Microsoft Makers of the Windows Operating System and hundreds of products that run on it.

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Microsoft product.

RSS Feeds for Microsoft security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Microsoft products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Microsoft Sorted by Most Security Vulnerabilities since 2018

Microsoft Windows 105237 vulnerabilities

Microsoft Windows Server 20194976 vulnerabilities

Microsoft Windows Server 20164881 vulnerabilities

Microsoft Windows Server 20123685 vulnerabilities

Microsoft Windows Server 20223335 vulnerabilities

Microsoft Windows Server 20082820 vulnerabilities

Microsoft Windows 112283 vulnerabilities

Microsoft Windows 11 24h21929 vulnerabilities

Microsoft Windows Server 20251918 vulnerabilities

Microsoft Windows Server 2012 R21859 vulnerabilities

Microsoft Windows 11 23h21852 vulnerabilities

Microsoft Windows 71811 vulnerabilities

Microsoft Windows 8.11715 vulnerabilities

Microsoft Windows 10 15071679 vulnerabilities

Microsoft Windows Rt 8 11592 vulnerabilities

Microsoft Windows Server 23h21431 vulnerabilities

Microsoft Windows Server 2022 23h21115 vulnerabilities

Microsoft Windows Server 2008 R21100 vulnerabilities

Microsoft Windows 11 25h21091 vulnerabilities

Microsoft Windows 11 26h1938 vulnerabilities

Microsoft Windows932 vulnerabilities

Microsoft Windows Server 2008 Sp2904 vulnerabilities

Microsoft 365 Apps663 vulnerabilities

Microsoft Windows Server655 vulnerabilities

Microsoft Office597 vulnerabilities

Microsoft Internet Explorer (IE)528 vulnerabilities
Popular web browser for windows

