Microsoft Makers of the Windows Operating System and hundreds of products that run on it.

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Microsoft product.

RSS Feeds for Microsoft security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Microsoft products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Microsoft Sorted by Most Security Vulnerabilities since 2018

Microsoft Windows 105879 vulnerabilities

Microsoft Windows Server 20195592 vulnerabilities

Microsoft Windows Server 20165435 vulnerabilities

Microsoft Windows Server 20124078 vulnerabilities

Microsoft Windows Server 20223976 vulnerabilities

Microsoft Windows Server 20082820 vulnerabilities

Microsoft Windows Server 20252597 vulnerabilities

Microsoft Windows 11 24h22557 vulnerabilities

Microsoft Windows 11 23h22455 vulnerabilities

Microsoft Windows 112283 vulnerabilities

Microsoft Windows Server 2012 R22277 vulnerabilities

Microsoft Windows 71811 vulnerabilities

Microsoft Windows 11 25h21718 vulnerabilities

Microsoft Windows 8.11715 vulnerabilities

Microsoft Windows 10 15071679 vulnerabilities

Microsoft Windows Rt 8 11592 vulnerabilities

Microsoft Windows 11 26h11566 vulnerabilities

Microsoft Windows Server 23h21431 vulnerabilities

Microsoft Windows Server 2022 23h21115 vulnerabilities

Microsoft Windows Server 2008 R21100 vulnerabilities

Microsoft Windows932 vulnerabilities

Microsoft Windows Server 2008 Sp2904 vulnerabilities

Microsoft 365 Apps769 vulnerabilities

Microsoft Windows Server655 vulnerabilities

Microsoft Office599 vulnerabilities

Microsoft Sharepoint Server535 vulnerabilities

Microsoft Internet Explorer (IE)528 vulnerabilities
Popular web browser for windows

