CVE-2026-10980

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-109816.5Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised t CVE-2026-1098126.9A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-p CVE-2026-1098138.6A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthentic CVE-2026-109828.8Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c CVE-2026-1098276.3A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools CVE-2026-1098284.3A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the CVE-2026-1098299.1undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes t CVE-2026-109839.6Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform CVE-2026-1098315.1UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-se CVE-2026-1098327.5A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUT CVE-2026-1098335.9A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the intern CVE-2026-1098385.1IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.