions designed to protect users from malicious sites. An attacker could craft a malicious HTML page that, when visited, tricks Chrome's safety mechanisms into allowing navigation to a blocked site. The vulnerability requires user interaction—the user must visit the attacker's page—but does not require special system privileges or browser configuration.

• CVE-2026-13906MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain an out-of-bounds read vulnerability in its codec handling code. An attacker can craft a malicious HTML page that, when visited by a user, reads data from Chrome's process memory and potentially exposes sensitive information. The vulnerability requires user interaction (visiting a webpage) but no special privileges, and affects confidentiality only—not availability or integrity.

• CVE-2026-13908MEDIUM 6.5

  Google Chrome on iOS versions before 150.0.7871.47 contain a flaw in the Omnibox (address bar) that allows attackers to bypass navigation security controls. An attacker could trick a user into performing specific gestures—like taps or swipes—while serving malicious network traffic, enabling the browser to navigate to unintended destinations or bypass intended restrictions. The vulnerability requires user interaction and network-level attack capability, but succeeds against users who may not notice subtle UI manipulation.

• CVE-2026-13910MEDIUM 6.5

  Google Chrome on Android contains a vulnerability in its WebXR implementation that can allow attackers to steal data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but once there, they could potentially access sensitive information from other websites you have open in your browser. The vulnerability affects Chrome versions before 150.0.7871.47 on Android devices.

• CVE-2026-13913MEDIUM 6.5

  Google Chrome on iOS has a weakness in how it enforces security policies for the autofill feature. A remote attacker can craft a malicious web page that, if a user interacts with it in specific ways, could leak sensitive data across website boundaries that should normally be hidden from each other. The vulnerability affects Chrome versions prior to 150.0.7871.47 and requires user interaction to exploit.

• CVE-2026-13917MEDIUM 6.5

  Google Chrome for iOS contains a validation flaw that allows attackers to bypass navigation restrictions through a specially crafted web page. The vulnerability requires a user to perform specific interactions with the browser UI, but does not require any special privileges or configuration. An attacker could potentially redirect users to unintended destinations or manipulate the browsing experience by circumventing Chrome's navigation safeguards.

• CVE-2026-13919MEDIUM 6.5

  Google Chrome prior to version 150.0.7871.47 contains a vulnerability in its extension security model that allows an attacker with an already-compromised renderer process to circumvent site isolation protections through a specially crafted web page. Site isolation is Chrome's fundamental defense mechanism that runs each website in a separate process; bypassing it could allow an attacker to access sensitive data from other sites the user is visiting. This requires both a prior renderer compromise and user interaction with a malicious page, but once those conditions are met, the integrity of Chrome's cross-site security boundary is undermined.

• CVE-2026-13921MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how it validates input to the DeviceBoundSessionCredentials feature. An attacker can craft a malicious HTML page that, when visited by a user, bypasses Chrome's same-origin policy—a core security boundary that prevents websites from accessing data or making requests on behalf of other sites. The vulnerability requires user interaction (visiting the crafted page) but does not require special privileges to exploit.

• CVE-2026-13922MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's Paint component allows an attacker to extract sensitive data across website boundaries through a specially crafted webpage. The flaw affects Chrome versions before 150.0.7871.47 and requires user interaction (visiting a malicious site), but does not require special network access or browser extensions. An attacker cannot modify data or crash the browser with this flaw—only read information they shouldn't have access to.

• CVE-2026-13923MEDIUM 6.5

  A flaw in Google Chrome's GPU rendering system on Android allows attackers to trick users into visiting a malicious website that extracts sensitive data from the browser's memory. The vulnerability stems from uninitialized memory in the GPU component—essentially, data that should have been cleared wasn't, leaving fragments of previous operations exposed. An attacker can craft a specially designed webpage that, when viewed by a Chrome user on Android, reads this uninitialized memory and exfiltrates information. Chrome version 150.0.7871.47 and later patch this issue.

• CVE-2026-13924MEDIUM 6.5

  A flaw in Chrome's Android WebView allows an attacker who has already compromised the browser's rendering engine to bypass the same-origin policy—a core security boundary that prevents one website from accessing data belonging to another. The attacker would need to serve a specially crafted HTML page to trigger the bypass. This is a Medium-severity issue affecting Chrome versions before 150.0.7871.47 on Android.

• CVE-2026-13926MEDIUM 6.5

  A flaw in Google Chrome's network validation allows an attacker who has already compromised Chrome's renderer process to bypass navigation security controls. The vulnerability exists because Chrome does not sufficiently validate untrusted input when handling network operations. An attacker would craft a malicious HTML page to trigger the bypass. While the attacker must have compromised the renderer first, the ability to then circumvent navigation restrictions could enable further malicious actions, such as redirecting users to unintended sites or accessing restricted resources.

• CVE-2026-13930MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser enforces navigation restrictions. An attacker can craft a malicious webpage that tricks the browser into allowing navigation to blocked or restricted destinations. The attack requires user interaction (clicking or interacting with the page) but doesn't require any special permissions or authentication. While the security rating is medium, the impact is real: users visiting a malicious site could be redirected to phishing pages, malware distribution sites, or other dangerous destinations that Chrome's security policies should have prevented.