Microsoft Windows 10 1909520 vulnerabilities

Microsoft Sharepoint Server519 vulnerabilities

Microsoft Windows Server 2004434 vulnerabilities

Microsoft Edge Browser422 vulnerabilities
Web Browser based on Chromium

Microsoft Office 2019404 vulnerabilities

Microsoft Office 2021401 vulnerabilities

Microsoft Office 2024398 vulnerabilities

Microsoft Windows Server 20h2397 vulnerabilities

Microsoft Windows Vista382 vulnerabilities

Microsoft Windows Server 1909344 vulnerabilities

Microsoft Office Macos 2021335 vulnerabilities

Microsoft Office Macos 2024332 vulnerabilities

Microsoft Windows XP326 vulnerabilities

Microsoft Windows Server 1903317 vulnerabilities

Microsoft Edge Chromium311 vulnerabilities

Microsoft Windows 10 1803279 vulnerabilities

Microsoft Windows 10 21h1267 vulnerabilities

Microsoft Windows Server 2003262 vulnerabilities

Microsoft Office Long Term Servicing Channel219 vulnerabilities

Microsoft Sharepoint Server 2019204 vulnerabilities

Microsoft Sharepoint Server 2016198 vulnerabilities

Microsoft Excel194 vulnerabilities
Spreadsheet Software

Microsoft Office 365180 vulnerabilities

Microsoft Windows Server 1803171 vulnerabilities

Microsoft Windows 2003 Server162 vulnerabilities

Microsoft Excel 2016154 vulnerabilities

Microsoft Visual Studio 2022150 vulnerabilities

Microsoft Net142 vulnerabilities

Microsoft Sql Server 2019141 vulnerabilities

Microsoft Office Online Server135 vulnerabilities

Microsoft Exchange Server132 vulnerabilities

Microsoft Visual Studio 2019125 vulnerabilities

Microsoft Office 2016114 vulnerabilities

Microsoft Sql Server 2022113 vulnerabilities

Microsoft Windows 2000112 vulnerabilities

Microsoft Windows 11 2h2110 vulnerabilities

Microsoft SQL Server106 vulnerabilities
Database Server

Microsoft Word104 vulnerabilities

Microsoft Dynamics 365103 vulnerabilities

Microsoft Sql Server 201799 vulnerabilities

Microsoft Visual Studio 201797 vulnerabilities

Microsoft Sql Server 201697 vulnerabilities

Microsoft Visual Studio96 vulnerabilities
Developer IDE

Microsoft Office 365 Proplus87 vulnerabilities

Microsoft Visual Studio Code87 vulnerabilities
VSCode Developer IDE

Microsoft Outlook86 vulnerabilities

Microsoft Word 201662 vulnerabilities

Microsoft Office Compatibility Pack61 vulnerabilities

Microsoft Windows 861 vulnerabilities

Microsoft Windows Nt57 vulnerabilities

Microsoft Office Web Apps55 vulnerabilities

Microsoft Azure Site Recovery53 vulnerabilities

Microsoft Powershell51 vulnerabilities

Microsoft Windows Rt46 vulnerabilities

Microsoft .NET Framework45 vulnerabilities

Microsoft Exchange Server 201642 vulnerabilities

Microsoft Office Web Apps Server42 vulnerabilities

Microsoft Hevc Video Extensions42 vulnerabilities

Microsoft Http Server41 vulnerabilities

Microsoft Azure Devops Server40 vulnerabilities

Microsoft Windows 10 170940 vulnerabilities

Microsoft 39 vulnerabilities

Microsoft ASP.NET Core37 vulnerabilities

Microsoft Mysql36 vulnerabilities

Microsoft .NET Core35 vulnerabilities

Microsoft Remote Desktop35 vulnerabilities

Microsoft Exchange Server 201935 vulnerabilities

Microsoft Excel Viewer34 vulnerabilities

Microsoft Visual Studio 202633 vulnerabilities

Microsoft Teams33 vulnerabilities

Microsoft Windows 10 170331 vulnerabilities

Microsoft Ole Db Driver For Sql Server31 vulnerabilities

Microsoft Exchange Server Se30 vulnerabilities

Recent Microsoft Security Advisories

Advisory	Title	Published
CVE-2026-72984	CVE-2026-72984 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	August 28, 2026
CVE-2026-78891	Chromium: CVE-2026-78891 Buffer overflow in WebRTC	August 28, 2026
CVE-2026-66324	CVE-2026-66324 Microsoft Edge (Chromium-based) Spoofing Vulnerability	August 28, 2026
CVE-2026-70309	CVE-2026-70309 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	August 28, 2026
CVE-2026-66323	CVE-2026-66323 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	August 28, 2026
CVE-2026-70341	CVE-2026-70341 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	August 28, 2026
CVE-2026-70331	CVE-2026-70331 Microsoft Edge for iOS Spoofing Vulnerability	August 28, 2026
CVE-2026-58616	CVE-2026-58616 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	August 28, 2026
CVE-2026-78892	Chromium: CVE-2026-78892 Incorrect authorization in Chromoting	August 28, 2026
CVE-2026-66798	CVE-2026-66798 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	August 28, 2026

Known Exploited Microsoft Vulnerabilities

The following Microsoft vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Microsoft SQL Server Remote Code Execution Vulnerability	Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CVE-2019-1068 Exploit Probability: 52.8%	August 26, 2026
Microsoft SharePoint Weak Authentication Vulnerability	Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-55040 Exploit Probability: 1.3%	August 18, 2026
Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability	Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. CVE-2026-33824 Exploit Probability: 55.9%	August 18, 2026
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability	Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-68820	August 11, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. CVE-2026-50522 Exploit Probability: 57.1%	July 22, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CVE-2026-58644	July 16, 2026
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerabil	Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-56155 Exploit Probability: 2.3%	July 14, 2026
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability	Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. CVE-2026-56164 Exploit Probability: 18.4%	July 14, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability	Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CVE-2026-45659 Exploit Probability: 9.1%	July 1, 2026
Microsoft Defender Link Following Vulnerability	Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-41091 Exploit Probability: 9.6%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0806 Exploit Probability: 82.2%	May 20, 2026
Microsoft DirectX NULL Byte Overwrite Vulnerability	Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. CVE-2009-1537 Exploit Probability: 51.2%	May 20, 2026
Microsoft Defender Denial of Service Vulnerability	Microsoft Defender contains an unspecified vulnerability that allows for denial of service. CVE-2026-45498 Exploit Probability: 63.1%	May 20, 2026
Microsoft Windows Buffer Overflow Vulnerability	Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. CVE-2008-4250 Exploit Probability: 98.8%	May 20, 2026
Microsoft Internet Explorer Use-After-Free Vulnerability	Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0249 Exploit Probability: 91.9%	May 20, 2026
Microsoft Exchange Server Cross-Site Scripting Vulnerability	Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. CVE-2026-42897 Exploit Probability: 5.6%	May 15, 2026
Microsoft Windows Protection Mechanism Failure Vulnerability	Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. CVE-2026-32202 Exploit Probability: 63.7%	April 28, 2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability	Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. CVE-2026-33825 Exploit Probability: 6.7%	April 22, 2026
Microsoft Office Remote Code Execution	Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object. CVE-2009-0238 Exploit Probability: 43.1%	April 14, 2026
Microsoft SharePoint Server Improper Input Validation Vulnerability	Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. CVE-2026-32201 Exploit Probability: 21.5%	April 14, 2026

Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 7 known exploited Microsoft vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

Top 10 Riskiest Microsoft Vulnerabilities

Based on the current exploit probability, these Microsoft vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.

Rank	CVE	EPSS	Vulnerability
1	CVE-2021-34473	100.0%	Microsoft Exchange Server Remote Code Execution Vulnerability
2	CVE-2019-0708	100.0%	"BlueKeep" Microsoft Windows Remote Desktop Remote Code Execution Vulnerability
3	CVE-2015-1635	100.0%	Microsoft HTTP.sys Remote Code Execution Vulnerability
4	CVE-2021-26855	100.0%	Microsoft OWA Exchange Control Panel (ECP) Exploit Chain
5	CVE-2021-34523	100.0%	Microsoft Exchange Server Privilege Escalation Vulnerability
6	CVE-2025-53770	100.0%	Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
7	CVE-2012-0158	100.0%	Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
8	CVE-2022-41082	100.0%	Microsoft Exchange Server Remote Code Execution Vulnerability
9	CVE-2020-0688	100.0%	Microsoft Exchange Server Key Validation Vulnerability
10	CVE-2022-41040	100.0%	Microsoft Exchange Server Server-Side Request Forgery Vulnerability

By the Year

In 2026 there have been 5819 vulnerabilities in Microsoft with an average score of 7.3 out of ten. Last year, in 2025 Microsoft had 2759 security vulnerabilities published. That is, 3060 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.03.

Year	Vulnerabilities	Average Score
2026	5819	7.25
2025	2759	7.23
2024	2182	7.39
2023	1695	7.21
2022	1389	7.43
2021	1153	7.44
2020	1253	7.19
2019	831	7.08
2018	661	7.03