Microsoft Windows 10 1909520 vulnerabilities

Microsoft Office 2019509 vulnerabilities

Microsoft Office 2021506 vulnerabilities

Microsoft Office 2024503 vulnerabilities

Microsoft Windows Server 2004434 vulnerabilities

Microsoft Edge Browser429 vulnerabilities
Web Browser based on Chromium

Microsoft Office Macos 2021423 vulnerabilities

Microsoft Office Macos 2024419 vulnerabilities

Microsoft Windows Server 20h2397 vulnerabilities

Microsoft Windows Vista382 vulnerabilities

Microsoft Windows Server 1909344 vulnerabilities

Microsoft Windows XP326 vulnerabilities

Microsoft Edge Chromium317 vulnerabilities

Microsoft Windows Server 1903317 vulnerabilities

Microsoft Windows 10 1803279 vulnerabilities

Microsoft Office 365268 vulnerabilities

Microsoft Windows 10 21h1267 vulnerabilities

Microsoft Windows Server 2003262 vulnerabilities

Microsoft Office Long Term Servicing Channel219 vulnerabilities

Microsoft Sharepoint Server 2019204 vulnerabilities

Microsoft Sharepoint Server 2016198 vulnerabilities

Microsoft Excel194 vulnerabilities
Spreadsheet Software

Microsoft Sql Server 2019193 vulnerabilities

Microsoft Excel 2016184 vulnerabilities

Microsoft Windows Server 1803171 vulnerabilities

Microsoft Office 2016168 vulnerabilities

Microsoft Sql Server 2022165 vulnerabilities

Microsoft Windows 2003 Server162 vulnerabilities

Microsoft Visual Studio 2022157 vulnerabilities

Microsoft Net148 vulnerabilities

Microsoft Sql Server 2017144 vulnerabilities

Microsoft Office Online Server135 vulnerabilities

Microsoft Exchange Server132 vulnerabilities

Microsoft Visual Studio 2019125 vulnerabilities

Microsoft Windows 2000112 vulnerabilities

Microsoft Windows 11 2h2110 vulnerabilities

Microsoft SQL Server106 vulnerabilities
Database Server

Microsoft Dynamics 365105 vulnerabilities

Microsoft Word104 vulnerabilities

Microsoft Visual Studio Code99 vulnerabilities
VSCode Developer IDE

Microsoft Visual Studio 201797 vulnerabilities

Microsoft Sql Server 201697 vulnerabilities

Microsoft Visual Studio96 vulnerabilities
Developer IDE

Microsoft Word 201694 vulnerabilities

Microsoft Office 365 Proplus87 vulnerabilities

Microsoft Outlook86 vulnerabilities

Microsoft Sql Server 202570 vulnerabilities

Microsoft Office Compatibility Pack61 vulnerabilities

Microsoft Windows 861 vulnerabilities

Microsoft Windows Nt57 vulnerabilities

Microsoft Office Web Apps55 vulnerabilities

Microsoft Azure Site Recovery53 vulnerabilities

Microsoft Powershell52 vulnerabilities

Microsoft Exchange Server 201650 vulnerabilities

Microsoft .NET Framework47 vulnerabilities

Microsoft Windows Rt46 vulnerabilities

Microsoft Exchange Server 201944 vulnerabilities

Microsoft Hevc Video Extensions44 vulnerabilities

Microsoft Office Web Apps Server42 vulnerabilities

Microsoft Visual Studio 202642 vulnerabilities

Microsoft Http Server41 vulnerabilities

Microsoft Azure Devops Server40 vulnerabilities

Microsoft Windows 10 170940 vulnerabilities

Microsoft 39 vulnerabilities

Microsoft Remote Desktop39 vulnerabilities

Microsoft Exchange Server Se39 vulnerabilities

Microsoft ASP.NET Core38 vulnerabilities

Microsoft Mysql36 vulnerabilities

Microsoft Teams35 vulnerabilities

Microsoft .NET Core35 vulnerabilities

Microsoft Excel Viewer34 vulnerabilities

Microsoft Windows 10 170331 vulnerabilities

Microsoft Ole Db Driver For Sql Server31 vulnerabilities

Recent Microsoft Security Advisories

Advisory	Title	Published
CVE-2026-88097	CVE-2026-88097 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	September 18, 2026
CVE-2026-70009	CVE-2026-70009 Azure Arc Elevation of Privilege Vulnerability	September 17, 2026
CVE-2026-68791	CVE-2026-68791 Azure Machine Learning Information Disclosure Vulnerability	September 17, 2026
CVE-2026-87701	CVE-2026-87701 Azure Cosmos DB Elevation of Privilege Vulnerability	September 17, 2026
CVE-2026-78501	CVE-2026-78501 Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability	September 17, 2026
CVE-2026-69399	CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability	September 17, 2026
CVE-2026-83944	CVE-2026-83944 Azure Logic Apps Elevation of Privilege Vulnerability	September 17, 2026
CVE-2026-55946	CVE-2026-55946 Microsoft Copilot Information Disclosure Vulnerability	September 17, 2026
CVE-2026-77903	CVE-2026-77903 Microsoft Dataverse Elevation of Privilege Vulnerability	September 17, 2026
CVE-2026-69865	CVE-2026-69865 Microsoft Container Registry Elevation of Privilege Vulnerability	September 17, 2026

Known Exploited Microsoft Vulnerabilities

The following Microsoft vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Microsoft Windows Heap-Based Buffer Overflow Vulnerability	Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. CVE-2026-85880	September 8, 2026
Microsoft Windows Link Following Vulnerability	Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CVE-2026-81963	September 8, 2026
Microsoft SQL Server Remote Code Execution Vulnerability	Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CVE-2019-1068 Exploit Probability: 52.8%	August 26, 2026
Microsoft SharePoint Weak Authentication Vulnerability	Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-55040 Exploit Probability: 1.3%	August 18, 2026
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability	Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. CVE-2026-33824 Exploit Probability: 55.9%	August 18, 2026
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-68820	August 11, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. CVE-2026-50522 Exploit Probability: 57.1%	July 22, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CVE-2026-58644	July 16, 2026
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability	Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. CVE-2026-56164 Exploit Probability: 18.4%	July 14, 2026
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerabil	Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-56155 Exploit Probability: 2.3%	July 14, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CVE-2026-45659 Exploit Probability: 9.1%	July 1, 2026
Microsoft Defender Denial of Service Vulnerability	Microsoft Defender contains an unspecified vulnerability that allows for denial of service. CVE-2026-45498 Exploit Probability: 63.1%	May 20, 2026
Microsoft Defender Link Following Vulnerability	Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-41091 Exploit Probability: 9.6%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0806 Exploit Probability: 82.2%	May 20, 2026
Microsoft DirectX NULL Byte Overwrite Vulnerability	Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. CVE-2009-1537 Exploit Probability: 51.2%	May 20, 2026
Microsoft Windows Buffer Overflow Vulnerability	Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. CVE-2008-4250 Exploit Probability: 98.8%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0249 Exploit Probability: 91.9%	May 20, 2026
Microsoft Exchange Server Cross-Site Scripting Vulnerability	Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. CVE-2026-42897 Exploit Probability: 5.6%	May 15, 2026
Microsoft Windows Protection Mechanism Failure Vulnerability	Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. CVE-2026-32202 Exploit Probability: 63.7%	April 28, 2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability	Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. CVE-2026-33825 Exploit Probability: 6.7%	April 22, 2026

Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 5 known exploited Microsoft vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Microsoft Vulnerabilities

Based on the current exploit probability, these Microsoft vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2019-0708	100.0%	"BlueKeep" Microsoft Windows Remote Desktop Remote Code Execution Vulnerability
2	CVE-2021-34473	100.0%	Microsoft Exchange Server Remote Code Execution Vulnerability
3	CVE-2015-1635	100.0%	Microsoft HTTP.sys Remote Code Execution Vulnerability
4	CVE-2021-26855	100.0%	Microsoft OWA Exchange Control Panel (ECP) Exploit Chain
5	CVE-2021-34523	100.0%	Microsoft Exchange Server Privilege Escalation Vulnerability
6	CVE-2023-29357	100.0%	Microsoft SharePoint Server Privilege Escalation Vulnerability
7	CVE-2025-53770	100.0%	Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
8	CVE-2012-0158	100.0%	Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
9	CVE-2022-41082	100.0%	Microsoft Exchange Server Remote Code Execution Vulnerability
10	CVE-2020-0688	100.0%	Microsoft Exchange Server Key Validation Vulnerability

By the Year

In 2026 there have been 7069 vulnerabilities in Microsoft with an average score of 7.3 out of ten. Last year, in 2025 Microsoft had 2759 security vulnerabilities published. That is, 4310 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.

Year	Vulnerabilities	Average Score
2026	7069	7.26
2025	2759	7.23
2024	2182	7.39
2023	1695	7.21
2022	1389	7.43
2021	1153	7.44
2020	1253	7.19
2019	831	7.08
2018	661	7.03

