CVE-2026-7984

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use after free in ReadingMode in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-798407.3A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.CVE-2026-798415.8A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption CVE-2026-798429.1An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 CVE-2026-798436.5A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclos CVE-2026-7984410.0Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary co CVE-2026-798457.3A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryM CVE-2026-7984610.0Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitr CVE-2026-7984710.0Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially CVE-2026-7984810.0Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against a CVE-2026-7984910.0Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against a CVE-2026-79858.3Use after free in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentia CVE-2026-7985010.0Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls