Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Chromium CVE-2026-113252: Improper input validation
Chromium CVE-2026-113242: Memory corruption
Chromium CVE-2026-113157: Information leak
Chromium CVE-2026-113119: Use after free
Chromium CVE-2026-113340: Memory corruption
.NET Framework Denial of Service Vulnerability
.NET Framework Elevation of Privilege Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.
Chromium: CVE-2026-7363 Use after free in Canvas
Chromium CVE-2026-113326: Memory corruption
Chromium CVE-2026-113295: Out of bounds read
Chromium CVE-2026-113210: Use after free
Chromium CVE-2026-113082: Memory corruption
Chromium CVE-2026-113074: Use after free
Chromium CVE-2026-113011: Use after free
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Chromium: CVE-2026-78892 Incorrect authorization in Chromoting
.NET and Visual Studio Remote Code Execution Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including ToString() results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer's machine when the developer evaluates an expression during debugging.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/445
CVSS Details
- Version: 3.1 - Severity: High - Score: 8.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
Affected Platforms
- Platforms: Windows, Linux, macOS - Architectures: All
<a name="affected-packages"></a>Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
Package name | Affected version | Patched version ------------ | ---------------- | --------------- Microsoft.AspNetCore.Components.WebAssembly.Server | >= 10.0.0, <= 10.0.12 | 10.0.13 Microsoft.AspNetCore.Components.WebAssembly.Server | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2.26478.115
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
You are affected if you use a vulnerable version of Microsoft.AspNetCore.Components.WebAssembly.Server to debug a Blazor WebAssembly application and evaluate an expression involving attacker-controlled application data.
<a name="how-fix"></a>How do I fix the issue?
1. Install the latest supported version of .NET. 2. Update Microsoft.AspNetCore.Components.WebAssembly.Server to the patched version for the .NET release used by the application.
Once the updated package or runtime is installed, restart the debugger and development environment.
Other Information
Reporting Security Issues
If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repositories are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnetcore. The Announcements repository (https://github.com/dotnet/announcements) will contain this bulletin as an issue and will include a link to a discussion issue.
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
External Links
CVE-2026-102870
Acknowledgements
alittleston3
Revisions
V1.0 (10/13/2026): Advisory published.
AMD. A buffer overflow issue was addressed with improved memory handling.
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)
Golang Go could allow a remote attacker to obtain sensitive information, caused byimproper access control by the os.DirFS function and http.Dir type. By sending a specially-crafted request, an attacker could exploit this vulnerability to access any path on the system, and use this information to launch further attacks against the affected system.
A flaw was found in Go, where it could allow a remote attacker to traverse directories on the system, caused by improper validation of user requests by the filepath.Clean on Windows package. This flaw allows an attacker to send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.
Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering.
A vulnerability was fixed in DPDK. When having a failure with the mlx5 driver, the error recovery was not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.
Commits per branch: main - https://git.dpdk.org/dpdk/commit/?id=60b254e392 21.11 - https://git.dpdk.org/dpdk-stable/commit/?id=25c01bd323 20.11 - https://git.dpdk.org/dpdk-stable/commit/?id=ef311075d2 19.11 - https://git.dpdk.org/dpdk-stable/commit/?id=8b090f2664
LTS Releases: 21.11 - http://fast.dpdk.org/rel/dpdk-21.11.2.tar.xz 20.11 - http://fast.dpdk.org/rel/dpdk-20.11.6.tar.xz 19.11 - http://fast.dpdk.org/rel/dpdk-19.11.13.tar.xz