{
  "schema_version": 1,
  "version": "2026-10-15",
  "_note": "Auto-regenerated. Browser CVEs from NVD; extension CVEs from update-extension-cves.js.",
  "browsers": [
    {
      "id": "chrome",
      "label": "Chrome",
      "cves": [
        {
          "cve": "CVE-2026-110136",
          "summary": "Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110136"
        },
        {
          "cve": "CVE-2026-110142",
          "summary": "Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110142"
        },
        {
          "cve": "CVE-2026-110149",
          "summary": "Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110149"
        },
        {
          "cve": "CVE-2026-110152",
          "summary": "Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110152"
        },
        {
          "cve": "CVE-2026-110159",
          "summary": "Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110159"
        },
        {
          "cve": "CVE-2026-110161",
          "summary": "Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110161"
        },
        {
          "cve": "CVE-2026-110165",
          "summary": "Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110165"
        },
        {
          "cve": "CVE-2026-110137",
          "summary": "Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110137"
        },
        {
          "cve": "CVE-2026-110139",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110139"
        },
        {
          "cve": "CVE-2026-110140",
          "summary": "Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110140"
        },
        {
          "cve": "CVE-2026-110147",
          "summary": "Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110147"
        },
        {
          "cve": "CVE-2026-110148",
          "summary": "Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110148"
        },
        {
          "cve": "CVE-2026-110151",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110151"
        },
        {
          "cve": "CVE-2026-110153",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110153"
        },
        {
          "cve": "CVE-2026-110154",
          "summary": "Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110154"
        },
        {
          "cve": "CVE-2026-110155",
          "summary": "Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110155"
        },
        {
          "cve": "CVE-2026-110157",
          "summary": "Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110157"
        },
        {
          "cve": "CVE-2026-110162",
          "summary": "Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110162"
        },
        {
          "cve": "CVE-2026-110163",
          "summary": "Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110163"
        },
        {
          "cve": "CVE-2026-110164",
          "summary": "Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110164"
        },
        {
          "cve": "CVE-2026-110166",
          "summary": "Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110166"
        },
        {
          "cve": "CVE-2026-110167",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110167"
        },
        {
          "cve": "CVE-2026-110168",
          "summary": "Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110168"
        },
        {
          "cve": "CVE-2026-110169",
          "summary": "Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110169"
        },
        {
          "cve": "CVE-2026-110171",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110171"
        },
        {
          "cve": "CVE-2026-110172",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110172"
        },
        {
          "cve": "CVE-2026-110144",
          "summary": "Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)",
          "cvss": 8.6,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110144"
        },
        {
          "cve": "CVE-2026-110138",
          "summary": "Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: ",
          "cvss": 8.3,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110138"
        },
        {
          "cve": "CVE-2026-110145",
          "summary": "Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.3,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110145"
        },
        {
          "cve": "CVE-2026-110156",
          "summary": "Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. ",
          "cvss": 8.3,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110156"
        },
        {
          "cve": "CVE-2026-110158",
          "summary": "Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.3,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110158"
        },
        {
          "cve": "CVE-2026-110146",
          "summary": "Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110146"
        },
        {
          "cve": "CVE-2026-110150",
          "summary": "Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High)",
          "cvss": 5.5,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110150"
        },
        {
          "cve": "CVE-2026-110143",
          "summary": "Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110143"
        },
        {
          "cve": "CVE-2026-110170",
          "summary": "Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110170"
        },
        {
          "cve": "CVE-2026-110160",
          "summary": "Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (",
          "cvss": 4.2,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110160"
        },
        {
          "cve": "CVE-2026-110141",
          "summary": "Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 3.1,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-110141"
        },
        {
          "cve": "CVE-2026-106281",
          "summary": "Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106281"
        },
        {
          "cve": "CVE-2026-106298",
          "summary": "Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106298"
        },
        {
          "cve": "CVE-2026-106323",
          "summary": "Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium s",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106323"
        },
        {
          "cve": "CVE-2026-106329",
          "summary": "Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security seve",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106329"
        },
        {
          "cve": "CVE-2026-106358",
          "summary": "Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106358"
        },
        {
          "cve": "CVE-2026-106372",
          "summary": "Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106372"
        },
        {
          "cve": "CVE-2026-106375",
          "summary": "Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106375"
        },
        {
          "cve": "CVE-2026-106382",
          "summary": "Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106382"
        },
        {
          "cve": "CVE-2026-106401",
          "summary": "Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106401"
        },
        {
          "cve": "CVE-2026-106414",
          "summary": "Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secur",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106414"
        },
        {
          "cve": "CVE-2026-106417",
          "summary": "Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106417"
        },
        {
          "cve": "CVE-2026-106419",
          "summary": "Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 9.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106419"
        },
        {
          "cve": "CVE-2026-106294",
          "summary": "Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)",
          "cvss": 9.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106294"
        },
        {
          "cve": "CVE-2026-106268",
          "summary": "Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106268"
        },
        {
          "cve": "CVE-2026-106269",
          "summary": "Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106269"
        },
        {
          "cve": "CVE-2026-106274",
          "summary": "Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106274"
        },
        {
          "cve": "CVE-2026-106278",
          "summary": "Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106278"
        },
        {
          "cve": "CVE-2026-106283",
          "summary": "Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Mediu",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106283"
        },
        {
          "cve": "CVE-2026-106291",
          "summary": "Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106291"
        },
        {
          "cve": "CVE-2026-106308",
          "summary": "Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: H",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106308"
        },
        {
          "cve": "CVE-2026-106309",
          "summary": "Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106309"
        },
        {
          "cve": "CVE-2026-106314",
          "summary": "Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106314"
        },
        {
          "cve": "CVE-2026-106315",
          "summary": "Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106315"
        },
        {
          "cve": "CVE-2026-106318",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106318"
        },
        {
          "cve": "CVE-2026-106334",
          "summary": "Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106334"
        },
        {
          "cve": "CVE-2026-106335",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106335"
        },
        {
          "cve": "CVE-2026-106341",
          "summary": "Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106341"
        },
        {
          "cve": "CVE-2026-106342",
          "summary": "Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106342"
        },
        {
          "cve": "CVE-2026-106346",
          "summary": "Improper state validation in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106346"
        },
        {
          "cve": "CVE-2026-106347",
          "summary": "Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106347"
        },
        {
          "cve": "CVE-2026-106349",
          "summary": "Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106349"
        },
        {
          "cve": "CVE-2026-106350",
          "summary": "Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106350"
        },
        {
          "cve": "CVE-2026-106352",
          "summary": "Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106352"
        },
        {
          "cve": "CVE-2026-106357",
          "summary": "Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106357"
        },
        {
          "cve": "CVE-2026-106371",
          "summary": "Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106371"
        },
        {
          "cve": "CVE-2026-106373",
          "summary": "Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106373"
        },
        {
          "cve": "CVE-2026-106374",
          "summary": "Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106374"
        },
        {
          "cve": "CVE-2026-106383",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106383"
        },
        {
          "cve": "CVE-2026-106387",
          "summary": "Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106387"
        },
        {
          "cve": "CVE-2026-106411",
          "summary": "Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106411"
        },
        {
          "cve": "CVE-2026-106421",
          "summary": "Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106421"
        },
        {
          "cve": "CVE-2026-106423",
          "summary": "Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106423"
        },
        {
          "cve": "CVE-2026-106367",
          "summary": "Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium securit",
          "cvss": 8.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106367"
        },
        {
          "cve": "CVE-2026-106292",
          "summary": "Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severi",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106292"
        },
        {
          "cve": "CVE-2026-106293",
          "summary": "Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severit",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106293"
        },
        {
          "cve": "CVE-2026-106363",
          "summary": "Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (C",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106363"
        },
        {
          "cve": "CVE-2026-106377",
          "summary": "Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106377"
        },
        {
          "cve": "CVE-2026-106378",
          "summary": "Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security se",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106378"
        },
        {
          "cve": "CVE-2026-106393",
          "summary": "Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106393"
        },
        {
          "cve": "CVE-2026-106409",
          "summary": "Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic.",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106409"
        },
        {
          "cve": "CVE-2026-106412",
          "summary": "Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a cra",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106412"
        },
        {
          "cve": "CVE-2026-106426",
          "summary": "Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106426"
        },
        {
          "cve": "CVE-2026-106271",
          "summary": "Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)",
          "cvss": 8.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106271"
        },
        {
          "cve": "CVE-2026-106301",
          "summary": "Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium se",
          "cvss": 8.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106301"
        },
        {
          "cve": "CVE-2026-106403",
          "summary": "Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 8.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106403"
        },
        {
          "cve": "CVE-2026-106279",
          "summary": "Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. (",
          "cvss": 7.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106279"
        },
        {
          "cve": "CVE-2026-106266",
          "summary": "Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security se",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106266"
        },
        {
          "cve": "CVE-2026-106267",
          "summary": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106267"
        },
        {
          "cve": "CVE-2026-106280",
          "summary": "Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106280"
        },
        {
          "cve": "CVE-2026-106286",
          "summary": "Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106286"
        },
        {
          "cve": "CVE-2026-106289",
          "summary": "Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106289"
        },
        {
          "cve": "CVE-2026-106307",
          "summary": "Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106307"
        },
        {
          "cve": "CVE-2026-106310",
          "summary": "Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106310"
        },
        {
          "cve": "CVE-2026-106312",
          "summary": "Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106312"
        },
        {
          "cve": "CVE-2026-106331",
          "summary": "Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security se",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106331"
        },
        {
          "cve": "CVE-2026-106348",
          "summary": "Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106348"
        },
        {
          "cve": "CVE-2026-106353",
          "summary": "Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Low)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106353"
        },
        {
          "cve": "CVE-2026-106361",
          "summary": "Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security s",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106361"
        },
        {
          "cve": "CVE-2026-106362",
          "summary": "Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106362"
        },
        {
          "cve": "CVE-2026-106365",
          "summary": "Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106365"
        },
        {
          "cve": "CVE-2026-106381",
          "summary": "Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106381"
        },
        {
          "cve": "CVE-2026-106384",
          "summary": "Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106384"
        },
        {
          "cve": "CVE-2026-106386",
          "summary": "Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106386"
        },
        {
          "cve": "CVE-2026-106389",
          "summary": "Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106389"
        },
        {
          "cve": "CVE-2026-106404",
          "summary": "Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medi",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106404"
        },
        {
          "cve": "CVE-2026-106407",
          "summary": "Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Me",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106407"
        },
        {
          "cve": "CVE-2026-106408",
          "summary": "Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106408"
        },
        {
          "cve": "CVE-2026-106418",
          "summary": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)",
          "cvss": 6.5,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106418"
        },
        {
          "cve": "CVE-2026-106322",
          "summary": "Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106322"
        },
        {
          "cve": "CVE-2026-106324",
          "summary": "Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106324"
        },
        {
          "cve": "CVE-2026-106327",
          "summary": "Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 6.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106327"
        },
        {
          "cve": "CVE-2026-106397",
          "summary": "Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 6.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106397"
        },
        {
          "cve": "CVE-2026-106405",
          "summary": "Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)",
          "cvss": 6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106405"
        },
        {
