CVE-2026-10019

HighCVSS 8.8/10Last modified Jul 21, 2026

Description

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-472

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2026
Last modified: Jul 21, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1001906.3The AIL Framework crawler splash domain page (showDomain.html) is vulnerable to stored cross-site script injection (XSS). User-supplied data CVE-2026-1001926.5X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or CVE-2026-1001934.7The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' para CVE-2026-1001967.2The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comme CVE-2026-10025.3The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically CVE-2026-100208.3Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had com CVE-2026-1002007.0Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1002017.0Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.CVE-2026-1002029.8Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.CVE-2026-1002037.0Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1002057.1Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.CVE-2026-1002077.3Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker