CVE-2026-8539

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-853907.1Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing CVE-2026-853919.8Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge sessio CVE-2026-853924.3Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authent CVE-2026-853937.5node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. CVE-2026-853949.1python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM CVE-2026-853957.1UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass CVE-2026-853967.5rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths CVE-2026-853977.3A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.p CVE-2026-853987.3A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. S CVE-2026-853997.3A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSing CVE-2026-85408.8Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra CVE-2026-854007.5Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and conf