The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
10 Nov 2026 Google Chromium Memory corruption
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 157.0.8103.50
- CISA due date
- 24 Nov 2026 (still open)
- Weakness
- CWE-416
27 Oct 2026 Google Brotli Memory corruption
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- nodejs node.js 26.12.1, nodejs node.js 24.22.1, nodejs node.js 22.23.4, microsoft .net 10.0.14, microsoft .net 9.0.22 and 7 older
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-252, CWE-787
16 Sep 2026 Google Pixel Access control flaw
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 19 Sep 2026
- Weakness
- CWE-693
9 Sep 2026 Google Chromium V8 Memory corruption
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 153.0.8010.36
- CISA due date
- 23 Sep 2026
- Weakness
- CWE-787
4 Sep 2026 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 152.0.7977.82, google v8 15.3.48
- CISA due date
- 18 Sep 2026
- Weakness
- CWE-843
9 Jun 2026 Google Chromium V8 Memory corruption
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 149.0.7827.103
- CISA due date
- 23 Jun 2026
- Weakness
- CWE-787, CWE-125
On Hacker News
High severity Chrome CVE-2026-11645 2 comments2 Jun 2026 Android Framework Memory corruption
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Jun 2026
- Weakness
- CWE-190
1 Apr 2026 Google Dawn Memory corruption
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 146.0.7680.177
- CISA due date
- 15 Apr 2026
- Weakness
- CWE-416
13 Mar 2026 Google Chromium V8 Remote code execution
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 146.0.7680.75
- CISA due date
- 27 Mar 2026
- Weakness
- CWE-119
13 Mar 2026 Google Skia Memory corruption
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 146.0.7680.80
- CISA due date
- 27 Mar 2026
- Weakness
- CWE-787
17 Feb 2026 Google Chromium Memory corruption
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 145.0.7632.76, google chrome 145.0.7632.75
- CISA due date
- 10 Mar 2026
- Weakness
- CWE-416
12 Dec 2025 Google Chromium Memory corruption
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 143.0.7499.110, google chrome 143.0.7499.109, microsoft edge chromium 143.0.3650.80, apple safari 26.2, apple ipados 26.2 and 7 older
- CISA due date
- 2 Jan 2026
- Weakness
- CWE-787, CWE-119
2 Dec 2025 Android Framework Security flaw
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Dec 2025
2 Dec 2025 Android Framework Authentication bypass
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Dec 2025
- Weakness
- CWE-306
19 Nov 2025 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 142.0.7444.175
- CISA due date
- 10 Dec 2025
- Weakness
- CWE-843
23 Sep 2025 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 140.0.7339.185
- CISA due date
- 14 Oct 2025
- Weakness
- CWE-843
4 Sep 2025 Android Runtime Memory corruption
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 25 Sep 2025
- Weakness
- CWE-416
22 Jul 2025 Google Chromium Input validation flaw
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 138.0.7204.157, apple safari 18.6, apple ipados 18.6, apple iphone os 18.6, apple macos 15.6 and 4 older
- CISA due date
- 12 Aug 2025
- Weakness
- CWE-20
2 Jul 2025 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 138.0.7204.96, google chrome 138.0.7204.92
- CISA due date
- 23 Jul 2025
- Weakness
- CWE-843
5 Jun 2025 Google Chromium V8 Memory corruption
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 137.0.7151.68, microsoft edge chromium 137.0.3296.62
- CISA due date
- 26 Jun 2025
- Weakness
- CWE-125, CWE-787
27 Mar 2025 Google Chromium Mojo Security flaw
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 134.0.6998.177
- CISA due date
- 17 Apr 2025
4 Mar 2025 Linux Kernel Security flaw
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- linux kernel 6.11.8, linux kernel 6.6.61, linux kernel 6.1.117, linux kernel 5.15.172, linux kernel 5.10.230 and 3 older
- CISA due date
- 25 Mar 2025
- Weakness
- CWE-908
7 Nov 2024 Android Framework Security flaw
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Nov 2024
- Weakness
- CWE-176
17 Sep 2024 Adobe Flash Player Memory corruption
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- google chrome 32.0.1700.107, adobe flash player 12.0.0.44, adobe flash player 11.7.700.261, adobe flash player 11.2.202.336
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-191
28 Aug 2024 Google Chromium V8 Memory corruption
