Chromium: CVE-2025-12438 Use after free in Ozone

Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

A new exploitation technique called key reinstallation attacks used to break Wi-Fi handshakes that negotiate session keys was discovered. These attacks target the Wi-Fi/WPA2 standard. An adversary can trick a client or Access Point (AP) into reinstalling an already-in use pairwise key in 4-way handshake. While reinstalling the already in-use key, the associated packet number (sometimes also called nonce) and receive replay counter is reset. This causes nonce reuse, voiding any security the underlying encryption protocol is supposed to provide. For example, it allows decryption or injection of frames, and enables an attacker to replay frames.

Chromium: CVE-2025-10201 Inappropriate implementation in Mojo

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

Chromium: CVE-2026-17680 Heap buffer overflow in Color

Chromium: CVE-2026-7363 Use after free in Canvas

Chromium: CVE-2026-9117 Type Confusion in GFX

Chromium: CVE-2026-9122 Out of bounds read in GPU

Chromium: CVE-2026-11028 Use after free in Media

Chromium: CVE-2026-9985 Insufficient validation of untrusted input in Media

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information.

The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.

Chromium: CVE-2026-14421 Uninitialized Use in Dawn

Chromium: CVE-2026-13942 Insufficient validation of untrusted input in Video Capture

Chromium: CVE-2026-14062 Inappropriate implementation in Views

Chromium: CVE-2026-13779 Use after free in Chromoting

Chromium: CVE-2026-14103 Use after free in SSL

Chromium: CVE-2026-13986 Inappropriate implementation in Media UI

Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Chromium: CVE-2026-8576 Inappropriate implementation in CORS

Chromium: CVE-2026-8534 Integer overflow in GPU

Chromium: CVE-2026-8535 Out of bounds read in Media

Chromium: CVE-2026-8001 Use after free in Printing

Chromium: CVE-2026-7992 Insufficient validation of untrusted input in UI

Chromium: CVE-2026-7946 Insufficient policy enforcement in WebUI

Chromium: CVE-2026-12019 Out of bounds write  Codecs

Chromium: CVE-2026-11675 Insufficient validation of untrusted input in Skia

Chromium: CVE-2026-11668 Uninitialized Use in Codecs