CVE-2026-9124

MediumCVSS 5.3/10Last modified Jul 23, 2026

Description

Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-912405.9Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are a CVE-2026-912419.1Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). CVE-2026-912427.4Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins). The supported version that is affected is 11.4. Easily CVE-2026-912439.6Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported vers CVE-2026-912444.7Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Diffi CVE-2026-912456.5Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are af CVE-2026-912466.1Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are af CVE-2026-912475.9Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are af CVE-2026-912485.3Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are af CVE-2026-912493.3Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported version that is affected is 11.4. Easi CVE-2026-91256.4The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overl CVE-2026-912509.9Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 1