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 128.0.6613.84, microsoft edge chromium 128.0.2739.42
- CISA due date
- 18 Sep 2024
- Weakness
- CWE-358
On Hacker News
Zooming in on CVE-2024–796526 Aug 2024 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 128.0.6613.84, microsoft edge 128.0.2739.42
- CISA due date
- 16 Sep 2024
- Weakness
- CWE-843
13 Jun 2024 Android Pixel Security flaw
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 4 Jul 2024
- Weakness
- CWE-783
28 May 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 125.0.6422.112
- CISA due date
- 18 Jun 2024
- Weakness
- CWE-843
20 May 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 125.0.6422.60
- CISA due date
- 10 Jun 2024
- Weakness
- CWE-843
16 May 2024 Google Chromium V8 Memory corruption
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 124.0.6367.207
- CISA due date
- 6 Jun 2024
- Weakness
- CWE-787
13 May 2024 Google Chromium Memory corruption
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 124.0.6367.201
- CISA due date
- 3 Jun 2024
- Weakness
- CWE-416
4 Apr 2024 Android Pixel Security flaw
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google android 2024-04-05
- CISA due date
- 25 Apr 2024
- Weakness
- CWE-280
4 Apr 2024 Android Pixel Security flaw
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 25 Apr 2024
- Weakness
- CWE-908
5 Mar 2024 Android Pixel Information disclosure
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 26 Mar 2024
- Weakness
- CWE-200
6 Feb 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 116.0.5845.179, microsoft edge chromium 116.0.1938.76
- CISA due date
- 27 Feb 2024
- Weakness
- CWE-843
17 Jan 2024 Google Chromium V8 Memory corruption
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 120.0.6099.224, couchbase server 7.2.5
- CISA due date
- 7 Feb 2024
- Weakness
- CWE-787
2 Jan 2024 Google Chromium WebRTC Memory corruption
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 120.0.6099.129
- CISA due date
- 23 Jan 2024
- Weakness
- CWE-787
30 Nov 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 119.0.6045.199, microsoft edge chromium 119.0.2151.97
- CISA due date
- 21 Dec 2023
- Weakness
- CWE-190
2 Oct 2023 Google Chromium libvpx Memory corruption
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- mozilla firefox 118.1, mozilla firefox 118.0.1, google chrome 117.0.5938.132, mozilla firefox 115.3.1, mozilla thunderbird 115.3.1 and 3 older
- CISA due date
- 23 Oct 2023
- Weakness
- CWE-787
18 Sep 2023 Samsung Mobile Devices Security flaw
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2023
- Weakness
- CWE-703
13 Sep 2023 Google Chromium WebP Memory corruption
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- bentley seequent leapfrog 2023.2, mozilla firefox 117.0.1, google chrome 116.0.5845.187, microsoft edge chromium 116.0.1938.81, mozilla thunderbird 115.2.2 and 7 older
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-787
13 Sep 2023 Android Framework Privilege escalation
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-269
7 Jun 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 114.0.5735.110, couchbase server 7.1.5
- CISA due date
- 28 Jun 2023
- Weakness
- CWE-843
21 Apr 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.137
- CISA due date
- 12 May 2023
- Weakness
- CWE-190
On Hacker News
Google Chrome Zero-Day 1 comment17 Apr 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.121, couchbase server 7.1.5
- CISA due date
- 8 May 2023
- Weakness
- CWE-843
13 Apr 2023 Android Framework Weak cryptography
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 4 May 2023
- Weakness
- CWE-295
30 Mar 2023 Google Chromium Network Service Memory corruption
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 105.0.5195.52
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-416
5 Dec 2022 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 108.0.5359.94
- CISA due date
- 26 Dec 2022
- Weakness
- CWE-122, CWE-843
28 Nov 2022 Google Chromium GPU Memory corruption
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft edge chromium 107.0.5304.150, google chrome 107.0.5304.121, microsoft edge 107.0.1418.62
- CISA due date
- 19 Dec 2022
- Weakness
- CWE-787
28 Oct 2022 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 107.0.5304.87
- CISA due date
- 18 Nov 2022
- Weakness
- CWE-122, CWE-843
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.