          "cve": "CVE-2026-106328",
          "summary": "Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)",
          "cvss": 5.9,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106328"
        },
        {
          "cve": "CVE-2026-106264",
          "summary": "Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106264"
        },
        {
          "cve": "CVE-2026-106265",
          "summary": "UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106265"
        },
        {
          "cve": "CVE-2026-106270",
          "summary": "Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106270"
        },
        {
          "cve": "CVE-2026-106272",
          "summary": "UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network traffic. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106272"
        },
        {
          "cve": "CVE-2026-106276",
          "summary": "UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106276"
        },
        {
          "cve": "CVE-2026-106282",
          "summary": "UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106282"
        },
        {
          "cve": "CVE-2026-106285",
          "summary": "UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106285"
        },
        {
          "cve": "CVE-2026-106288",
          "summary": "Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106288"
        },
        {
          "cve": "CVE-2026-106296",
          "summary": "Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106296"
        },
        {
          "cve": "CVE-2026-106299",
          "summary": "Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106299"
        },
        {
          "cve": "CVE-2026-106302",
          "summary": "UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106302"
        },
        {
          "cve": "CVE-2026-106305",
          "summary": "UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106305"
        },
        {
          "cve": "CVE-2026-106306",
          "summary": "Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106306"
        },
        {
          "cve": "CVE-2026-106311",
          "summary": "Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106311"
        },
        {
          "cve": "CVE-2026-106316",
          "summary": "UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106316"
        },
        {
          "cve": "CVE-2026-106317",
          "summary": "UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106317"
        },
        {
          "cve": "CVE-2026-106333",
          "summary": "Incorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106333"
        },
        {
          "cve": "CVE-2026-106337",
          "summary": "UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106337"
        },
        {
          "cve": "CVE-2026-106338",
          "summary": "UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106338"
        },
        {
          "cve": "CVE-2026-106343",
          "summary": "Improper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106343"
        },
        {
          "cve": "CVE-2026-106344",
          "summary": "Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106344"
        },
        {
          "cve": "CVE-2026-106356",
          "summary": "Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106356"
        },
        {
          "cve": "CVE-2026-106366",
          "summary": "Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106366"
        },
        {
          "cve": "CVE-2026-106368",
          "summary": "UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106368"
        },
        {
          "cve": "CVE-2026-106380",
          "summary": "UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106380"
        },
        {
          "cve": "CVE-2026-106396",
          "summary": "Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.79",
          "fixed_in": "155.0.8059.79",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106396"
        },
        {
          "cve": "CVE-2026-106400",
          "summary": "Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106400"
        },
        {
          "cve": "CVE-2026-106406",
          "summary": "Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106406"
        },
        {
          "cve": "CVE-2026-106416",
          "summary": "Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106416"
        },
        {
          "cve": "CVE-2026-106420",
          "summary": "Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106420"
        },
        {
          "cve": "CVE-2026-106427",
          "summary": "Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 5.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106427"
        },
        {
          "cve": "CVE-2026-106303",
          "summary": "Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chro",
          "cvss": 5.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106303"
        },
        {
          "cve": "CVE-2026-106351",
          "summary": "Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity",
          "cvss": 5.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106351"
        },
        {
          "cve": "CVE-2026-106355",
          "summary": "Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Lo",
          "cvss": 5.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106355"
        },
        {
          "cve": "CVE-2026-106364",
          "summary": "Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 5.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106364"
        },
        {
          "cve": "CVE-2026-106385",
          "summary": "Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)",
          "cvss": 5.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106385"
        },
        {
          "cve": "CVE-2026-106388",
          "summary": "Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 5.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106388"
        },
        {
          "cve": "CVE-2026-106313",
          "summary": "Incorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)",
          "cvss": 5.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106313"
        },
        {
          "cve": "CVE-2026-106402",
          "summary": "Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)",
          "cvss": 4.8,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106402"
        },
        {
          "cve": "CVE-2026-106273",
          "summary": "Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106273"
        },
        {
          "cve": "CVE-2026-106275",
          "summary": "Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106275"
        },
        {
          "cve": "CVE-2026-106284",
          "summary": "Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML p",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106284"
        },
        {
          "cve": "CVE-2026-106290",
          "summary": "Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: ",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106290"
        },
        {
          "cve": "CVE-2026-106300",
          "summary": "Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106300"
        },
        {
          "cve": "CVE-2026-106304",
          "summary": "Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106304"
        },
        {
          "cve": "CVE-2026-106370",
          "summary": "Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: ",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106370"
        },
        {
          "cve": "CVE-2026-106376",
          "summary": "Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106376"
        },
        {
          "cve": "CVE-2026-106395",
          "summary": "Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.7,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106395"
        },
        {
          "cve": "CVE-2026-106340",
          "summary": "Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)",
          "cvss": 4.6,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106340"
        },
        {
          "cve": "CVE-2026-106326",
          "summary": "Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)",
          "cvss": 4.4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106326"
        },
        {
          "cve": "CVE-2026-106277",
          "summary": "Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106277"
        },
        {
          "cve": "CVE-2026-106287",
          "summary": "Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106287"
        },
        {
          "cve": "CVE-2026-106297",
          "summary": "Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106297"
        },
        {
          "cve": "CVE-2026-106321",
          "summary": "Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106321"
        },
        {
          "cve": "CVE-2026-106325",
          "summary": "Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106325"
        },
        {
          "cve": "CVE-2026-106330",
          "summary": "Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106330"
        },
        {
          "cve": "CVE-2026-106332",
          "summary": "Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106332"
        },
        {
          "cve": "CVE-2026-106336",
          "summary": "Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106336"
        },
        {
          "cve": "CVE-2026-106354",
          "summary": "Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106354"
        },
        {
          "cve": "CVE-2026-106359",
          "summary": "Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106359"
        },
        {
          "cve": "CVE-2026-106360",
          "summary": "Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106360"
        },
        {
          "cve": "CVE-2026-106379",
          "summary": "Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106379"
        },
        {
          "cve": "CVE-2026-106390",
          "summary": "Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106390"
        },
        {
          "cve": "CVE-2026-106392",
          "summary": "Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106392"
        },
        {
          "cve": "CVE-2026-106394",
          "summary": "Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106394"
        },
        {
          "cve": "CVE-2026-106398",
          "summary": "Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106398"
        },
        {
          "cve": "CVE-2026-106415",
          "summary": "Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106415"
        },
        {
          "cve": "CVE-2026-106422",
          "summary": "Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106422"
        },
        {
          "cve": "CVE-2026-106295",
          "summary": "Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106295"
        },
        {
          "cve": "CVE-2026-106320",
          "summary": "Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106320"
        },
        {
          "cve": "CVE-2026-106345",
          "summary": "Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106345"
        },
        {
          "cve": "CVE-2026-106369",
          "summary": "Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106369"
        },
        {
          "cve": "CVE-2026-106391",
          "summary": "Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106391"
        },
        {
          "cve": "CVE-2026-106410",
          "summary": "Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106410"
        },
        {
          "cve": "CVE-2026-106413",
          "summary": "Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106413"
        },
        {
          "cve": "CVE-2026-106425",
          "summary": "Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium secu",
          "cvss": 4.2,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106425"
        },
        {
          "cve": "CVE-2026-106424",
          "summary": "Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)",
          "cvss": 4,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106424"
        },
        {
          "cve": "CVE-2026-106399",
          "summary": "Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)",
          "cvss": 3.3,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106399"
        },
        {
          "cve": "CVE-2026-106339",
          "summary": "Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)",
          "cvss": 3.1,
          "affected_max": "155.0.8059.39",
          "fixed_in": "155.0.8059.39",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106339"
        }
      ]
    },
    {
      "id": "firefox",
      "label": "Firefox",
      "cves": [
        {
          "cve": "CVE-2026-106016",
          "summary": "Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.",
          "cvss": 9.8,
          "affected_max": "157.0.1",
          "fixed_in": "157.0.1",
          "published": "2026-10-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-106016"
        },
        {
          "cve": "CVE-2026-100810",
          "summary": "Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 9.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100810"
        },
        {
          "cve": "CVE-2026-100758",
          "summary": "Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100758"
        },
        {
          "cve": "CVE-2026-100760",
          "summary": "Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 9.6,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100760"
        },
        {
          "cve": "CVE-2026-100762",
          "summary": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100762"
        },
        {
          "cve": "CVE-2026-100770",
          "summary": "Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100770"
        },
        {
          "cve": "CVE-2026-100775",
          "summary": "Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100775"
        },
        {
          "cve": "CVE-2026-100778",
          "summary": "Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100778"
        },
        {
          "cve": "CVE-2026-100781",
          "summary": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefo",
          "cvss": 9.6,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100781"
        },
        {
          "cve": "CVE-2026-100786",
          "summary": "Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100786"
        },
        {
          "cve": "CVE-2026-100787",
          "summary": "Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 9.6,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100787"
        },
        {
          "cve": "CVE-2026-100811",
          "summary": "Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100811"
        },
        {
          "cve": "CVE-2026-100818",
          "summary": "Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100818"
        },
        {
          "cve": "CVE-2026-100819",
          "summary": "Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100819"
        },
        {
          "cve": "CVE-2026-100828",
          "summary": "Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 9.6,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100828"
        },
        {
          "cve": "CVE-2026-100829",
          "summary": "Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 9.6,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100829"
        },
        {
          "cve": "CVE-2026-100763",
          "summary": "Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 9.1,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100763"
        },
        {
          "cve": "CVE-2026-100757",
          "summary": "Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100757"
        },
        {
          "cve": "CVE-2026-100761",
          "summary": "Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100761"
        },
        {
          "cve": "CVE-2026-100764",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100764"
        },
        {
          "cve": "CVE-2026-100765",
          "summary": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100765"
        },
        {
          "cve": "CVE-2026-100767",
          "summary": "Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100767"
        },
        {
          "cve": "CVE-2026-100768",
          "summary": "Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100768"
        },
        {
          "cve": "CVE-2026-100769",
          "summary": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100769"
        },
        {
          "cve": "CVE-2026-100772",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100772"
        },
        {
          "cve": "CVE-2026-100773",
          "summary": "Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100773"
        },
        {
          "cve": "CVE-2026-100774",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100774"
        },
        {
          "cve": "CVE-2026-100776",
          "summary": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100776"
        },
        {
          "cve": "CVE-2026-100777",
          "summary": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100777"
        },
        {
          "cve": "CVE-2026-100779",
          "summary": "Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100779"
        },
        {
          "cve": "CVE-2026-100780",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100780"
        },
        {
          "cve": "CVE-2026-100782",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100782"
        },
        {
          "cve": "CVE-2026-100784",
          "summary": "Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100784"
        },
        {
          "cve": "CVE-2026-100785",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100785"
        },
        {
          "cve": "CVE-2026-100808",
          "summary": "Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100808"
        },
        {
          "cve": "CVE-2026-100813",
          "summary": "Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100813"
        },
        {
          "cve": "CVE-2026-100814",
          "summary": "Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100814"
        },
        {
          "cve": "CVE-2026-100815",
          "summary": "Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100815"
        },
        {
          "cve": "CVE-2026-100820",
          "summary": "Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100820"
        },
        {
          "cve": "CVE-2026-100824",
          "summary": "Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100824"
        },
        {
          "cve": "CVE-2026-100825",
          "summary": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100825"
        },
        {
          "cve": "CVE-2026-100831",
          "summary": "Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.8,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100831"
        },
        {
          "cve": "CVE-2026-100832",
          "summary": "Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.8,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100832"
        },
        {
          "cve": "CVE-2026-100756",
          "summary": "Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.1,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100756"
        },
        {
          "cve": "CVE-2026-100759",
          "summary": "Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.1,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100759"
        },
        {
          "cve": "CVE-2026-100771",
          "summary": "Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 8.1,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100771"
        },
        {
          "cve": "CVE-2026-100809",
          "summary": "Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.1,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100809"
        },
        {
          "cve": "CVE-2026-100816",
          "summary": "Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.1,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100816"
        },
        {
          "cve": "CVE-2026-100830",
          "summary": "Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 8.1,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100830"
        },
        {
          "cve": "CVE-2026-100812",
          "summary": "Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 6.5,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100812"
        },
        {
          "cve": "CVE-2026-100826",
          "summary": "Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 6.5,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100826"
        },
        {
          "cve": "CVE-2026-100817",
          "summary": "Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.",
          "cvss": 5.4,
          "affected_max": "157.0.0",
          "fixed_in": "157.0.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100817"
        },
        {
          "cve": "CVE-2026-100822",
          "summary": "Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.",
          "cvss": 5.4,
          "affected_max": "153.4.0",
          "fixed_in": "153.4.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100822"
        },
        {
          "cve": "CVE-2026-100821",
          "summary": "Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 4.7,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100821"
        },
        {
          "cve": "CVE-2026-100766",
          "summary": "Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 4.3,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100766"
        },
        {
          "cve": "CVE-2026-100783",
          "summary": "Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.",
          "cvss": 4.3,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-100783"
        },
        {
          "cve": "CVE-2026-96869",
          "summary": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.",
          "cvss": 4.3,
          "affected_max": "140.17.0",
          "fixed_in": "140.17.0",
          "published": "2026-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-96869"
        },
        {
          "cve": "CVE-2026-92036",
          "summary": "Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.8,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92036"
        },
        {
          "cve": "CVE-2026-92037",
          "summary": "Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.8,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92037"
        },
        {
          "cve": "CVE-2026-92061",
          "summary": "Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.8,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92061"
        },
        {
          "cve": "CVE-2026-92066",
          "summary": "Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.8,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92066"
        },
        {
          "cve": "CVE-2026-92018",
          "summary": "Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 9.6,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92018"
        },
        {
          "cve": "CVE-2026-92032",
          "summary": "Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 9.6,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92032"
        },
        {
          "cve": "CVE-2026-92035",
          "summary": "Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.1",
          "cvss": 9.6,
          "affected_max": "115.42.0",
          "fixed_in": "115.42.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92035"
        },
        {
          "cve": "CVE-2026-92045",
          "summary": "Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.6,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92045"
        },
        {
          "cve": "CVE-2026-92071",
          "summary": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.6,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92071"
        },
        {
          "cve": "CVE-2026-92059",
          "summary": "Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.3,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92059"
        },
        {
          "cve": "CVE-2026-92034",
          "summary": "Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.1,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92034"
        },
        {
          "cve": "CVE-2026-92038",
          "summary": "Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.1,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92038"
        },
        {
          "cve": "CVE-2026-92041",
          "summary": "Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.1,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92041"
        },
        {
          "cve": "CVE-2026-92050",
          "summary": "Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.1,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92050"
        },
        {
          "cve": "CVE-2026-92051",
          "summary": "Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 9.1,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92051"
        },
        {
          "cve": "CVE-2026-92057",
          "summary": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.1,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92057"
        },
        {
          "cve": "CVE-2026-92075",
          "summary": "Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.1,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92075"
        },
        {
          "cve": "CVE-2026-92079",
          "summary": "Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9.1,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92079"
        },
        {
          "cve": "CVE-2026-92048",
          "summary": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 9,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92048"
        },
        {
          "cve": "CVE-2026-92006",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92006"
        },
        {
          "cve": "CVE-2026-92007",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92007"
        },
        {
          "cve": "CVE-2026-92008",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92008"
        },
        {
          "cve": "CVE-2026-92009",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92009"
        },
        {
          "cve": "CVE-2026-92010",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92010"
        },
        {
          "cve": "CVE-2026-92011",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92011"
        },
        {
          "cve": "CVE-2026-92012",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92012"
        },
        {
          "cve": "CVE-2026-92013",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, a",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92013"
        },
        {
          "cve": "CVE-2026-92014",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92014"
        },
        {
          "cve": "CVE-2026-92015",
          "summary": "Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92015"
        },
        {
          "cve": "CVE-2026-92016",
          "summary": "Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92016"
        },
        {
          "cve": "CVE-2026-92017",
          "summary": "Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92017"
        },
        {
          "cve": "CVE-2026-92020",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92020"
        },
        {
          "cve": "CVE-2026-92021",
          "summary": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.",
          "cvss": 8.8,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92021"
        },
        {
          "cve": "CVE-2026-92022",
          "summary": "Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92022"
        },
        {
          "cve": "CVE-2026-92023",
          "summary": "Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92023"
        },
        {
          "cve": "CVE-2026-92024",
          "summary": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92024"
        },
        {
          "cve": "CVE-2026-92025",
          "summary": "Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92025"
        },
        {
          "cve": "CVE-2026-92026",
          "summary": "Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92026"
        },
        {
          "cve": "CVE-2026-92027",
          "summary": "Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92027"
        },
        {
          "cve": "CVE-2026-92028",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92028"
        },
        {
          "cve": "CVE-2026-92029",
          "summary": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92029"
        },
        {
          "cve": "CVE-2026-92040",
          "summary": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 8.8,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92040"
        },
        {
          "cve": "CVE-2026-92043",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92043"
        },
        {
          "cve": "CVE-2026-92046",
          "summary": "Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92046"
        },
        {
          "cve": "CVE-2026-92047",
          "summary": "Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92047"
        },
        {
          "cve": "CVE-2026-92049",
          "summary": "Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92049"
        },
        {
          "cve": "CVE-2026-92052",
          "summary": "Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92052"
        },
        {
          "cve": "CVE-2026-92053",
          "summary": "Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92053"
        },
        {
          "cve": "CVE-2026-92054",
          "summary": "Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92054"
        },
        {
          "cve": "CVE-2026-92055",
          "summary": "Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92055"
        },
        {
          "cve": "CVE-2026-92056",
          "summary": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92056"
        },
        {
          "cve": "CVE-2026-92058",
          "summary": "Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92058"
        },
        {
          "cve": "CVE-2026-92060",
          "summary": "Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92060"
        },
        {
          "cve": "CVE-2026-92062",
          "summary": "Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92062"
        },
        {
          "cve": "CVE-2026-92064",
          "summary": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92064"
        },
        {
          "cve": "CVE-2026-92065",
          "summary": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92065"
        },
        {
          "cve": "CVE-2026-92067",
          "summary": "Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92067"
        },
        {
          "cve": "CVE-2026-92073",
          "summary": "Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92073"
        },
        {
          "cve": "CVE-2026-92074",
          "summary": "Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92074"
        },
        {
          "cve": "CVE-2026-92076",
          "summary": "Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8.8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92076"
        },
        {
          "cve": "CVE-2026-92019",
          "summary": "Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 8.1,
          "affected_max": "115.41.0",
          "fixed_in": "115.41.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92019"
        },
        {
          "cve": "CVE-2026-92072",
          "summary": "Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 8,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92072"
        },
        {
          "cve": "CVE-2026-92042",
          "summary": "Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 7.5,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92042"
        },
        {
          "cve": "CVE-2026-92044",
          "summary": "Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 7.5,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92044"
        },
        {
          "cve": "CVE-2026-92031",
          "summary": "Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 6.5,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92031"
        },
        {
          "cve": "CVE-2026-92063",
          "summary": "Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.",
          "cvss": 6.5,
          "affected_max": "156.0.0",
          "fixed_in": "156.0.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92063"
        },
        {
          "cve": "CVE-2026-92077",
          "summary": "Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 6.5,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92077"
        },
        {
          "cve": "CVE-2026-92078",
          "summary": "Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 6.5,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92078"
        },
        {
          "cve": "CVE-2026-92039",
          "summary": "Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 6.3,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92039"
        },
        {
          "cve": "CVE-2026-92030",
          "summary": "Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 5.4,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92030"
        },
        {
          "cve": "CVE-2026-92068",
          "summary": "Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 5.4,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92068"
        },
        {
          "cve": "CVE-2026-92069",
          "summary": "Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 5.4,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92069"
        },
        {
          "cve": "CVE-2026-92005",
          "summary": "Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.",
          "cvss": 5.3,
          "affected_max": "140.16.0",
          "fixed_in": "140.16.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92005"
        },
        {
          "cve": "CVE-2026-92070",
          "summary": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.",
          "cvss": 4.3,
          "affected_max": "153.3.0",
          "fixed_in": "153.3.0",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-92070"
        },
        {
          "cve": "CVE-2026-84129",
          "summary": "Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 9.8,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84129"
        },
        {
          "cve": "CVE-2026-84133",
          "summary": "Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 9.8,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84133"
        },
        {
          "cve": "CVE-2026-84134",
          "summary": "Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 9.8,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84134"
        },
        {
          "cve": "CVE-2026-84140",
          "summary": "Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 9.8,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84140"
        },
        {
          "cve": "CVE-2026-84141",
          "summary": "Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 9.8,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84141"
        },
        {
          "cve": "CVE-2026-84142",
          "summary": "Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability",
          "cvss": 9.8,
          "affected_max": "155.0.0",
          "fixed_in": "155.0.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84142"
        },
        {
          "cve": "CVE-2026-84143",
          "summary": "Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of t",
          "cvss": 9.8,
          "affected_max": "140.15.0",
          "fixed_in": "140.15.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84143"
        },
        {
          "cve": "CVE-2026-84119",
          "summary": "Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 9.6,
          "affected_max": "115.40.0",
          "fixed_in": "115.40.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84119"
        },
        {
          "cve": "CVE-2026-84121",
          "summary": "Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 9.6,
          "affected_max": "115.40.0",
          "fixed_in": "115.40.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84121"
        },
        {
          "cve": "CVE-2026-84123",
          "summary": "Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 8.8,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84123"
        },
        {
          "cve": "CVE-2026-84128",
          "summary": "Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.",
          "cvss": 8.8,
          "affected_max": "155.0.0",
          "fixed_in": "155.0.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84128"
        },
        {
          "cve": "CVE-2026-84131",
          "summary": "Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 8.8,
          "affected_max": "115.40.0",
          "fixed_in": "115.40.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84131"
        },
        {
          "cve": "CVE-2026-84130",
          "summary": "Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 7.5,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84130"
        },
        {
          "cve": "CVE-2026-84132",
          "summary": "Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 7.5,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84132"
        },
        {
          "cve": "CVE-2026-84144",
          "summary": "Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exp",
          "cvss": 7.5,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84144"