• CVE-2026-13931MEDIUM 6.5

  A vulnerability in Google Chrome's media handling on Windows allows an attacker who has already compromised the renderer process to trick users into believing they're interacting with a legitimate interface, when in fact they're seeing a fake one created by the attacker. The vulnerability requires the renderer to be compromised first, making it part of a multi-stage attack chain. It affects Chrome versions prior to 150.0.7871.47 on Windows.

• CVE-2026-13932MEDIUM 6.5

  A vulnerability in Google Chrome on Android allows an attacker who has already compromised the browser's rendering engine to steal sensitive data from websites you visit. The attacker would need to trick you into visiting a malicious webpage, but once you do and given they control the renderer process, they can access information from other websites you have open—bypassing normal browser security boundaries. This affects Chrome versions before 150.0.7871.47 on Android devices.

• CVE-2026-13935MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a side-channel vulnerability in the ComputePressure API that allows an attacker to extract sensitive cross-origin data through a specially crafted webpage. The vulnerability does not require special privileges or system access—only that a user visit a malicious site—but does not enable attackers to modify data or disrupt service. The flaw stems from timing or behavioral information leakage when the browser queries system pressure metrics, potentially exposing information about other websites or applications running concurrently.

• CVE-2026-13936MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it handles password-related functionality that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive information from the browser's memory. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted site—but does not require any special privileges or authentication. Chrome version 150.0.7871.47 and earlier on Android are affected.

• CVE-2026-13937MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in password policy enforcement that could allow an attacker who has already compromised the browser's rendering engine to steal sensitive information from websites you visit. The attacker would craft a malicious web page to extract data that should remain isolated between different websites. While this requires the renderer process to be compromised first, it represents a meaningful step in a multi-stage attack chain.

• CVE-2026-13940MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Cast feature handles uninitialized memory during type conversion. An attacker positioned on the same local network as a victim can send specially crafted network packets to trigger this bug, potentially reading sensitive data from Chrome's process memory without requiring user interaction or special privileges. The vulnerability is classified as medium severity.

• CVE-2026-13943MEDIUM 6.5

  Google Chrome on Android contains a flaw where uninitialized memory in the CSS rendering engine can leak sensitive data to attackers. An attacker crafts a malicious webpage and tricks a user into visiting it; the browser then exposes fragments of process memory—potentially containing passwords, tokens, or other confidential information—that the attacker can read. This affects Chrome versions before 150.0.7871.47 on Android.

• CVE-2026-13949MEDIUM 6.5

  A flaw in Google Chrome's payment handling on Android devices could allow an attacker to steal sensitive information from the browser's memory. The vulnerability requires a user to visit a malicious website, but does not require any special user privileges or browser configuration. An attacker could craft a deceptive web page that, when viewed, bypasses Chrome's security policies and leaks data from the payment system's process memory—potentially exposing payment-related information or other sensitive details stored there.

• CVE-2026-13953MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the SplitView feature handles navigation security checks. An attacker who has already compromised Chrome's renderer process—the component that executes web content—can exploit this weakness to bypass built-in navigation restrictions by serving a crafted HTML page. The vulnerability requires the attacker to have prior control of the renderer process, which substantially limits the attack surface but remains serious in environments where renderer compromise is plausible.

• CVE-2026-13954MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it enforces security policies when processing XML within web pages. An attacker can craft a malicious HTML page that, when visited by a user, allows the attacker to read sensitive data held in Chrome's process memory. This vulnerability requires user interaction (visiting a malicious page) but does not require the attacker to be authenticated or have special privileges. The vulnerability was patched in Chrome version 150.0.7871.47 and later.

• CVE-2026-13958MEDIUM 6.5

  Google Chrome on Windows contains a memory safety bug in its codec handling that can leak sensitive information to attackers. When a user visits a specially crafted webpage, Chrome may fail to properly initialize certain codec variables, allowing the attacker to read unencrypted data from the browser's memory. This is a confidentiality risk—attackers cannot modify or destroy data, but they may access things like cached credentials, session tokens, or other sensitive information stored in memory during codec operations.

• CVE-2026-13962MEDIUM 6.5

  A weakness in how Google Chrome validates PDF data could allow an attacker who has already compromised Chrome's renderer process to bypass navigation protections using a specially crafted webpage. The vulnerability requires both a prior compromise of the renderer and user interaction, limiting its real-world attack surface but representing a meaningful integrity risk once initial access is established.

• CVE-2026-13964MEDIUM 6.5

  Google Chrome's WebView component on Android contains a flaw that allows attackers to circumvent navigation restrictions through a specially crafted web page. An attacker could trick a user into visiting a malicious HTML page, which then bypasses security controls that normally prevent unauthorized navigation to restricted destinations. This is a policy enforcement gap rather than a code execution vulnerability, meaning the browser's security rules aren't being properly applied in certain conditions.

