Microsoft Makers of the Windows Operating System and hundreds of products that run on it.

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Microsoft product.

RSS Feeds for Microsoft security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Microsoft products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Microsoft Sorted by Most Security Vulnerabilities since 2018

Microsoft Windows 105879 vulnerabilities

Microsoft Windows Server 20195592 vulnerabilities

Microsoft Windows Server 20165435 vulnerabilities

Microsoft Windows Server 20124078 vulnerabilities

Microsoft Windows Server 20223976 vulnerabilities

Microsoft Windows Server 20082820 vulnerabilities

Microsoft Windows Server 20252597 vulnerabilities

Microsoft Windows 11 24h22557 vulnerabilities

Microsoft Windows 11 23h22455 vulnerabilities

Microsoft Windows 112283 vulnerabilities

Microsoft Windows Server 2012 R22277 vulnerabilities

Microsoft Windows 71811 vulnerabilities

Microsoft Windows 11 25h21718 vulnerabilities

Microsoft Windows 8.11715 vulnerabilities

Microsoft Windows 10 15071679 vulnerabilities

Microsoft Windows Rt 8 11592 vulnerabilities

Microsoft Windows 11 26h11566 vulnerabilities

Microsoft Windows Server 23h21431 vulnerabilities

Microsoft Windows Server 2022 23h21115 vulnerabilities

Microsoft Windows Server 2008 R21100 vulnerabilities

Microsoft Windows932 vulnerabilities

Microsoft Windows Server 2008 Sp2904 vulnerabilities

Microsoft 365 Apps770 vulnerabilities

Microsoft Windows Server655 vulnerabilities

Microsoft Office599 vulnerabilities

Microsoft Sharepoint Server535 vulnerabilities

Microsoft Internet Explorer (IE)528 vulnerabilities
Popular web browser for windows