        },
        {
          "cve": "CVE-2026-84145",
          "summary": "Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of t",
          "cvss": 7.5,
          "affected_max": "115.40.0",
          "fixed_in": "115.40.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84145"
        },
        {
          "cve": "CVE-2026-84138",
          "summary": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.",
          "cvss": 6.5,
          "affected_max": "155.0.0",
          "fixed_in": "155.0.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84138"
        },
        {
          "cve": "CVE-2026-84136",
          "summary": "Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 6.1,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84136"
        },
        {
          "cve": "CVE-2026-84139",
          "summary": "Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 6.1,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84139"
        },
        {
          "cve": "CVE-2026-84118",
          "summary": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 5.4,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84118"
        },
        {
          "cve": "CVE-2026-84120",
          "summary": "Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 5.4,
          "affected_max": "115.40.0",
          "fixed_in": "115.40.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84120"
        },
        {
          "cve": "CVE-2026-84122",
          "summary": "Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 5.4,
          "affected_max": "140.15.0",
          "fixed_in": "140.15.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84122"
        },
        {
          "cve": "CVE-2026-84124",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 5.4,
          "affected_max": "140.15.0",
          "fixed_in": "140.15.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84124"
        },
        {
          "cve": "CVE-2026-84125",
          "summary": "Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 5.4,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84125"
        },
        {
          "cve": "CVE-2026-84126",
          "summary": "Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.",
          "cvss": 4.3,
          "affected_max": "155.0.0",
          "fixed_in": "155.0.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84126"
        },
        {
          "cve": "CVE-2026-84137",
          "summary": "Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.",
          "cvss": 4.3,
          "affected_max": "153.2.0",
          "fixed_in": "153.2.0",
          "published": "2026-09-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-84137"
        },
        {
          "cve": "CVE-2026-75874",
          "summary": "Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.",
          "cvss": 10,
          "affected_max": "154.0.0",
          "fixed_in": "154.0.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-75874"
        },
        {
          "cve": "CVE-2026-74964",
          "summary": "Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 9.8,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74964"
        },
        {
          "cve": "CVE-2026-74979",
          "summary": "Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 9.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74979"
        },
        {
          "cve": "CVE-2026-74985",
          "summary": "Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 9.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74985"
        },
        {
          "cve": "CVE-2026-74987",
          "summary": "Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of t",
          "cvss": 9.8,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74987"
        },
        {
          "cve": "CVE-2026-74988",
          "summary": "Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exp",
          "cvss": 9.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74988"
        },
        {
          "cve": "CVE-2026-74989",
          "summary": "Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability",
          "cvss": 9.8,
          "affected_max": "154.0.0",
          "fixed_in": "154.0.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74989"
        },
        {
          "cve": "CVE-2026-74990",
          "summary": "Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of t",
          "cvss": 9.8,
          "affected_max": "115.39.0",
          "fixed_in": "115.39.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74990"
        },
        {
          "cve": "CVE-2026-74956",
          "summary": "Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 9.1,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74956"
        },
        {
          "cve": "CVE-2026-74959",
          "summary": "Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 9.1,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74959"
        },
        {
          "cve": "CVE-2026-74961",
          "summary": "Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 9.1,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74961"
        },
        {
          "cve": "CVE-2026-74986",
          "summary": "Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 9.1,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74986"
        },
        {
          "cve": "CVE-2026-74946",
          "summary": "Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, a",
          "cvss": 8.8,
          "affected_max": "115.39.0",
          "fixed_in": "115.39.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74946"
        },
        {
          "cve": "CVE-2026-74947",
          "summary": "Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74947"
        },
        {
          "cve": "CVE-2026-74949",
          "summary": "Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74949"
        },
        {
          "cve": "CVE-2026-74950",
          "summary": "Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74950"
        },
        {
          "cve": "CVE-2026-74952",
          "summary": "Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.",
          "cvss": 8.8,
          "affected_max": "154.0.0",
          "fixed_in": "154.0.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74952"
        },
        {
          "cve": "CVE-2026-74953",
          "summary": "Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74953"
        },
        {
          "cve": "CVE-2026-74955",
          "summary": "Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74955"
        },
        {
          "cve": "CVE-2026-74965",
          "summary": "Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74965"
        },
        {
          "cve": "CVE-2026-74969",
          "summary": "Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.8,
          "affected_max": "115.39.0",
          "fixed_in": "115.39.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74969"
        },
        {
          "cve": "CVE-2026-74957",
          "summary": "Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.1,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74957"
        },
        {
          "cve": "CVE-2026-74960",
          "summary": "Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.1,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74960"
        },
        {
          "cve": "CVE-2026-74962",
          "summary": "Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.1,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74962"
        },
        {
          "cve": "CVE-2026-74978",
          "summary": "Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 8.1,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74978"
        },
        {
          "cve": "CVE-2026-74981",
          "summary": "Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 8.1,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74981"
        },
        {
          "cve": "CVE-2026-74983",
          "summary": "Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 8.1,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74983"
        },
        {
          "cve": "CVE-2026-74954",
          "summary": "Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 7.5,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74954"
        },
        {
          "cve": "CVE-2026-74958",
          "summary": "Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 7.5,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74958"
        },
        {
          "cve": "CVE-2026-74966",
          "summary": "Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 7.5,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74966"
        },
        {
          "cve": "CVE-2026-74977",
          "summary": "Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 7.5,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74977"
        },
        {
          "cve": "CVE-2026-74982",
          "summary": "Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 7.5,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74982"
        },
        {
          "cve": "CVE-2026-74984",
          "summary": "Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 6.8,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74984"
        },
        {
          "cve": "CVE-2026-74948",
          "summary": "Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 6.5,
          "affected_max": "115.39.0",
          "fixed_in": "115.39.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74948"
        },
        {
          "cve": "CVE-2026-74976",
          "summary": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 6.5,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74976"
        },
        {
          "cve": "CVE-2026-74963",
          "summary": "Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 5.4,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74963"
        },
        {
          "cve": "CVE-2026-74967",
          "summary": "Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 5.4,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74967"
        },
        {
          "cve": "CVE-2026-74968",
          "summary": "Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 5.4,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74968"
        },
        {
          "cve": "CVE-2026-74970",
          "summary": "Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.",
          "cvss": 5.4,
          "affected_max": "153.1.0",
          "fixed_in": "153.1.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74970"
        },
        {
          "cve": "CVE-2026-74974",
          "summary": "Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 5.4,
          "affected_max": "115.39.0",
          "fixed_in": "115.39.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74974"
        },
        {
          "cve": "CVE-2026-74971",
          "summary": "Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 4.3,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74971"
        },
        {
          "cve": "CVE-2026-74972",
          "summary": "Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 4.3,
          "affected_max": "140.14.0",
          "fixed_in": "140.14.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74972"
        },
        {
          "cve": "CVE-2026-74973",
          "summary": "Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.",
          "cvss": 4.2,
          "affected_max": "115.39.0",
          "fixed_in": "115.39.0",
          "published": "2026-08-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-74973"
        }
      ]
    },
    {
      "id": "edge",
      "label": "Edge",
      "cves": [
        {
          "cve": "CVE-2026-88097",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.",
          "cvss": 8.1,
          "affected_max": "153.0.4234.46",
          "fixed_in": "153.0.4234.46",
          "published": "2026-09-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-88097"
        },
        {
          "cve": "CVE-2026-69486",
          "summary": "Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "153.0.4234.32",
          "fixed_in": "153.0.4234.32",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-69486"
        },
        {
          "cve": "CVE-2026-85893",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.",
          "cvss": 8.8,
          "affected_max": "153.0.4234.32",
          "fixed_in": "153.0.4234.32",
          "published": "2026-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85893"
        },
        {
          "cve": "CVE-2026-85892",
          "summary": "Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.",
          "cvss": 7.8,
          "affected_max": "152.0.4191.66",
          "fixed_in": "152.0.4191.66",
          "published": "2026-09-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-85892"
        },
        {
          "cve": "CVE-2026-70341",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.",
          "cvss": 8.5,
          "affected_max": "152.0.4191.52",
          "fixed_in": "152.0.4191.52",
          "published": "2026-09-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-70341"
        },
        {
          "cve": "CVE-2026-77490",
          "summary": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.1,
          "affected_max": "151.0.4129.107",
          "fixed_in": "151.0.4129.107",
          "published": "2026-09-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-77490"
        },
        {
          "cve": "CVE-2026-72984",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "152.0.4191.53",
          "fixed_in": "152.0.4191.53",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-72984"
        },
        {
          "cve": "CVE-2026-66324",
          "summary": "External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.5,
          "affected_max": "152.0.4191.53",
          "fixed_in": "152.0.4191.53",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66324"
        },
        {
          "cve": "CVE-2026-62904",
          "summary": "Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 5.4,
          "affected_max": "152.0.4191.53",
          "fixed_in": "152.0.4191.53",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-62904"
        },
        {
          "cve": "CVE-2026-66323",
          "summary": "Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 5.4,
          "affected_max": "152.0.4191.53",
          "fixed_in": "152.0.4191.53",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66323"
        },
        {
          "cve": "CVE-2026-70309",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.65",
          "fixed_in": "150.0.4078.65",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-70309"
        },
        {
          "cve": "CVE-2026-70331",
          "summary": "Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.50",
          "fixed_in": "150.0.4078.50",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-70331"
        },
        {
          "cve": "CVE-2026-58616",
          "summary": "Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.",
          "cvss": 4.4,
          "affected_max": "152.0.4191.53",
          "fixed_in": "152.0.4191.53",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58616"
        },
        {
          "cve": "CVE-2026-66798",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 4.3,
          "affected_max": "152.0.4191.53",
          "fixed_in": "152.0.4191.53",
          "published": "2026-08-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66798"
        },
        {
          "cve": "CVE-2026-72970",
          "summary": "Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "151.0.4129.86",
          "fixed_in": "151.0.4129.86",
          "published": "2026-08-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-72970"
        },
        {
          "cve": "CVE-2026-70339",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 5.4,
          "affected_max": "151.0.4129.78",
          "fixed_in": "151.0.4129.78",
          "published": "2026-08-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-70339"
        },
        {
          "cve": "CVE-2026-66318",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 8.1,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66318"
        },
        {
          "cve": "CVE-2026-66315",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66315"
        },
        {
          "cve": "CVE-2026-65802",
          "summary": "External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.4,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65802"
        },
        {
          "cve": "CVE-2026-66321",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.4,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66321"
        },
        {
          "cve": "CVE-2026-66322",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 7.1,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66322"
        },
        {
          "cve": "CVE-2026-66313",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.",
          "cvss": 6.8,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66313"
        },
        {
          "cve": "CVE-2026-66312",
          "summary": "Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.",
          "cvss": 6.5,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66312"
        },
        {
          "cve": "CVE-2026-66314",
          "summary": "Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 6.5,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66314"
        },
        {
          "cve": "CVE-2026-66326",
          "summary": "Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 6.5,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66326"
        },
        {
          "cve": "CVE-2026-66311",
          "summary": "Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.",
          "cvss": 6.2,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66311"
        },
        {
          "cve": "CVE-2026-65804",
          "summary": "Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.1,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-65804"
        },
        {
          "cve": "CVE-2026-66325",
          "summary": "Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.1,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66325"
        },
        {
          "cve": "CVE-2026-66316",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66316"
        },
        {
          "cve": "CVE-2026-66317",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.",
          "cvss": 5.4,
          "affected_max": "151.0.4129.59",
          "fixed_in": "151.0.4129.59",
          "published": "2026-08-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-66317"
        },
        {
          "cve": "CVE-2026-57989",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.4,
          "affected_max": "150.0.4078.99",
          "fixed_in": "150.0.4078.99",