• CVE-2026-13985MEDIUM 6.5

  A flaw in Google Chrome's MediaCapture implementation allows attackers who have already compromised the browser's renderer process to trick users into interacting with fake UI elements. The attacker crafts a malicious HTML page that makes legitimate-looking interface components appear where they shouldn't, enabling social engineering attacks. This requires the renderer process to already be compromised, limiting the threat to scenarios where initial access has been established through other means.

• CVE-2026-13988MEDIUM 6.5

  A vulnerability in Google Chrome's Paint feature allows attackers to trick users with fake visual elements on web pages. An attacker could craft a deceptive HTML page that, when visited, displays misleading UI elements—such as fake browser controls or warning dialogs—to manipulate user behavior. This affects Chrome versions before 150.0.7871.47 and requires user interaction (clicking or viewing the page) to be exploited. The attack has no impact on data confidentiality or system availability, but could be used for social engineering, credential theft, or other deception-based attacks.

• CVE-2026-13990MEDIUM 6.5

  A vulnerability in Google Chrome's data transfer handling on Windows allows attackers who have already compromised the browser's renderer process to trick users into believing they are interacting with legitimate UI elements. The attacker would craft a malicious webpage that, once loaded, manipulates what appears on screen to deceive the user—for example, making a dangerous action look safe or hiding warning dialogs. This requires the renderer process to be compromised first, which is a meaningful prerequisite but not uncommon in real-world attack chains.

• CVE-2026-13996MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it handles permissions that allows an attacker to trick users with a fake webpage. When users visit a malicious site, the browser may display misleading permission prompts or UI elements, making it appear that certain actions have been approved or denied when they actually haven't. This spoofing attack requires user interaction—the victim must visit the crafted page—but does not result in data theft or system crashes.

• CVE-2026-14002MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles geolocation permissions that allows an attacker who has already compromised Chrome's renderer process to trick users with fake permission dialogs or spoofed UI elements. An attacker would need to first gain control of the renderer process through another vulnerability or attack vector, then exploit this weakness to display misleading geolocation prompts, potentially deceiving users into granting location access they wouldn't otherwise grant.

• CVE-2026-14004MEDIUM 6.5

  A flaw in Google Chrome's CSS rendering engine can allow attackers to extract sensitive information from websites you visit. By crafting a malicious webpage, an attacker could potentially read data that should remain private between you and other websites you're logged into—such as account details or personal information. The vulnerability requires user interaction (clicking a link or visiting a page) and affects Chrome versions before 150.0.7871.47.

• CVE-2026-14007MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it enforces the Permissions Policy—a security feature that controls what browser capabilities (like camera, microphone, geolocation) web pages can access. An attacker can craft a malicious HTML page that tricks the browser into allowing navigation or access that should have been blocked by policy. The vulnerability requires user interaction (clicking a link or opening the page), but once triggered, it can bypass navigation restrictions that administrators or page developers intended to enforce.

• CVE-2026-14008MEDIUM 6.5

  A memory disclosure vulnerability exists in Google Chrome's WebXR implementation on Android devices. An attacker can craft a malicious HTML page that, when visited by a user, reads uninitialized memory from the browser process. This could expose sensitive information such as encryption keys, authentication tokens, or other data previously used by the browser. The vulnerability requires user interaction—the victim must visit the crafted page—but does not require any special browser settings or user privileges to exploit.

• CVE-2026-14010MEDIUM 6.5

  Google Chrome on Windows contains a flaw in how it handles certain codec operations, leaving uninitialized memory accessible to attackers. By serving a specially crafted webpage, an attacker can trick a user into visiting a malicious site and extract sensitive data—such as fragments of passwords, encryption keys, or other in-memory secrets—that happened to be nearby in the browser process. This is a memory disclosure vulnerability that requires user interaction (clicking a link or visiting a site) but poses meaningful risk because the leaked data could be valuable to an attacker.

• CVE-2026-14014MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in the Paint component that allows attackers to trick users into seeing a fake or misleading interface. An attacker would host a malicious webpage; when a user visits it, the page can manipulate what appears on screen to mimic legitimate UI elements (buttons, dialogs, login prompts) or hide the true nature of the content. This is a user-interaction vulnerability—the attack requires a victim to visit the crafted page, but no special browser settings or authentication bypass is needed.

• CVE-2026-14015MEDIUM 6.5

  A race condition in Google Chrome's WebRTC implementation on Windows allows an attacker to trick users into visiting a malicious webpage that leaks data across security boundaries. The vulnerability is triggered during a timing-sensitive sequence in the WebRTC audio/video processing stack, where data meant to be isolated between different website origins becomes accessible. An attacker would need user interaction—specifically, the victim must visit the crafted HTML page—but once there, sensitive information from other websites could be exposed without further prompting.

• CVE-2026-14016MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how SVG (Scalable Vector Graphics) content is processed that could allow an attacker to steal sensitive data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the vulnerability could be exploited to access information the user has access to on other sites—bypassing the browser's normal cross-origin security boundary.