Microsoft Windows 10 1909520 vulnerabilities

Microsoft Office 2019509 vulnerabilities

Microsoft Office 2021507 vulnerabilities

Microsoft Office 2024504 vulnerabilities

Microsoft Windows Server 2004434 vulnerabilities

Microsoft Edge Browser429 vulnerabilities
Web Browser based on Chromium

Microsoft Office Macos 2021423 vulnerabilities

Microsoft Office Macos 2024419 vulnerabilities

Microsoft Windows Server 20h2397 vulnerabilities

Microsoft Windows Vista382 vulnerabilities

Microsoft Windows Server 1909344 vulnerabilities

Microsoft Windows XP326 vulnerabilities

Microsoft Edge Chromium317 vulnerabilities

Microsoft Windows Server 1903317 vulnerabilities

Microsoft Windows 10 1803279 vulnerabilities

Microsoft Office 365268 vulnerabilities

Microsoft Windows 10 21h1267 vulnerabilities

Microsoft Windows Server 2003262 vulnerabilities

Microsoft Office Long Term Servicing Channel219 vulnerabilities

Microsoft Sharepoint Server 2019204 vulnerabilities

Microsoft Sharepoint Server 2016198 vulnerabilities

Microsoft Excel194 vulnerabilities
Spreadsheet Software

Microsoft Sql Server 2019193 vulnerabilities

Microsoft Excel 2016184 vulnerabilities

Microsoft Windows Server 1803171 vulnerabilities

Microsoft Office 2016168 vulnerabilities

Microsoft Sql Server 2022165 vulnerabilities

Microsoft Windows 2003 Server162 vulnerabilities

Microsoft Visual Studio 2022157 vulnerabilities

Microsoft Net148 vulnerabilities

Microsoft Sql Server 2017144 vulnerabilities

Microsoft Office Online Server135 vulnerabilities

Microsoft Exchange Server132 vulnerabilities

Microsoft Visual Studio 2019125 vulnerabilities

Microsoft Windows 2000112 vulnerabilities

Microsoft Windows 11 2h2110 vulnerabilities

Microsoft SQL Server106 vulnerabilities
Database Server

Microsoft Dynamics 365105 vulnerabilities

Microsoft Word104 vulnerabilities

Microsoft Visual Studio Code99 vulnerabilities
VSCode Developer IDE

Microsoft Visual Studio 201797 vulnerabilities

Microsoft Sql Server 201697 vulnerabilities

Microsoft Visual Studio96 vulnerabilities
Developer IDE

Microsoft Word 201694 vulnerabilities

Microsoft Office 365 Proplus87 vulnerabilities

Microsoft Outlook86 vulnerabilities

Microsoft Sql Server 202570 vulnerabilities

Microsoft Office Compatibility Pack61 vulnerabilities

Microsoft Windows 861 vulnerabilities

Microsoft Windows Nt57 vulnerabilities

Microsoft Office Web Apps55 vulnerabilities

Microsoft Azure Site Recovery53 vulnerabilities

Microsoft Powershell52 vulnerabilities

Microsoft Exchange Server 201651 vulnerabilities

Microsoft .NET Framework47 vulnerabilities

Microsoft Windows Rt46 vulnerabilities

Microsoft Exchange Server 201945 vulnerabilities

Microsoft Hevc Video Extensions44 vulnerabilities

Microsoft Office Web Apps Server42 vulnerabilities

Microsoft Visual Studio 202642 vulnerabilities

Microsoft Http Server41 vulnerabilities

Microsoft Exchange Server Se40 vulnerabilities

Microsoft Azure Devops Server40 vulnerabilities

Microsoft Windows 10 170940 vulnerabilities

Microsoft 39 vulnerabilities

Microsoft Remote Desktop39 vulnerabilities

Microsoft ASP.NET Core38 vulnerabilities

Microsoft Mysql36 vulnerabilities

Microsoft Teams35 vulnerabilities

Microsoft .NET Core35 vulnerabilities

Microsoft Excel Viewer34 vulnerabilities

Microsoft Windows 10 170331 vulnerabilities

Microsoft Ole Db Driver For Sql Server31 vulnerabilities

Recent Microsoft Security Advisories

Advisory	Title	Published
CVE-2026-96940	CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability	October 2, 2026
CVE-2026-91728	Chromium CVE-2026-91728: Integer overflow	September 29, 2026
CVE-2026-91745	Chromium CVE-2026-91745: Use after free	September 29, 2026
CVE-2026-95281	Chromium CVE-2026-95281: Buffer overflow in ANGLE	September 25, 2026
CVE-2026-95277	Chromium CVE-2026-95277: Use after free in Views	September 25, 2026
CVE-2026-95279	Chromium CVE-2026-95279: UI misrepresentation in Omnibox	September 25, 2026
CVE-2026-95280	Chromium CVE-2026-95280: Race condition in V8	September 25, 2026
CVE-2026-95278	Chromium CVE-2026-95278: Missing authorization in WakeLock	September 25, 2026
CVE-2026-95274	Chromium CVE-2026-95274: Improper output encoding in DevTools	September 25, 2026
CVE-2026-95275	Chromium CVE-2026-95275: Incorrect reference resolution in MediaStream	September 25, 2026

Known Exploited Microsoft Vulnerabilities

The following Microsoft vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Microsoft SharePoint Code Injection Vulnerability	Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. CVE-2026-65660	September 25, 2026
Microsoft Windows Heap-Based Buffer Overflow Vulnerability	Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. CVE-2026-85880	September 8, 2026
Microsoft Windows Link Following Vulnerability	Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CVE-2026-81963	September 8, 2026
Microsoft SQL Server Remote Code Execution Vulnerability	Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CVE-2019-1068 Exploit Probability: 57.0%	August 26, 2026
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability	Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. CVE-2026-33824 Exploit Probability: 55.9%	August 18, 2026
Microsoft SharePoint Weak Authentication Vulnerability	Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-55040 Exploit Probability: 1.3%	August 18, 2026
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-68820	August 11, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. CVE-2026-50522 Exploit Probability: 57.1%	July 22, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CVE-2026-58644	July 16, 2026
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerabil	Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-56155 Exploit Probability: 2.3%	July 14, 2026
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability	Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. CVE-2026-56164 Exploit Probability: 18.4%	July 14, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CVE-2026-45659 Exploit Probability: 9.1%	July 1, 2026
Microsoft Defender Denial of Service Vulnerability	Microsoft Defender contains an unspecified vulnerability that allows for denial of service. CVE-2026-45498 Exploit Probability: 63.1%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0249 Exploit Probability: 91.9%	May 20, 2026
Microsoft Defender Link Following Vulnerability	Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-41091 Exploit Probability: 9.6%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0806 Exploit Probability: 82.2%	May 20, 2026
Microsoft DirectX NULL Byte Overwrite Vulnerability	Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. CVE-2009-1537 Exploit Probability: 51.2%	May 20, 2026
Microsoft Windows Buffer Overflow Vulnerability	Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. CVE-2008-4250 Exploit Probability: 98.8%	May 20, 2026
Microsoft Exchange Server Cross-Site Scripting Vulnerability	Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. CVE-2026-42897 Exploit Probability: 5.6%	May 15, 2026
Microsoft Windows Protection Mechanism Failure Vulnerability	Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. CVE-2026-32202 Exploit Probability: 63.7%	April 28, 2026

