CVE-2026-10968

HighCVSS 7.4/10Last modified Jul 22, 2026

Description

Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1096806.5FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes wh CVE-2026-1096814.7The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can sp CVE-2026-1096824.7Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host withou CVE-2026-1096845.3Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-1096857.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free lin CVE-2026-1096869.8Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affect CVE-2026-1096877.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free lin CVE-2026-1096889.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free lin CVE-2026-1096895.3Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access C CVE-2026-109697.5Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis CVE-2026-1096916.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Ele CVE-2026-1096927.1Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Contro