          "published": "2026-07-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57989"
        },
        {
          "cve": "CVE-2026-57978",
          "summary": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.99",
          "fixed_in": "150.0.4078.99",
          "published": "2026-07-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57978"
        },
        {
          "cve": "CVE-2026-57980",
          "summary": "Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.80",
          "fixed_in": "150.0.4078.80",
          "published": "2026-07-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57980"
        },
        {
          "cve": "CVE-2026-58596",
          "summary": "Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58596"
        },
        {
          "cve": "CVE-2026-58281",
          "summary": "Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58281"
        },
        {
          "cve": "CVE-2026-58525",
          "summary": "Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 8.2,
          "affected_max": "150.0.4078.50",
          "fixed_in": "150.0.4078.50",
          "published": "2026-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58525"
        },
        {
          "cve": "CVE-2026-58289",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 9,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58289"
        },
        {
          "cve": "CVE-2026-56645",
          "summary": "Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56645"
        },
        {
          "cve": "CVE-2026-57974",
          "summary": "Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57974"
        },
        {
          "cve": "CVE-2026-57981",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57981"
        },
        {
          "cve": "CVE-2026-57983",
          "summary": "Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 8.7,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57983"
        },
        {
          "cve": "CVE-2026-58284",
          "summary": "Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58284"
        },
        {
          "cve": "CVE-2026-58285",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58285"
        },
        {
          "cve": "CVE-2026-58287",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58287"
        },
        {
          "cve": "CVE-2026-58288",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58288"
        },
        {
          "cve": "CVE-2026-58295",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 8.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58295"
        },
        {
          "cve": "CVE-2026-58282",
          "summary": "Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 8.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58282"
        },
        {
          "cve": "CVE-2026-58283",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 8.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58283"
        },
        {
          "cve": "CVE-2026-58286",
          "summary": "Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 8.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58286"
        },
        {
          "cve": "CVE-2026-58293",
          "summary": "External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58293"
        },
        {
          "cve": "CVE-2026-57985",
          "summary": "Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.6,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57985"
        },
        {
          "cve": "CVE-2026-57975",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57975"
        },
        {
          "cve": "CVE-2026-57984",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57984"
        },
        {
          "cve": "CVE-2026-57986",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57986"
        },
        {
          "cve": "CVE-2026-57992",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57992"
        },
        {
          "cve": "CVE-2026-58276",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58276"
        },
        {
          "cve": "CVE-2026-58290",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58290"
        },
        {
          "cve": "CVE-2026-58292",
          "summary": "Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58292"
        },
        {
          "cve": "CVE-2026-58294",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58294"
        },
        {
          "cve": "CVE-2026-58299",
          "summary": "Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58299"
        },
        {
          "cve": "CVE-2026-57991",
          "summary": "Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.4,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57991"
        },
        {
          "cve": "CVE-2026-57993",
          "summary": "Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 7.4,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57993"
        },
        {
          "cve": "CVE-2026-58298",
          "summary": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 7.2,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58298"
        },
        {
          "cve": "CVE-2026-57977",
          "summary": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 7.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57977"
        },
        {
          "cve": "CVE-2026-57988",
          "summary": "Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57988"
        },
        {
          "cve": "CVE-2026-58296",
          "summary": "Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58296"
        },
        {
          "cve": "CVE-2026-58297",
          "summary": "Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58297"
        },
        {
          "cve": "CVE-2026-58522",
          "summary": "Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.",
          "cvss": 6.8,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58522"
        },
        {
          "cve": "CVE-2026-45489",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 6.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45489"
        },
        {
          "cve": "CVE-2026-56646",
          "summary": "Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56646"
        },
        {
          "cve": "CVE-2026-57987",
          "summary": "Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57987"
        },
        {
          "cve": "CVE-2026-58523",
          "summary": "Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 6.5,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58523"
        },
        {
          "cve": "CVE-2026-58300",
          "summary": "Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.",
          "cvss": 6.2,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58300"
        },
        {
          "cve": "CVE-2026-58291",
          "summary": "Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 6.1,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58291"
        },
        {
          "cve": "CVE-2026-45488",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45488"
        },
        {
          "cve": "CVE-2026-58278",
          "summary": "Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58278"
        },
        {
          "cve": "CVE-2026-58524",
          "summary": "Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58524"
        },
        {
          "cve": "CVE-2026-58597",
          "summary": "Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 4.3,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-58597"
        },
        {
          "cve": "CVE-2026-55945",
          "summary": "Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to disclose information locally.",
          "cvss": 4.2,
          "affected_max": "150.0.4078.48",
          "fixed_in": "150.0.4078.48",
          "published": "2026-07-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-55945"
        },
        {
          "cve": "CVE-2026-50521",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.",
          "cvss": 8.3,
          "affected_max": "149.0.4022.67",
          "fixed_in": "149.0.4022.67",
          "published": "2026-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-50521"
        },
        {
          "cve": "CVE-2026-45495",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 8.8,
          "affected_max": "148.0.3967.70",
          "fixed_in": "148.0.3967.70",
          "published": "2026-05-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45495"
        },
        {
          "cve": "CVE-2026-45492",
          "summary": "Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 5.4,
          "affected_max": "148.0.3967.70",
          "fixed_in": "148.0.3967.70",
          "published": "2026-05-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45492"
        },
        {
          "cve": "CVE-2026-45494",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 5.4,
          "affected_max": "148.0.3967.70",
          "fixed_in": "148.0.3967.70",
          "published": "2026-05-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45494"
        },
        {
          "cve": "CVE-2026-41107",
          "summary": "External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.4,
          "affected_max": "148.0.3967.55",
          "fixed_in": "148.0.3967.55",
          "published": "2026-05-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-41107"
        },
        {
          "cve": "CVE-2026-42891",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.5,
          "affected_max": "148.0.3967.55",
          "fixed_in": "148.0.3967.55",
          "published": "2026-05-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42891"
        },
        {
          "cve": "CVE-2026-42838",
          "summary": "Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.",
          "cvss": 5.4,
          "affected_max": "148.0.3967.55",
          "fixed_in": "148.0.3967.55",
          "published": "2026-05-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42838"
        },
        {
          "cve": "CVE-2026-40416",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 4.3,
          "affected_max": "148.0.3967.55",
          "fixed_in": "148.0.3967.55",
          "published": "2026-05-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40416"
        },
        {
          "cve": "CVE-2026-33118",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 4.3,
          "affected_max": "147.0.3912.60",
          "fixed_in": "147.0.3912.60",
          "published": "2026-04-10",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-33118"
        },
        {
          "cve": "CVE-2026-0385",
          "summary": "Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability",
          "cvss": 5,
          "affected_max": "146.0.3856.59",
          "fixed_in": "146.0.3856.59",
          "published": "2026-03-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0385"
        },
        {
          "cve": "CVE-2026-0102",
          "summary": "Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, ema",
          "cvss": 3.1,
          "affected_max": "145.0.3800.58",
          "fixed_in": "145.0.3800.58",
          "published": "2026-02-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0102"
        },
        {
          "cve": "CVE-2026-0391",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.5,
          "affected_max": "143.0.3650.66",
          "fixed_in": "143.0.3650.66",
          "published": "2026-02-05",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0391"
        },
        {
          "cve": "CVE-2026-21223",
          "summary": "Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.",
          "cvss": 7.1,
          "affected_max": "144.0.3719.82",
          "fixed_in": "144.0.3719.82",
          "published": "2026-01-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-21223"
        },
        {
          "cve": "CVE-2025-65046",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 3.1,
          "affected_max": "143.0.3650.88",
          "fixed_in": "143.0.3650.88",
          "published": "2025-12-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-65046"
        },
        {
          "cve": "CVE-2025-14174",
          "summary": "Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "143.0.3650.80",
          "fixed_in": "143.0.3650.80",
          "published": "2025-12-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14174"
        },
        {
          "cve": "CVE-2025-62223",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 4.3,
          "affected_max": "143.0.3650.66",
          "fixed_in": "143.0.3650.66",
          "published": "2025-12-05",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62223"
        },
        {
          "cve": "CVE-2025-60711",
          "summary": "Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 6.3,
          "affected_max": "142.0.3595.53",
          "fixed_in": "142.0.3595.53",
          "published": "2025-10-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-60711"
        },
        {
          "cve": "CVE-2025-59251",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.6,
          "affected_max": "140.0.3485.81",
          "fixed_in": "140.0.3485.81",
          "published": "2025-09-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-59251"
        },
        {
          "cve": "CVE-2025-53791",
          "summary": "Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.",
          "cvss": 4.7,
          "affected_max": "140.0.3485.54",
          "fixed_in": "140.0.3485.54",
          "published": "2025-09-05",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-53791"
        },
        {
          "cve": "CVE-2025-47963",
          "summary": "No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.3,
          "affected_max": "138.0.3351.55",
          "fixed_in": "138.0.3351.55",
          "published": "2025-07-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47963"
        },
        {
          "cve": "CVE-2025-47182",
          "summary": "Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.",
          "cvss": 5.6,
          "affected_max": "138.0.3351.55",
          "fixed_in": "138.0.3351.55",
          "published": "2025-07-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47182"
        },
        {
          "cve": "CVE-2025-47964",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 5.4,
          "affected_max": "138.0.3351.55",
          "fixed_in": "138.0.3351.55",
          "published": "2025-07-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47964"
        },
        {
          "cve": "CVE-2025-49713",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "138.0.3351.65",
          "fixed_in": "138.0.3351.65",
          "published": "2025-07-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49713"
        },
        {
          "cve": "CVE-2025-49741",
          "summary": "No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
          "cvss": 7.4,
          "affected_max": "135.0.3179.98",
          "fixed_in": "135.0.3179.98",
          "published": "2025-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49741"
        },
        {
          "cve": "CVE-2025-5419",
          "summary": "Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "137.0.3296.62",
          "fixed_in": "137.0.3296.62",
          "published": "2025-06-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5419"
        },
        {
          "cve": "CVE-2025-29825",
          "summary": "User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 6.5,
          "affected_max": "136.0.3240.50",
          "fixed_in": "136.0.3240.50",
          "published": "2025-05-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-29825"
        },
        {
          "cve": "CVE-2025-29834",
          "summary": "Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 7.5,
          "affected_max": "134.0.3124.93",
          "fixed_in": "134.0.3124.93",
          "published": "2025-04-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-29834"
        },
        {
          "cve": "CVE-2025-25000",
          "summary": "Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 8.8,
          "affected_max": "135.0.3179.54",
          "fixed_in": "135.0.3179.54",
          "published": "2025-04-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-25000"
        },
        {
          "cve": "CVE-2025-29815",
          "summary": "Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.",
          "cvss": 7.6,
          "affected_max": "134.0.3124.66",
          "fixed_in": "134.0.3124.66",
          "published": "2025-04-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-29815"
        },
        {
          "cve": "CVE-2025-29806",
          "summary": "No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.",
          "cvss": 6.5,
          "affected_max": "129.0.2792.52",
          "fixed_in": "129.0.2792.52",
          "published": "2025-03-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-29806"
        },
        {
          "cve": "CVE-2025-26643",
          "summary": "The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.",
          "cvss": 5.4,
          "affected_max": "134.0.3124.51",
          "fixed_in": "134.0.3124.51",
          "published": "2025-03-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-26643"
        },
        {
          "cve": "CVE-2025-21401",
          "summary": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
          "cvss": 4.5,
          "affected_max": "133.0.3065.69",
          "fixed_in": "133.0.3065.69",
          "published": "2025-02-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21401"
        },
        {
          "cve": "CVE-2025-21342",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 8.8,
          "affected_max": "133.0.3065.51",
          "fixed_in": "133.0.3065.51",
          "published": "2025-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21342"
        },
        {
          "cve": "CVE-2025-21408",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 8.8,
          "affected_max": "133.0.3065.51",
          "fixed_in": "133.0.3065.51",
          "published": "2025-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21408"
        },
        {
          "cve": "CVE-2025-21279",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "133.0.3065.51",
          "fixed_in": "133.0.3065.51",
          "published": "2025-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21279"
        },
        {
          "cve": "CVE-2025-21283",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "133.0.3065.51",
          "fixed_in": "133.0.3065.51",
          "published": "2025-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21283"
        },
        {
          "cve": "CVE-2025-21267",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.4,
          "affected_max": "133.0.3065.51",
          "fixed_in": "133.0.3065.51",
          "published": "2025-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21267"
        },
        {