Of the known exploited vulnerabilities above, 6 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 4 known exploited Microsoft vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Microsoft Vulnerabilities

Based on the current exploit probability, these Microsoft vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2019-0708	100.0%	"BlueKeep" Microsoft Windows Remote Desktop Remote Code Execution Vulnerability
2	CVE-2021-34473	100.0%	Microsoft Exchange Server Remote Code Execution Vulnerability
3	CVE-2015-1635	100.0%	Microsoft HTTP.sys Remote Code Execution Vulnerability
4	CVE-2025-53770	100.0%	Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
5	CVE-2021-26855	100.0%	Microsoft OWA Exchange Control Panel (ECP) Exploit Chain
6	CVE-2025-49704	100.0%	Microsoft SharePoint Code Injection Vulnerability
7	CVE-2021-34523	100.0%	Microsoft Exchange Server Privilege Escalation Vulnerability
8	CVE-2023-29357	100.0%	Microsoft SharePoint Server Privilege Escalation Vulnerability
9	CVE-2025-59287	100.0%	Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
10	CVE-2012-0158	100.0%	Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability

By the Year

In 2026 there have been 7182 vulnerabilities in Microsoft with an average score of 7.3 out of ten. Last year, in 2025 Microsoft had 2759 security vulnerabilities published. That is, 4423 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.

Year	Vulnerabilities	Average Score
2026	7182	7.26
2025	2759	7.23
2024	2182	7.39
2023	1695	7.21
2022	1389	7.43
2021	1153	7.44
2020	1253	7.19
2019	831	7.08
2018	661	7.03

