CVE-2026-7931

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-793108.5webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-control CVE-2026-793116.1webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().CVE-2026-793126.8webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loa CVE-2026-793139.8webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expir CVE-2026-793148.8A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of o CVE-2026-793154.7A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-sid CVE-2026-793167.6An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template throu CVE-2026-793174.8A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only che CVE-2026-793186.5web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (appl CVE-2026-793195.3Stencil core 4.43.5 is vulnerable to Incorrect Access Control.CVE-2026-79324.4Insufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restricti CVE-2026-793206.1Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application en