          "cve": "CVE-2025-21404",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "133.0.3065.51",
          "fixed_in": "133.0.3065.51",
          "published": "2025-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21404"
        },
        {
          "cve": "CVE-2025-21262",
          "summary": "User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network",
          "cvss": 5.4,
          "affected_max": "132.0.2957.127",
          "fixed_in": "132.0.2957.127",
          "published": "2025-01-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21262"
        },
        {
          "cve": "CVE-2025-21185",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 6.5,
          "affected_max": "132.0.2957.115",
          "fixed_in": "132.0.2957.115",
          "published": "2025-01-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-21185"
        },
        {
          "cve": "CVE-2024-49041",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "131.0.2903.86",
          "fixed_in": "131.0.2903.86",
          "published": "2024-12-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-49041"
        },
        {
          "cve": "CVE-2024-49054",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "131.0.2903.63",
          "fixed_in": "131.0.2903.63",
          "published": "2024-11-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-49054"
        },
        {
          "cve": "CVE-2024-49025",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 5.4,
          "affected_max": "131.0.2903.48",
          "fixed_in": "131.0.2903.48",
          "published": "2024-11-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-49025"
        },
        {
          "cve": "CVE-2024-49023",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 5.9,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-49023"
        },
        {
          "cve": "CVE-2024-43577",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43577"
        },
        {
          "cve": "CVE-2024-43578",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.6,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43578"
        },
        {
          "cve": "CVE-2024-43579",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.6,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43579"
        },
        {
          "cve": "CVE-2024-43566",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.5,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43566"
        },
        {
          "cve": "CVE-2024-43595",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43595"
        },
        {
          "cve": "CVE-2024-43596",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43596"
        },
        {
          "cve": "CVE-2024-43587",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 5.9,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43587"
        },
        {
          "cve": "CVE-2024-43580",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 5.4,
          "affected_max": "130.0.2849.46",
          "fixed_in": "130.0.2849.46",
          "published": "2024-10-17",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43580"
        },
        {
          "cve": "CVE-2024-43489",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "129.0.2792.52",
          "fixed_in": "129.0.2792.52",
          "published": "2024-09-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43489"
        },
        {
          "cve": "CVE-2024-43496",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "129.0.2792.52",
          "fixed_in": "129.0.2792.52",
          "published": "2024-09-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43496"
        },
        {
          "cve": "CVE-2024-38221",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "129.0.2792.52",
          "fixed_in": "129.0.2792.52",
          "published": "2024-09-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38221"
        },
        {
          "cve": "CVE-2024-38207",
          "summary": "Microsoft Edge (HTML-based) Memory Corruption Vulnerability",
          "cvss": 6.3,
          "affected_max": "128.0.2739.42",
          "fixed_in": "128.0.2739.42",
          "published": "2024-08-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38207"
        },
        {
          "cve": "CVE-2024-38209",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.8,
          "affected_max": "128.0.2739.42",
          "fixed_in": "128.0.2739.42",
          "published": "2024-08-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38209"
        },
        {
          "cve": "CVE-2024-38210",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.8,
          "affected_max": "128.0.2739.42",
          "fixed_in": "128.0.2739.42",
          "published": "2024-08-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38210"
        },
        {
          "cve": "CVE-2024-7965",
          "summary": "Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "128.0.2739.42",
          "fixed_in": "128.0.2739.42",
          "published": "2024-08-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7965"
        },
        {
          "cve": "CVE-2024-43472",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 5.8,
          "affected_max": "127.0.2651.105",
          "fixed_in": "127.0.2651.105",
          "published": "2024-08-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43472"
        },
        {
          "cve": "CVE-2024-38218",
          "summary": "Microsoft Edge (HTML-based) Memory Corruption Vulnerability",
          "cvss": 8.4,
          "affected_max": "127.0.2651.98",
          "fixed_in": "127.0.2651.98",
          "published": "2024-08-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38218"
        },
        {
          "cve": "CVE-2024-38219",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.5,
          "affected_max": "127.0.2651.98",
          "fixed_in": "127.0.2651.98",
          "published": "2024-08-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38219"
        },
        {
          "cve": "CVE-2024-34122",
          "summary": "Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this",
          "cvss": 7.8,
          "affected_max": "126.0.2592.81",
          "fixed_in": "126.0.2592.81",
          "published": "2024-07-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-34122"
        },
        {
          "cve": "CVE-2024-30058",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 5.4,
          "affected_max": "126.0.2592.56",
          "fixed_in": "126.0.2592.56",
          "published": "2024-06-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-30058"
        },
        {
          "cve": "CVE-2024-38083",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "126.0.2592.56",
          "fixed_in": "126.0.2592.56",
          "published": "2024-06-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38083"
        },
        {
          "cve": "CVE-2024-30056",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 7.1,
          "affected_max": "124.0.2478.109",
          "fixed_in": "124.0.2478.109",
          "published": "2024-05-25",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-30056"
        },
        {
          "cve": "CVE-2024-30055",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 5.4,
          "affected_max": "124.0.2478.97",
          "fixed_in": "124.0.2478.97",
          "published": "2024-05-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-30055"
        },
        {
          "cve": "CVE-2024-29991",
          "summary": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
          "cvss": 5,
          "affected_max": "124.0.2478.51",
          "fixed_in": "124.0.2478.51",
          "published": "2024-04-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-29991"
        },
        {
          "cve": "CVE-2024-29987",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 6.5,
          "affected_max": "124.0.2478.51",
          "fixed_in": "124.0.2478.51",
          "published": "2024-04-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-29987"
        },
        {
          "cve": "CVE-2024-29986",
          "summary": "Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 5.4,
          "affected_max": "124.0.2478.51",
          "fixed_in": "124.0.2478.51",
          "published": "2024-04-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-29986"
        },
        {
          "cve": "CVE-2024-29981",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "122.0.2365.120",
          "fixed_in": "122.0.2365.120",
          "published": "2024-04-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-29981"
        },
        {
          "cve": "CVE-2024-29049",
          "summary": "Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability",
          "cvss": 4.1,
          "affected_max": "122.0.2365.120",
          "fixed_in": "122.0.2365.120",
          "published": "2024-04-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-29049"
        },
        {
          "cve": "CVE-2024-26163",
          "summary": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
          "cvss": 4.7,
          "affected_max": "122.0.2365.92",
          "fixed_in": "122.0.2365.92",
          "published": "2024-03-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26163"
        },
        {
          "cve": "CVE-2024-26192",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 8.2,
          "affected_max": "122.0.2365.52",
          "fixed_in": "122.0.2365.52",
          "published": "2024-02-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26192"
        },
        {
          "cve": "CVE-2024-21423",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 4.8,
          "affected_max": "122.0.2365.52",
          "fixed_in": "122.0.2365.52",
          "published": "2024-02-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21423"
        },
        {
          "cve": "CVE-2024-21399",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 8.3,
          "affected_max": "121.0.2277.98",
          "fixed_in": "121.0.2277.98",
          "published": "2024-02-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21399"
        },
        {
          "cve": "CVE-2024-21388",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 6.5,
          "affected_max": "121.0.2277.83",
          "fixed_in": "121.0.2277.83",
          "published": "2024-01-30",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21388"
        },
        {
          "cve": "CVE-2024-21326",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 9.6,
          "affected_max": "121.0.2277.83",
          "fixed_in": "121.0.2277.83",
          "published": "2024-01-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21326"
        },
        {
          "cve": "CVE-2024-21385",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 8.3,
          "affected_max": "121.0.2277.83",
          "fixed_in": "121.0.2277.83",
          "published": "2024-01-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21385"
        },
        {
          "cve": "CVE-2024-21387",
          "summary": "Microsoft Edge for Android Spoofing Vulnerability",
          "cvss": 5.3,
          "affected_max": "120.0.2210.160",
          "fixed_in": "120.0.2210.160",
          "published": "2024-01-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21387"
        },
        {
          "cve": "CVE-2024-21382",
          "summary": "Microsoft Edge for Android Information Disclosure Vulnerability",
          "cvss": 4.3,
          "affected_max": "121.0.2277.83",
          "fixed_in": "121.0.2277.83",
          "published": "2024-01-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21382"
        },
        {
          "cve": "CVE-2024-21383",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 3.3,
          "affected_max": "121.0.2277.83",
          "fixed_in": "121.0.2277.83",
          "published": "2024-01-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21383"
        },
        {
          "cve": "CVE-2024-21336",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 2.5,
          "affected_max": "121.0.2277.83",
          "fixed_in": "121.0.2277.83",
          "published": "2024-01-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21336"
        },
        {
          "cve": "CVE-2024-20709",
          "summary": "Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the co",
          "cvss": 5.5,
          "affected_max": "120.0.2210.133",
          "fixed_in": "120.0.2210.133",
          "published": "2024-01-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-20709"
        },
        {
          "cve": "CVE-2024-20721",
          "summary": "Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the co",
          "cvss": 5.5,
          "affected_max": "120.0.2210.133",
          "fixed_in": "120.0.2210.133",
          "published": "2024-01-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-20721"
        },
        {
          "cve": "CVE-2024-20675",
          "summary": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
          "cvss": 6.3,
          "affected_max": "120.0.2210.133",
          "fixed_in": "120.0.2210.133",
          "published": "2024-01-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-20675"
        },
        {
          "cve": "CVE-2024-21337",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 5.2,
          "affected_max": "120.0.2210.133",
          "fixed_in": "120.0.2210.133",
          "published": "2024-01-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-21337"
        },
        {
          "cve": "CVE-2023-36878",
          "summary": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
          "cvss": 4.3,
          "affected_max": "120.0.2210.77",
          "fixed_in": "120.0.2210.77",
          "published": "2023-12-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36878"
        },
        {
          "cve": "CVE-2023-6702",
          "summary": "Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "120.0.2210.77",
          "fixed_in": "120.0.2210.77",
          "published": "2023-12-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6702"
        },
        {
          "cve": "CVE-2023-35618",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 9.6,
          "affected_max": "120.0.2210.61",
          "fixed_in": "120.0.2210.61",
          "published": "2023-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35618"
        },
        {
          "cve": "CVE-2023-36880",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 4.8,
          "affected_max": "120.0.2210.61",
          "fixed_in": "120.0.2210.61",
          "published": "2023-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36880"
        },
        {
          "cve": "CVE-2023-38174",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 4.3,
          "affected_max": "120.0.2210.61",
          "fixed_in": "120.0.2210.61",
          "published": "2023-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-38174"
        },
        {
          "cve": "CVE-2023-6345",
          "summary": "Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)",
          "cvss": 9.6,
          "affected_max": "119.0.2151.97",
          "fixed_in": "119.0.2151.97",
          "published": "2023-11-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6345"
        },
        {
          "cve": "CVE-2023-36008",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.6,
          "affected_max": "119.0.2151.72",
          "fixed_in": "119.0.2151.72",
          "published": "2023-11-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36008"
        },
        {
          "cve": "CVE-2023-36026",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "119.0.2151.72",
          "fixed_in": "119.0.2151.72",
          "published": "2023-11-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36026"
        },
        {
          "cve": "CVE-2023-36014",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.3,
          "affected_max": "119.0.2151.58",
          "fixed_in": "119.0.2151.58",
          "published": "2023-11-10",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36014"
        },
        {
          "cve": "CVE-2023-36024",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 7.1,
          "affected_max": "118.0.2088.102",
          "fixed_in": "118.0.2088.102",
          "published": "2023-11-10",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36024"
        },
        {
          "cve": "CVE-2023-36027",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 7.1,
          "affected_max": "118.0.2088.102",
          "fixed_in": "118.0.2088.102",
          "published": "2023-11-10",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36027"
        },
        {
          "cve": "CVE-2023-36409",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 6.5,
          "affected_max": "118.0.2088.46",
          "fixed_in": "118.0.2088.46",
          "published": "2023-11-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36409"
        },
        {
          "cve": "CVE-2023-36034",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.3,
          "affected_max": "118.0.2088.88",
          "fixed_in": "118.0.2088.88",
          "published": "2023-11-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36034"
        },
        {
          "cve": "CVE-2023-36022",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 6.6,
          "affected_max": "118.0.2088.88",
          "fixed_in": "118.0.2088.88",
          "published": "2023-11-03",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36022"
        },
        {
          "cve": "CVE-2023-44323",
          "summary": "Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the curren",
          "cvss": 5.5,
          "affected_max": "118.0.2088.76",
          "fixed_in": "118.0.2088.76",
          "published": "2023-10-30",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-44323"
        },
        {
          "cve": "CVE-2023-36559",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.2,
          "affected_max": "118.0.2088.46",
          "fixed_in": "118.0.2088.46",
          "published": "2023-10-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36559"
        },
        {
          "cve": "CVE-2023-36735",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 9.6,
          "affected_max": "117.0.2045.31",
          "fixed_in": "117.0.2045.31",
          "published": "2023-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36735"
        },
        {
          "cve": "CVE-2023-36562",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 7.1,
          "affected_max": "117.0.2045.31",
          "fixed_in": "117.0.2045.31",
          "published": "2023-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36562"
        },
        {
          "cve": "CVE-2023-36727",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 6.1,
          "affected_max": "117.0.2045.31",
          "fixed_in": "117.0.2045.31",
          "published": "2023-09-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36727"
        },
        {
          "cve": "CVE-2023-4863",