It may take a day or so for new Microsoft vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Microsoft Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-96940	Oct 02, 2026	Oct 2026: Microsoft Exchange Server Elevation of Privilege Vulnerability Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.	Exchange Server 2019 Exchange Server 2016 Exchange Server Se
CVE-2026-95305	Sep 29, 2026	Google Chrome Chromoting UI Spoofing before 154.0.8037.57 UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
CVE-2026-95340	Sep 29, 2026	Chrome <154.0.8037.57: PIP Auth Bypass Web Origin Policy (CVE-2026-95340) Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95316	Sep 29, 2026	Local Mem Read via Unchecked Return Value in Chrome <154.0.8037.57 Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)
CVE-2026-95328	Sep 29, 2026	Google Chrome Android <154.0.8037.57: Confused Deputy via Coinstalled App Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
CVE-2026-95364	Sep 29, 2026	Google Chrome <154.0.8037.57 Passwords Input Validation Spoof Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95380	Sep 29, 2026	Type Confusion in V8 of Chrome v<154.0.8037.57: RCE via HTML Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95342	Sep 29, 2026	Missing Auth in Chrome V8 <154.0.8037.57 Allowing Remote Web Origin Bypass Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95296	Sep 29, 2026	Chrome Core Mac auth flaw before 154.0.8037.57 cross-origin data leak Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95288	Sep 29, 2026	UI Spoof via Crafted HTML in Chrome iOS <154.0.8037.57 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95361	Sep 29, 2026	Confused Deputy in DevTools (Chrome <154.0.8037.57) Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95326	Sep 29, 2026	Google Chrome 154.0.8037.57 Bluetooth cleanup flaw bypasses restrictions Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95319	Sep 29, 2026	Chrome <154.0.8037.57: UAF in Printing, remote code exec risk Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95309	Sep 29, 2026	Google Chrome Mobile iOS <154.0.8037.57 UI Spoofing via Crafted HTML UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95352	Sep 29, 2026	DevTools Auth Bypass in Chrome <154.0.8037.57 via Extension Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-95385	Sep 29, 2026	Chrome Windows <154.0.8037.57 PlatformIntegration Bypass via Crafted HTML Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95367	Sep 29, 2026	Info Leak via DataTransfer in Chrome <154.0.8037.57 Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95368	Sep 29, 2026	Chrome DevTools Authorisation Bypass <154.0.8037.57 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95279	Sep 29, 2026	Chrome Android UI Misrepresentation Omnibox Spoof <154.0.8037.57 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95292	Sep 29, 2026	Chrome SafeBrowsing Auth Bypass (<154.0.8037.57) Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-95334	Sep 29, 2026	Google Chrome <154.0.8037.57 WebProtect RCE via Reference Resolution Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95308	Sep 29, 2026	Google Chrome <154.0.8037.57 Integer Overflow in Metrics (Renderer) Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95333	Sep 29, 2026	Chrome UA Free in Metrics before 154.0.8037.57 exec outside sandbox Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95327	Sep 29, 2026	Info Leak in Chrome Networking before 154.0.8037.57 Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95307	Sep 29, 2026	UI Spoofing via ExtensionsMenu in Chrome <154.0.8037.57 UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95285	Sep 29, 2026	Chrome Android WebView Auth Bypass 154.0.8037.57 Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95278	Sep 29, 2026	Google Chrome <154.0.8037.57 WakeLock Auth Bypass via Crafted HTML Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95311	Sep 29, 2026	Chrome Fonts non-heap memory free RCE (pre-154.0.8037.57) Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95358	Sep 29, 2026	Google Chrome Mobile Auth Bypass prior to 154.0.8037.57 Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
CVE-2026-95347	Sep 29, 2026	Chrome Updater UAF (Mac) <154.0.8037.57 Allows RCA Exec Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95312	Sep 29, 2026	Info Leak in Chrome Passwords <154.0.8037.57 via Renderer Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95344	Sep 29, 2026	DevTools Race Condition: Chrome <154.0.8037.57 Bypasses Site Isolation Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-95332	Sep 29, 2026	Uninitialized Var in Tint (Chrome Android <154.0.8037.57) Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95289	Sep 29, 2026	Incorrect Auth in Scroll (Chrome <154.0.8037.57) Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95374	Sep 29, 2026	Google Chrome <154.0.8037.57 Network Auth Bypass via Crafted HTML Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95300	Sep 29, 2026	Chrome DevTools Auth Bypass Before 154.0.8037.57 via Crafted Traffic Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95323	Sep 29, 2026	Chrome iOS UI Spoofing Vulnerability in Chromium (URL Bar) Fixed 154.0.8037.57 UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95321	Sep 29, 2026	Chrome Android <154.0.8037.57 UI Spoof via Crafted HTML UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95336	Sep 29, 2026	Info Leak in Chrome Transactions Platform <154.0.8037.57 via Crafted HTML Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95325	Sep 29, 2026	Use-after-free in ANGLE before 154.0.8037.57 allows remote code exec in Chrome Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95290	Sep 29, 2026	Google Chrome <154.0.8037.57 NFC Auth Bypass via Renderer Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95275	Sep 29, 2026	Google Chrome <154.0.8037.57 MediaStream Ref Res. Bypass via crafted HTML Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95363	Sep 29, 2026	Chrome FileSystem UI spoofing <154.0.8037.57 via crafted HTML UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95354	Sep 29, 2026	Use-After-Free in Chrome Verifier before 154.0.8037.57 Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95384	Sep 29, 2026	Chrome <=154.0.8037.57 Transactions Platform RACE leaking info Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95341	Sep 29, 2026	Chrome Desktop <154.0.8037.57 Input Validation Execute External Code Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95371	Sep 29, 2026	Missing Auth in Chrome Views (Mac) <154.0.8037.57 Spoof UI Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95353	Sep 29, 2026	Google Chrome <154.0.8037.57 Use-After-Free in Bindings Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95314	Sep 29, 2026	Chrome pre-154.0.8037.57 HID Auth Bypass via HTML (CVE-2026-95314) Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95276	Sep 29, 2026	Chrome Themes Prior 154.0.8037.57 Improper Input Validation RCE Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)