CVE-2026-10015

HighCVSS 8.8/10Last modified Jul 21, 2026

Description

Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-472

Affected software

VendorProductVersions
GoogleChrome>= 148.0.7778.216, < 148.0.7778.216

References

Timeline

Published
May 28, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1001516.1The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to ReflectCVE-2026-1001526.5The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vCVE-2026-1001537.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all verCVE-2026-1001556.5The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbCVE-2026-1001576.5The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. CVE-2026-1001586.4The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $CVE-2026-1001594.8The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_gCVE-2026-100168.8Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crCVE-2026-1001617.2The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id'CVE-2026-1001637.4The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication BypassCVE-2026-1001647.5Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows AccounCVE-2026-1001686.5Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user h
CVE-2026-10015: High severity, CVSS 8.8 | Vulnix