It may take a day or so for new Microsoft vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Microsoft Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-70309	Aug 28, 2026	Aug 2026: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.	Edge Chromium
CVE-2026-72984	Aug 28, 2026	Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-66798	Aug 28, 2026	Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-66324	Aug 28, 2026	Aug 2026: Microsoft Edge (Chromium-based) Spoofing Vulnerability External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.	Edge Chromium
CVE-2026-66323	Aug 28, 2026	Aug 2026: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	Edge Chromium
CVE-2026-58616	Aug 28, 2026	Aug 2026: Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.	Edge Chromium
CVE-2026-62904	Aug 28, 2026	Aug 2026: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.	Edge Chromium
CVE-2026-70331	Aug 28, 2026	Aug 2026: Microsoft Edge for iOS Spoofing Vulnerability Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.	Edge Chromium Edge Browser
CVE-2026-25250	Aug 27, 2026	EazyFix 12.9 Bypass Sec Feature via Missing Crypt Steps Secure Boot Disable EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."
CVE-2026-79260	Aug 25, 2026	Google Chrome <152.0.7977.65 Cookie Input Validation Bypass Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78914	Aug 25, 2026	Uninitialized Skia Res Chrome <152.0.7977.65: Sandbox Read Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78964	Aug 25, 2026	Use-after-free in Chrome Sync on iOS <152.0.7977.65 Use after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79253	Aug 25, 2026	Google Chrome Network: Improper Input Validation (v <152.0.7977.65) Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79126	Aug 25, 2026	Chrome Proxy Info Leak Windows <152.0.7977.65 Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially obtain sensitive information via crafted network traffic. (Chromium security severity: Low)
CVE-2026-78915	Aug 25, 2026	Race Condition in Chrome Enterprise on Windows <152.0.7977.65 Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)
CVE-2026-79133	Aug 25, 2026	Chrome Forms IAM flaw <152.0.7977.65 sensitive data exfil via crafted page Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79021	Aug 25, 2026	Google Chrome <152 Auth Bypass in InterestGroups via Crafted PDF Missing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted PDF file. (Chromium security severity: Low)
CVE-2026-79179	Aug 25, 2026	Google Chrome <152.0.7977.65: DOM Auth Bypass leaking data Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79225	Aug 25, 2026	Browser Auth Bypass in Chrome Android 152.0.7977.65 (UI Interaction) Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via UI Interaction. (Chromium security severity: Low)
CVE-2026-79125	Aug 25, 2026	Information Leak in XR component of Google Chrome before 152.0.7977.65 Information leak in XR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79017	Aug 25, 2026	Race Condition in Chrome Extensions 152.0.7977.65 - Remote System Access Bypass Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-79148	Aug 25, 2026	Chrome DevTools OOB memory read via crafted extension (152.0.7977.65) Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially read memory inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-79197	Aug 25, 2026	Use-after-Free in V8 (Chrome <152.0.7977.65) Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79045	Aug 25, 2026	V8 Type Confusion in Google Chrome <152.0.7977.65: Remote Memory Read Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79112	Aug 25, 2026	OOB read in Skia before 152.0.7977.65 in Chrome Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79223	Aug 25, 2026	Integer overflow in Chromium: Chrome <152.0.7977.65 memory read via crafted file Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low)
CVE-2026-79246	Aug 25, 2026	Information Leak via DataTransfer pre-152.0.7977.65 in Chrome Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79244	Aug 25, 2026	Use-after-free in Chrome Animation before 152.0.7977.65 Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78947	Aug 25, 2026	Chrome <=152.0.7977.65 Extension CRX Origin Policy Bypass (CVE-2026-78947) Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-79056	Aug 25, 2026	Use-After-Free ServiceWorker Vulnerability in Chrome <152.0.7977.65 Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79108	Aug 25, 2026	Chrome UI Misrepresentation: Passkeys Web Auth (<152.0.7977.65) UI misrepresentation in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79018	Aug 25, 2026	Info Leak in FoldableAPIs in Google Chrome <152.0.7977.65 Information leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78980	Aug 25, 2026	Chrome <152.0.7977.65 ReaderMode Input Validation Flaw Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78956	Aug 25, 2026	Type confusion CVE-2026-78956 in V8 (Chrome <152.0.7977.65) - RCE Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79060	Aug 25, 2026	Chrome <152.0.7977.65 StorageAccessAPI Auth Bypass via Crafted HTML Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79239	Aug 25, 2026	Out of bounds read in Tint in Google Chrome Android <152.0.7977.65 Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79015	Aug 25, 2026	Google Chrome 152.0.7977.65: ServiceWorker Improper Input Validation Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79177	Aug 25, 2026	Google Chrome <152.0.7977.65 Media Auth Bypass Windows Incorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78896	Aug 25, 2026	Chrome StorageAccessAPI Info Leak <152.0.7977.65 Cross-Origin Data via HTML Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79009	Aug 25, 2026	Google Chrome UI Spoofing (152.0.7977.64) UI misrepresentation in UI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79058	Aug 25, 2026	Chrome <152.0.7977.65 Passwords Missing Auth Spoof UI via Renderer Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78968	Aug 25, 2026	Chrome <152 Missing Auth in Core: Spoof Address Bar via Crafted HTML Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79041	Aug 25, 2026	Google Chrome <152.0.7977.65 Mac: Missing Auth for Privileged Page Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79284	Aug 25, 2026	Chrome UI Spoofing via Renderer in Core (152.0.7977.65) UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79005	Aug 25, 2026	Chrome 152.0.7977.65 - StorageAccessAPI Authorization Bypass (CVE-2026-79005) Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79123	Aug 25, 2026	Chrome NTP Footer Improper Input Validation < 152.0.7977.65 (Windows) Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79090	Aug 25, 2026	Google Chrome <152.0.7977.65 Improper Privilege Mgmt in Actor via Crafted HTML Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79243	Aug 25, 2026	Google Chrome ReadingList Improper Input Validation <152.0.7977.65 on Windows Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78946	Aug 25, 2026	Google Chrome <152.0.7977.65: Select Auth Bypass Web Origin Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79040	Aug 25, 2026	Google Chrome Android <152.0.7977.65: Uninit GPU RCE via HTML Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)