          "summary": "Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)",
          "cvss": 8.8,
          "affected_max": "116.0.1938.81",
          "fixed_in": "116.0.1938.81",
          "published": "2023-09-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863"
        },
        {
          "cve": "CVE-2023-4762",
          "summary": "Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)",
          "cvss": 8.8,
          "affected_max": "116.0.1938.76",
          "fixed_in": "116.0.1938.76",
          "published": "2023-09-05",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-4762"
        },
        {
          "cve": "CVE-2023-36741",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 8.3,
          "affected_max": "116.0.1938.62",
          "fixed_in": "116.0.1938.62",
          "published": "2023-08-26",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36741"
        },
        {
          "cve": "CVE-2023-36787",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 8.8,
          "affected_max": "116.0.1938.54",
          "fixed_in": "116.0.1938.54",
          "published": "2023-08-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36787"
        },
        {
          "cve": "CVE-2023-38158",
          "summary": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
          "cvss": 3.1,
          "affected_max": "116.0.1938.54",
          "fixed_in": "116.0.1938.54",
          "published": "2023-08-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-38158"
        },
        {
          "cve": "CVE-2023-38157",
          "summary": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
          "cvss": 6.5,
          "affected_max": "115.0.1901.200",
          "fixed_in": "115.0.1901.200",
          "published": "2023-08-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-38157"
        },
        {
          "cve": "CVE-2023-38187",
          "summary": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
          "cvss": 6.5,
          "affected_max": "115.0.1901.183",
          "fixed_in": "115.0.1901.183",
          "published": "2023-07-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-38187"
        },
        {
          "cve": "CVE-2023-35392",
          "summary": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
          "cvss": 4.7,
          "affected_max": "115.0.1901.183",
          "fixed_in": "115.0.1901.183",
          "published": "2023-07-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35392"
        },
        {
          "cve": "CVE-2023-38173",
          "summary": "Microsoft Edge for Android Spoofing Vulnerability",
          "cvss": 4.3,
          "affected_max": "115.0.1901.183",
          "fixed_in": "115.0.1901.183",
          "published": "2023-07-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-38173"
        },
        {
          "cve": "CVE-2023-36887",
          "summary": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
          "cvss": 7.8,
          "affected_max": "114.0.1823.82",
          "fixed_in": "114.0.1823.82",
          "published": "2023-07-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36887"
        },
        {
          "cve": "CVE-2023-36888",
          "summary": "Microsoft Edge for Android (Chromium-based) Tampering Vulnerability",
          "cvss": 6.3,
          "affected_max": "114.0.1823.82",
          "fixed_in": "114.0.1823.82",
          "published": "2023-07-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-36888"
        }
      ]
    },
    {
      "id": "tor-browser",
      "label": "Tor Browser",
      "cves": [
        {
          "cve": "CVE-2021-39246",
          "summary": "Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able",
          "cvss": 6.1,
          "affected_max": "10.5.6",
          "fixed_in": null,
          "published": "2021-09-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-39246"
        },
        {
          "cve": "CVE-2019-13075",
          "summary": "Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a ",
          "cvss": 5.3,
          "affected_max": "8.5.3",
          "fixed_in": null,
          "published": "2019-06-30",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-13075"
        },
        {
          "cve": "CVE-2019-12383",
          "summary": "Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a \"Don't send my language\" setting.",
          "cvss": 4.3,
          "affected_max": "8.0.1",
          "fixed_in": "8.0.1",
          "published": "2019-05-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-12383"
        },
        {
          "cve": "CVE-2017-16639",
          "summary": "Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a different vulnerability than CVE-2017-16541. User interaction is required to trigger this vulnerability.",
          "cvss": 4.3,
          "affected_max": "8.0",
          "fixed_in": "8.0",
          "published": "2018-09-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2017-16639"
        },
        {
          "cve": "CVE-2018-16983",
          "summary": "NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.",
          "cvss": 9.8,
          "affected_max": "7.0.11",
          "fixed_in": null,
          "published": "2018-09-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-16983"
        }
      ]
    },
    {
      "id": "brave",
      "label": "Brave",
      "cves": [
        {
          "cve": "CVE-2023-28360",
          "summary": "An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file there was no download safety check dialog presented to the user.",
          "cvss": 4.3,
          "affected_max": "1.48.171",
          "fixed_in": "1.48.171",
          "published": "2023-05-11",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2023-28360"
        },
        {
          "cve": "CVE-2022-47932",
          "summary": "Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.",
          "cvss": 6.5,
          "affected_max": "1.42.51",
          "fixed_in": "1.42.51",
          "published": "2022-12-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-47932"
        },
        {
          "cve": "CVE-2022-47933",
          "summary": "Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFS",
          "cvss": 6.5,
          "affected_max": "1.42.51",
          "fixed_in": "1.42.51",
          "published": "2022-12-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-47933"
        },
        {
          "cve": "CVE-2022-47934",
          "summary": "Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE",
          "cvss": 6.5,
          "affected_max": "1.43.88",
          "fixed_in": "1.43.88",
          "published": "2022-12-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-47934"
        },
        {
          "cve": "CVE-2022-30334",
          "summary": "Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises \"Note that Private Windows with Tor Conne",
          "cvss": 5.3,
          "affected_max": "1.34",
          "fixed_in": "1.34",
          "published": "2022-05-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30334"
        },
        {
          "cve": "CVE-2021-45884",
          "summary": "In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings",
          "cvss": 7.5,
          "affected_max": "1.33.106",
          "fixed_in": null,
          "published": "2021-12-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-45884"
        },
        {
          "cve": "CVE-2021-22929",
          "summary": "An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2 onion domains in tor.log.",
          "cvss": 6.1,
          "affected_max": "1.28.62",
          "fixed_in": "1.28.62",
          "published": "2021-08-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-22929"
        },
        {
          "cve": "CVE-2021-22916",
          "summary": "In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy s",
          "cvss": 5.9,
          "affected_max": "1.26.60",
          "fixed_in": null,
          "published": "2021-07-12",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-22916"
        },
        {
          "cve": "CVE-2021-21323",
          "summary": "Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users w",
          "cvss": 4.3,
          "affected_max": "1.20.103",
          "fixed_in": null,
          "published": "2021-02-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-21323"
        },
        {
          "cve": "CVE-2020-8276",
          "summary": "The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an incognito window, including Tor windows. The intended behavior was to log the times",
          "cvss": 5.5,
          "affected_max": "1.18.35",
          "fixed_in": null,
          "published": "2020-11-09",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2020-8276"
        },
        {
          "cve": "CVE-2018-1000815",
          "summary": "Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript eve",
          "cvss": 4.3,
          "affected_max": "0.24.0",
          "fixed_in": null,
          "published": "2018-12-20",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000815"
        },
        {
          "cve": "CVE-2018-10798",
          "summary": "A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). The vulnerability is caused by mishandling of JavaScript code that triggers the reload of a page continuously with an interval of 1 second.",
          "cvss": 6.5,
          "affected_max": "0.14.0",
          "fixed_in": "0.14.0",
          "published": "2018-05-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-10798"
        },
        {
          "cve": "CVE-2018-10799",
          "summary": "A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux). This vulnerability is caused by the mishandling of a long URL formed by window.location+='?\\u202a\\uFEFF\\u202b'; concatenation in a SCRIPT element.",
          "cvss": 6.5,
          "affected_max": "0.14.0",
          "fixed_in": "0.14.0",
          "published": "2018-05-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-10799"
        }
      ]
    },
    {
      "id": "opera",
      "label": "Opera",
      "cves": [
        {
          "cve": "CVE-2018-18913",
          "summary": "Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attack",
          "cvss": 7.8,
          "affected_max": "57.0.3098.106",
          "fixed_in": "57.0.3098.106",
          "published": "2019-03-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-18913"
        },
        {
          "cve": "CVE-2014-0815",
          "summary": "The intent: URL implementation in Opera before 18 on Android allows attackers to read local files by leveraging an interaction error, as demonstrated by reading stored cookies.",
          "cvss": 4.3,
          "affected_max": "17.00",
          "fixed_in": null,
          "published": "2014-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2014-0815"
        },
        {
          "cve": "CVE-2014-1870",
          "summary": "Opera before 19 on Mac OS X allows user-assisted remote attackers to spoof the address bar via vectors involving a drag-and-drop operation.",
          "cvss": 4.3,
          "affected_max": "18.00",
          "fixed_in": null,
          "published": "2014-02-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2014-1870"
        },
        {
          "cve": "CVE-2013-4705",
          "summary": "Cross-site scripting (XSS) vulnerability in Opera before 15.00 allows remote attackers to inject arbitrary web script or HTML by leveraging UTF-8 encoding.",
          "cvss": 4.3,
          "affected_max": "15.00",
          "fixed_in": null,
          "published": "2013-09-13",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-4705"
        },
        {
          "cve": "CVE-2013-3211",
          "summary": "Unspecified vulnerability in Opera before 12.15 has unknown impact and attack vectors, related to a \"moderately severe issue.\"",
          "cvss": 10,
          "affected_max": "12.14",
          "fixed_in": null,
          "published": "2013-04-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-3211"
        },
        {
          "cve": "CVE-2013-3210",
          "summary": "Opera before 12.15 does not properly block top-level domains in Set-Cookie headers, which allows remote attackers to obtain sensitive information by leveraging control of a different web site in the same top-level domain.",
          "cvss": 5,
          "affected_max": "12.14",
          "fixed_in": null,
          "published": "2013-04-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-3210"
        },
        {
          "cve": "CVE-2013-1637",
          "summary": "Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events.",
          "cvss": 9.3,
          "affected_max": "12.12",
          "fixed_in": null,
          "published": "2013-02-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-1637"
        },
        {
          "cve": "CVE-2013-1638",
          "summary": "Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.",
          "cvss": 9.3,
          "affected_max": "12.12",
          "fixed_in": null,
          "published": "2013-02-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-1638"
        },
        {
          "cve": "CVE-2013-1639",
          "summary": "Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request.",
          "cvss": 6.8,
          "affected_max": "12.12",
          "fixed_in": null,
          "published": "2013-02-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-1639"
        },
        {
          "cve": "CVE-2013-1618",
          "summary": "The TLS implementation in Opera before 12.13 does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and",
          "cvss": 4,
          "affected_max": "12.12",
          "fixed_in": null,
          "published": "2013-02-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-1618"
        },
        {
          "cve": "CVE-2012-6465",
          "summary": "Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed SVG image.",
          "cvss": 9.3,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6465"
        },
        {
          "cve": "CVE-2012-6468",
          "summary": "Heap-based buffer overflow in Opera before 12.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a long HTTP response.",
          "cvss": 9.3,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6468"
        },
        {
          "cve": "CVE-2012-6470",
          "summary": "Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed image.",
          "cvss": 9.3,
          "affected_max": "12.11",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6470"
        },
        {
          "cve": "CVE-2012-6460",
          "summary": "Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger downloading and execution of arbitrary programs, via a crafted web site.",
          "cvss": 5,
          "affected_max": "11.66",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6460"
        },
        {
          "cve": "CVE-2012-6461",
          "summary": "The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers to trigger a false indication of successful revocation-status checking by causing a failure of a single checking servic",
          "cvss": 5,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6461"
        },
        {
          "cve": "CVE-2012-6462",
          "summary": "Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows remote attackers to bypass intended page-content restrictions via a crafted request.",
          "cvss": 5,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6462"
        },
        {
          "cve": "CVE-2012-6466",
          "summary": "Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtain potentially sensitive information from process memory by using a crafted image as the fill pattern for a canvas.",
          "cvss": 5,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6466"
        },
        {
          "cve": "CVE-2012-6469",
          "summary": "Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page.",
          "cvss": 5,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6469"
        },
        {
          "cve": "CVE-2012-6471",
          "summary": "Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests.",
          "cvss": 5,
          "affected_max": "12.11",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6471"
        },
        {
          "cve": "CVE-2012-6472",
          "summary": "Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitive information by reading a (1) cache file, (2) password file, or (3) configuration file, or (4) possibly gain privileges ",
          "cvss": 4.6,
          "affected_max": "12.11",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6472"
        },
        {
          "cve": "CVE-2012-6463",
          "summary": "Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data: URLs.",
          "cvss": 4.3,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6463"
        },
        {
          "cve": "CVE-2012-6464",
          "summary": "Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript code that overrides methods of unspecified native objects in documents that have different ",
          "cvss": 4.3,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6464"
        },
        {
          "cve": "CVE-2012-6467",
          "summary": "Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site, as exploited in the wild in N",
          "cvss": 4.3,
          "affected_max": "12.10",
          "fixed_in": null,
          "published": "2013-01-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-6467"
        },
        {
          "cve": "CVE-2012-4010",
          "summary": "Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660.",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2012-08-30",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-4010"
        },
        {
          "cve": "CVE-2012-4145",
          "summary": "Unspecified vulnerability in Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, has unknown impact and attack vectors, related to a \"low severity issue.\"",
          "cvss": 10,
          "affected_max": "12.00",
          "fixed_in": null,
          "published": "2012-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-4145"
        },
        {
          "cve": "CVE-2012-4143",
          "summary": "Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog, a di",
          "cvss": 6.8,
          "affected_max": "12.00",
          "fixed_in": null,
          "published": "2012-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-4143"
        },
        {
          "cve": "CVE-2012-4142",
          "summary": "Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (",
          "cvss": 4.3,
          "affected_max": "12.00",
          "fixed_in": null,
          "published": "2012-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-4142"
        },
        {
          "cve": "CVE-2012-4144",
          "summary": "Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mech",
          "cvss": 4.3,
          "affected_max": "12.00",
          "fixed_in": null,
