Category

Browsers

10,775 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

34 results · Clear filters · Feed

Medium 5.4

CVE-2026-109721 Public exploit

Incorrect boundary conditions in the JavaScript Engine: JIT component

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Oct 13, 2026
Medium 5.4

CVE-2026-87575 Public exploit

Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social e…

Google Chrome chromium Browsers Debian

Sep 9, 2026
Medium 5.4

CVE-2026-84118 Public exploit

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 1, 2026
Medium 5.4

CVE-2026-74970 Public exploit

Site isolation issue in the Graphics component

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Aug 18, 2026
Medium 6.5

CVE-2026-74945 Public exploit

Information disclosure in the Graphics: Text component

Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Aug 18, 2026
Medium 4.3

CVE-2026-65351 Public exploit

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…

Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian

Aug 17, 2026
Medium 4.3

CVE-2026-15718 Public exploit

Invalid pointer in the JavaScript: WebAssembly component

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Jul 14, 2026
Medium 6.5

CVE-2026-43700 Public exploit

A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iO…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers

Jun 29, 2026
Medium 6.5

CVE-2026-11110 Public exploit

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data …

Google Chrome chromium webkit2gtk Browsers Debian

Jun 4, 2026
Medium 6.5

CVE-2026-11109 Public exploit

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data …

Google Chrome chromium webkit2gtk Browsers Debian

Jun 4, 2026
Medium 4.3

CVE-2026-11107 Public exploit

Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform …

Google Chrome chromium Browsers Debian

Jun 4, 2026
Medium 6.5

CVE-2026-11105 Public exploit

Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker w…

Google Chrome chromium Browsers Debian

Jun 4, 2026
Medium 6.5

CVE-2026-11104 Public exploit

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the re…

Google Chrome chromium webkit2gtk Browsers Debian

Jun 4, 2026
Medium 6.5

CVE-2026-11106 Public exploit

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-o…

Google Chrome chromium Browsers Debian

Jun 4, 2026
Medium 6.5

CVE-2026-11101 Public exploit

Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-or…

Google Chrome chromium Browsers Debian

Jun 4, 2026
Medium 6.5

CVE-2026-47644 Public exploit

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

Microsoft Copilot Chat (Microsoft Edge) Browsers

Jun 4, 2026
Medium 4.3

CVE-2026-10702 Public exploit

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu

Jun 2, 2026
Medium 6.5

CVE-2026-8388 Public exploit

Incorrect boundary conditions in the JavaScript Engine: JIT component

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

May 12, 2026
Medium 6.5

CVE-2026-6770 Public exploit

Other issue in the Storage: IndexedDB component

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Apr 21, 2026
Medium 5.3

CVE-2026-6765 Public exploit

Information disclosure in the Form Autofill component

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Apr 21, 2026
Medium 5.4

CVE-2026-20643 Public exploit

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Backgro…

Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu

Mar 17, 2026
Medium 5.5

CVE-2026-20660 Public exploit

A path handling issue was addressed with improved logic. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7…

Apple macOS iOS and iPadOS visionOS macOS iOS Browsers

Feb 11, 2026
Medium 4.3

CVE-2025-43541 Public exploit EPSS 34%

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and i…

Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu

Dec 17, 2025
Medium 4.3

CVE-2025-12433 Public exploit

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of …

Google Chrome chromium qt6-qtwebengine Browsers Debian Alpine

Nov 10, 2025
Medium 4.3

CVE-2025-4664 Public exploit

Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cr…

Google Chrome chromium qt6-qtwebengine Browsers Debian Alpine

May 14, 2025
Medium 5.6

CVE-2024-4367 Public exploit EPSS 71%

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm

May 14, 2024
Medium 6.5

CVE-2024-21388 Public exploit EPSS 36%

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 30, 2024
Medium 6.5

CVE-2024-0741 Public exploit

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jan 23, 2024
Medium 6.5

CVE-2023-33145 Public exploit

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jun 13, 2023
Medium 4.3

CVE-2022-4611 Public exploit

Click Studios Passwordstate hard-coded credentials

A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack re…

Click Studios Passwordstate Browser Extension Chrome Passwordstate Browsers

Dec 19, 2022
Medium 6.1

CVE-2022-21970 Public exploit

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Microsoft Edge (Chromium-based) Browsers

Jan 11, 2022
Medium 4.3

CVE-2021-41351 Public exploit

Microsoft Edge (Chrome based) Spoofing on IE Mode

Microsoft Edge (Chrome based) Spoofing on IE Mode

Microsoft Microsoft Edge (Chromium-based) in IE Mode Browsers

Nov 10, 2021
Medium 6.5

CVE-2019-5825 Exploited Public exploit EPSS 56%

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…

Google Chrome chromium chromium-browser Browsers Debian Ubuntu

Nov 25, 2019
KEV Jun 8, 2022
Medium 6.5

CVE-2019-5786 Exploited Public exploit EPSS 61%

Use-After-Free in puppeteer

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm

Jun 27, 2019
KEV May 23, 2022