It may take a day or so for new Microsoft vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Microsoft Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-88097	Sep 18, 2026	Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.	Edge Chromium
CVE-2026-85887	Sep 17, 2026	Sep 2026: M365 Copilot Information Disclosure Vulnerability Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.	365 Copilot
CVE-2026-83946	Sep 17, 2026	Sep 2026: Azure Portal Spoofing Vulnerability Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.	Azure Portal
CVE-2026-69843	Sep 17, 2026	Sep 2026: Microsoft Fabric Elevation of Privilege Vulnerability Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.	Microsoft Fabric
CVE-2026-85878	Sep 17, 2026	Sep 2026: Azure Database for PostgreSQL Elevation of Privilege Vulnerability Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.	Azure Horizondb
CVE-2026-62874	Sep 17, 2026	Sep 2026: Azure Billing Elevation of Privilege Vulnerability Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.	Azure Billing
CVE-2026-85917	Sep 17, 2026	Sep 2026: Azure AI Foundry Elevation of Privilege Vulnerability Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.	Azure Ai Foundry
CVE-2026-85889	Sep 17, 2026	Sep 2026: Azure AI Foundry Elevation of Privilege Vulnerability Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.	Azure Ai Foundry
CVE-2026-70200	Sep 17, 2026	Sep 2026: Azure Logic Apps Elevation of Privilege Vulnerability Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.	Azure Logic Apps
CVE-2026-87701	Sep 17, 2026	Sep 2026: Azure Cosmos DB Elevation of Privilege Vulnerability Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.	Cosmos Db
CVE-2026-78501	Sep 17, 2026	Sep 2026: Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.	365 Copilot Business Chat
CVE-2026-83944	Sep 17, 2026	Sep 2026: Azure Logic Apps Elevation of Privilege Vulnerability Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.	Azure Logic Apps
CVE-2026-85885	Sep 17, 2026	Sep 2026: Microsoft 365 Copilot Elevation of Privilege Vulnerability Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.	365 Copilot
CVE-2026-68791	Sep 17, 2026	Sep 2026: Azure Machine Learning Information Disclosure Vulnerability Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.	Azure Machine Learning
CVE-2026-69399	Sep 17, 2026	Sep 2026: Azure Arc Elevation of Privilege Vulnerability Azure Arc Elevation of Privilege Vulnerability	Azure Arc
CVE-2026-69865	Sep 17, 2026	Sep 2026: Microsoft Container Registry Elevation of Privilege Vulnerability Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.	Azure Container Registry
CVE-2026-77903	Sep 17, 2026	Sep 2026: Microsoft Dataverse Elevation of Privilege Vulnerability Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.	Dataverse
CVE-2026-70009	Sep 17, 2026	Sep 2026: Azure Arc Elevation of Privilege Vulnerability Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.	Azure Arc
CVE-2026-55946	Sep 17, 2026	Sep 2026: Microsoft Copilot Information Disclosure Vulnerability Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.	Copilot
CVE-2026-85893	Sep 15, 2026	Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.	Edge Chromium
CVE-2026-69486	Sep 15, 2026	Sep 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-85892	Sep 14, 2026	Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.	Edge Chromium
CVE-2026-85921	Sep 14, 2026	Sep 2026: Windows Secure Kernel Mode Elevation of Privilege Vulnerability Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.	Windows 11 26h1
CVE-2026-77490	Sep 11, 2026	Sep 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	Edge Chromium
CVE-2026-70341	Sep 11, 2026	Sep 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.	Edge Browser Edge Chromium
CVE-2026-87602	Sep 09, 2026	OOB read in ANGLE in Google Chrome <153.0.8010.36 on Windows Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87437	Sep 09, 2026	Google Chrome <153.0.8010.36 Frames Info Leak Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87430	Sep 09, 2026	Buf overflow in WebRTC of Chrome <153.0.8010.36 Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87593	Sep 09, 2026	Google Chrome <=153.0.8010.36 Info Leak via Editing Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87544	Sep 09, 2026	Chrome Extensions Auth Bypass < 153.0.8010.36 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87601	Sep 09, 2026	V8 Race Condition in Google Chrome before 153.0.8010.36 Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87575	Sep 09, 2026	Google Chrome <=153.0.8010.36 Loader Auth Bypass via Crafted HTML Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87571	Sep 09, 2026	Chrome Loader Cert Validation Bypass (v<153.0.8010.36) Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
CVE-2026-87477	Sep 09, 2026	Info Leak in Chrome Core before 153.0.8010.36 via crafted HTML Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87608	Sep 09, 2026	FedCM Improper Cert Validation in Chrome <153.0.8010.36 Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
CVE-2026-87551	Sep 09, 2026	Google Chrome <153.0.8010.36 Improper Cert Validation in CORS Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
CVE-2026-87469	Sep 09, 2026	Chrome 153.0.8010.36: Extensions Input Validation Flaw Bypasses Origin Policy Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low)
CVE-2026-87489	Sep 09, 2026	V8 Memory Corruption in Chrome <153.0.8010.36 via Extension Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-87631	Sep 09, 2026	Google Chrome <153.0.8010.36 DOM Auth Missing (CVE-2026-87631) Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87473	Sep 09, 2026	Google Chrome <153.0.8010.36: FileHandling Authorization Bypass (CVE-2026-87473) Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87490	Sep 09, 2026	Info Leak in Chrome Transactions Platform <153.0.8010.36 Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87583	Sep 09, 2026	Google Chrome Android <153.0.8010.36 Password UI spoofing UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87509	Sep 09, 2026	Google Chrome Windows <153.0.8010.36 Updater Auth Bypass Exec Outside Sandbox Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)
CVE-2026-87461	Sep 09, 2026	CVE-2026-87461: Cross-origin Info Leak in Chrome Core before 153.0.8010.36 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-87617	Sep 09, 2026	Use-after-free in DevTools (Chrome <153.0.8010.36) Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87523	Sep 09, 2026	Race Condition in DataTransfer (Chrome <153.0.8010.36) Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87624	Sep 09, 2026	Chrome Android <153.0.8010.36 UI Spoofing via Password UI Misrepresentation UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87565	Sep 09, 2026	Info Leak: Chrome Passwords on Android 153.0.8010.36 Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87605	Sep 09, 2026	Missing Auth in Chrome Contacts (153.0.8010.36) Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87502	Sep 09, 2026	Confused Deputy in Chrome Fullscreen (153.0.8010.36) Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)