CVE-20XX-?
agent?

Browser & mail CVEs.

Published CVEs that affect browser & mail software, ranked by exploit odds.

55 CVEs · updated 2026-11-09 17:06 UTC

Reset all
  1. CVE-2026-85898

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

    Code execution Browser & mail Microsoft Edge Chromium

    8.8 HIGH 0.8% exploit odds Fix listed
  2. CVE-2026-113027

    Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  3. CVE-2026-112659

    A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.

    Code execution Browser & mail Apple Safari

    8.8 HIGH 0.6% exploit odds Fix listed
  4. CVE-2026-113192

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  5. CVE-2026-113030

    Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  6. CVE-2026-113012

    Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  7. CVE-2026-113193

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    6.5 MEDIUM 0.5% exploit odds Fix listed
  8. CVE-2026-113034

    Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  9. CVE-2026-113044

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  10. CVE-2026-113165

    Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  11. CVE-2026-121057

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  12. CVE-2026-113098

    Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    6.5 MEDIUM 0.4% exploit odds Fix listed
  13. CVE-2026-62765

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

    Code execution Browser & mail Microsoft Edge Chromium

    7.5 HIGH 0.4% exploit odds Fix listed
  14. CVE-2026-113175

    Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  15. CVE-2026-121233

    Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  16. CVE-2026-121226

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  17. CVE-2026-121228

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  18. CVE-2026-121218

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  19. CVE-2026-121221

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  20. CVE-2026-121210

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  21. CVE-2026-121137

    Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  22. CVE-2026-121094

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  23. CVE-2026-121078

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  24. CVE-2026-121082

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  25. CVE-2026-121068

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  26. CVE-2026-118305

    Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  27. CVE-2026-121098

    Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.4% exploit odds Fix listed
  28. CVE-2026-113065

    Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted media file. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  29. CVE-2026-121224

    Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.1 HIGH 0.3% exploit odds Fix listed
  30. CVE-2026-113078

    Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  31. CVE-2026-86922

    A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

    Code execution Browser & mail Apple Safari

    8.8 HIGH 0.3% exploit odds Fix listed
  32. CVE-2026-113233

    Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  33. CVE-2026-113052

    Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  34. CVE-2026-121234

    Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  35. CVE-2026-121166

    Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  36. CVE-2026-110140

    Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  37. CVE-2026-121133

    Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.1 HIGH 0.3% exploit odds Fix listed
  38. CVE-2026-121256

    Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  39. CVE-2026-113059

    Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  40. CVE-2026-121079

    Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  41. CVE-2026-121048

    Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  42. CVE-2026-121163

    Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  43. CVE-2026-118350

    Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  44. CVE-2026-118315

    Type confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  45. CVE-2026-110156

    Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  46. CVE-2026-119266

    Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  47. CVE-2026-118336

    Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  48. CVE-2026-118320

    Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  49. CVE-2026-113329

    Race condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    6.5 MEDIUM 0.2% exploit odds Fix listed
  50. CVE-2026-76029

    Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.2% exploit odds Fix listed

CVEs that affect browser & mail, sorted by how likely they are to be exploited (EPSS).