          "published": "2012-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-4144"
        },
        {
          "cve": "CVE-2012-4146",
          "summary": "Opera before 12.01 allows remote attackers to cause a denial of service (application crash) via a crafted web site, as demonstrated by the Lenovo \"Shop now\" page.",
          "cvss": 4.3,
          "affected_max": "12.00",
          "fixed_in": null,
          "published": "2012-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-4146"
        },
        {
          "cve": "CVE-2012-3559",
          "summary": "Unspecified vulnerability in Opera before 12.00 on Mac OS X has unknown impact and attack vectors, related to a \"moderate severity issue.\"",
          "cvss": 10,
          "affected_max": "12.00",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3559"
        },
        {
          "cve": "CVE-2012-3561",
          "summary": "Opera before 11.64 does not properly allocate memory for URL strings, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted string.",
          "cvss": 10,
          "affected_max": "11.62",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3561"
        },
        {
          "cve": "CVE-2012-3556",
          "summary": "Opera before 11.65 does not properly restrict the opening of a pop-up window in response to the first click of a double-click action, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or ",
          "cvss": 9.3,
          "affected_max": "11.62",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3556"
        },
        {
          "cve": "CVE-2012-3555",
          "summary": "Opera before 11.65 does not ensure that keyboard sequences are associated with a visible window, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted ",
          "cvss": 7.6,
          "affected_max": "11.62",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3555"
        },
        {
          "cve": "CVE-2012-3557",
          "summary": "Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web site.",
          "cvss": 5,
          "affected_max": "11.62",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3557"
        },
        {
          "cve": "CVE-2012-3563",
          "summary": "Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via a web page that contains invalid character encodings.",
          "cvss": 5,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3563"
        },
        {
          "cve": "CVE-2012-3564",
          "summary": "Opera before 12.00 Beta allows remote attackers to cause a denial of service (application hang) via an absolutely positioned wrap=off TEXTAREA element located next to an \"overflow: auto\" block element.",
          "cvss": 5,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3564"
        },
        {
          "cve": "CVE-2012-3565",
          "summary": "Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted characters in domain names, as demonstrated by \"IDNA2008 tests.\"",
          "cvss": 5,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3565"
        },
        {
          "cve": "CVE-2012-3567",
          "summary": "Opera before 12.00 Beta allows remote attackers to cause a denial of service (memory consumption or application hang) via an IFRAME element that uses the src=\"#\" syntax to embed a parent document.",
          "cvss": 5,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3567"
        },
        {
          "cve": "CVE-2012-3568",
          "summary": "Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org WebGL demo.",
          "cvss": 5,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3568"
        },
        {
          "cve": "CVE-2012-3560",
          "summary": "Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote attackers to conduct spoofing attacks by detecting and preventing attempts to load a",
          "cvss": 4.3,
          "affected_max": "11.64",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3560"
        },
        {
          "cve": "CVE-2012-3562",
          "summary": "Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload, as demonstrated by a \"multiple origin camera test\" page.",
          "cvss": 4.3,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3562"
        },
        {
          "cve": "CVE-2012-3566",
          "summary": "Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application hang) via JavaScript code that changes a form before submission.",
          "cvss": 4.3,
          "affected_max": "11.65",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3566"
        },
        {
          "cve": "CVE-2012-3558",
          "summary": "Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors i",
          "cvss": 2.6,
          "affected_max": "11.64",
          "fixed_in": null,
          "published": "2012-06-14",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-3558"
        },
        {
          "cve": "CVE-2012-1251",
          "summary": "Opera before 9.63 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
          "cvss": 5.8,
          "affected_max": "9.62",
          "fixed_in": null,
          "published": "2012-06-04",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1251"
        },
        {
          "cve": "CVE-2012-1924",
          "summary": "Opera before 11.62 allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog.",
          "cvss": 6.8,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1924"
        },
        {
          "cve": "CVE-2012-1925",
          "summary": "Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloading and executing arbitrary files via a download dialog locate",
          "cvss": 6.8,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1925"
        },
        {
          "cve": "CVE-2012-1927",
          "summary": "Opera before 11.62 allows remote attackers to spoof the address field by triggering the launch of a dialog window associated with a different domain.",
          "cvss": 6.4,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1927"
        },
        {
          "cve": "CVE-2012-1928",
          "summary": "Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain.",
          "cvss": 6.4,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1928"
        },
        {
          "cve": "CVE-2012-1929",
          "summary": "Opera before 11.62 on Mac OS X allows remote attackers to spoof the address field and security dialogs via crafted styling that causes page content to be displayed outside of the intended content area.",
          "cvss": 6.4,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1929"
        },
        {
          "cve": "CVE-2012-1926",
          "summary": "Opera before 11.62 allows remote attackers to bypass the Same Origin Policy via the (1) history.pushState and (2) history.replaceState functions in conjunction with cross-domain frames, leading to unintended read access to history.state inf",
          "cvss": 5,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1926"
        },
        {
          "cve": "CVE-2012-1930",
          "summary": "Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing, which allows local users to obtain sensitive information by reading these files.",
          "cvss": 4.6,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1930"
        },
        {
          "cve": "CVE-2012-1931",
          "summary": "Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink attack on a temporary file during printing.",
          "cvss": 4.6,
          "affected_max": "11.61",
          "fixed_in": null,
          "published": "2012-03-28",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1931"
        },
        {
          "cve": "CVE-2012-1003",
          "summary": "Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2012-02-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2012-1003"
        },
        {
          "cve": "CVE-2011-4683",
          "summary": "Unspecified vulnerability in Opera before 11.60 has unknown impact and attack vectors, related to a \"moderately severe issue.\"",
          "cvss": 10,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4683"
        },
        {
          "cve": "CVE-2011-4684",
          "summary": "Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to \"corner cases.\"",
          "cvss": 10,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4684"
        },
        {
          "cve": "CVE-2011-4682",
          "summary": "The JavaScript engine in Opera before 11.60 does not properly implement the in operator, which allows remote attackers to bypass the Same Origin Policy via vectors related to variables on different web sites.",
          "cvss": 6.4,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4682"
        },
        {
          "cve": "CVE-2011-4681",
          "summary": "Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to ",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4681"
        },
        {
          "cve": "CVE-2011-4685",
          "summary": "Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4685"
        },
        {
          "cve": "CVE-2011-4686",
          "summary": "Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unknown vectors.",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4686"
        },
        {
          "cve": "CVE-2011-4687",
          "summary": "Opera before 11.60 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified content on a web page, as demonstrated by a page under the cisco.com home page.",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4687"
        },
        {
          "cve": "CVE-2011-4690",
          "summary": "Opera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache",
          "cvss": 5,
          "affected_max": "11.60",
          "fixed_in": null,
          "published": "2011-12-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-4690"
        },
        {
          "cve": "CVE-2011-3388",
          "summary": "Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the addr",
          "cvss": 4.3,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-09-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-3388"
        },
        {
          "cve": "CVE-2011-2610",
          "summary": "Unspecified vulnerability in Opera before 11.50 has unknown impact and attack vectors, related to a \"moderately severe issue.\"",
          "cvss": 10,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2610"
        },
        {
          "cve": "CVE-2011-2628",
          "summary": "Opera before 11.11 does not properly implement FRAMESET elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to page unload.",
          "cvss": 10,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2628"
        },
        {
          "cve": "CVE-2011-2612",
          "summary": "Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by progorod.ru.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2612"
        },
        {
          "cve": "CVE-2011-2613",
          "summary": "The Array.prototype.join method in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a non-array object that contains initial holes.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2613"
        },
        {
          "cve": "CVE-2011-2614",
          "summary": "The SVG implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving a path on which many characters are drawn.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2614"
        },
        {
          "cve": "CVE-2011-2615",
          "summary": "Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application hang) via unknown content on a web page, as demonstrated by domiteca.com.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2615"
        },
        {
          "cve": "CVE-2011-2616",
          "summary": "Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (memory consumption) via unknown content on a web page, as demonstrated by test262.ecmascript.org.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2616"
        },
        {
          "cve": "CVE-2011-2617",
          "summary": "Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors related to selecting a text node, and closed pop-up windows, removed pop-up windows, and IFRAME elements.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2617"
        },
        {
          "cve": "CVE-2011-2618",
          "summary": "Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via web script that moves a (1) AUDIO element or (2) VIDEO element between windows.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2618"
        },
        {
          "cve": "CVE-2011-2619",
          "summary": "Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a gradient with many stops, related to the implementation of CANVAS elements, SVG, and Cascading Style Sheets (CSS).",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2619"
        },
        {
          "cve": "CVE-2011-2620",
          "summary": "Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving SVG animation.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2620"
        },
        {
          "cve": "CVE-2011-2621",
          "summary": "Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors related to form layout.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2621"
        },
        {
          "cve": "CVE-2011-2622",
          "summary": "Unspecified vulnerability in the Web Workers implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown vectors.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2622"
        },
        {
          "cve": "CVE-2011-2623",
          "summary": "Unspecified vulnerability in the SVG BiDi implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash or hang) via unknown vectors.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2623"
        },
        {
          "cve": "CVE-2011-2625",
          "summary": "Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a SELECT element that contains many OPTION elements.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2625"
        },
        {
          "cve": "CVE-2011-2626",
          "summary": "Opera before 11.50 allows remote attackers to cause a denial of service (application crash) by using \"injected script\" to set the SRC attribute of an IFRAME element.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2626"
        },
        {
          "cve": "CVE-2011-2627",
          "summary": "Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by live.com.",
          "cvss": 5,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2627"
        },
        {
          "cve": "CVE-2011-2629",
          "summary": "Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by www.falk.de.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2629"
        },
        {
          "cve": "CVE-2011-2631",
          "summary": "The Cascading Style Sheets (CSS) implementation in Opera before 11.11 does not properly handle the column-count property, which allows remote attackers to cause a denial of service (infinite repaint loop and application hang) via a web page",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2631"
        },
        {
          "cve": "CVE-2011-2632",
          "summary": "Opera before 11.11 does not properly handle destruction of a Silverlight instance, which allows remote attackers to cause a denial of service (application crash) via a web page, as demonstrated by vod.onet.pl.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2632"
        },
        {
          "cve": "CVE-2011-2633",
          "summary": "Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via vectors involving a Certificate Revocation List (CRL) file, as demonstrated by the multicert-ca-02.crl file.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2633"
        },
        {
          "cve": "CVE-2011-2634",
          "summary": "Opera before 11.10 allows remote attackers to hijack (1) searches and (2) customizations via unspecified third party applications.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2634"
        },
        {
          "cve": "CVE-2011-2635",
          "summary": "The Cascading Style Sheets (CSS) implementation in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via vectors involving use of the :hover pseudo-class, in conjunction with transforms, for a float",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2635"
        },
        {
          "cve": "CVE-2011-2636",
          "summary": "Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by a certain Tomato Firmware page.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2636"
        },
        {
          "cve": "CVE-2011-2637",
          "summary": "Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by futura-sciences.com, seoptimise.com, and mitosyfraudes.org.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2637"
        },
        {
          "cve": "CVE-2011-2638",
          "summary": "Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by games on zylom.com.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2638"
        },
        {
          "cve": "CVE-2011-2639",
          "summary": "Opera before 11.10 does not properly handle hidden animated GIF images, which allows remote attackers to cause a denial of service (CPU consumption) via an image file that triggers continual repaints.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2639"
        },
        {
          "cve": "CVE-2011-2640",
          "summary": "Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via an HTML document that has an empty parameter value for an embedded Java applet.",
          "cvss": 5,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2640"
        },
        {
          "cve": "CVE-2011-1337",
          "summary": "Opera before 11.50 allows remote attackers to cause a denial of service (disk consumption) via invalid URLs that trigger creation of error pages.",
          "cvss": 4.3,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-1337"
        },
        {
          "cve": "CVE-2011-2609",
          "summary": "Opera before 11.50 does not properly restrict data: URIs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.",
          "cvss": 4.3,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2609"
        },
        {
          "cve": "CVE-2011-2611",
          "summary": "Unspecified vulnerability in the printing functionality in Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page.",
          "cvss": 4.3,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2611"
        },
        {
          "cve": "CVE-2011-2624",
          "summary": "Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application hang) via a large table, which is not properly handled during a print preview.",
          "cvss": 4.3,
          "affected_max": "11.50",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2624"
        },
        {
          "cve": "CVE-2011-2630",
          "summary": "Opera before 11.11 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload occurring after the opening of a popup of the Easy Sticky Note ext",
          "cvss": 4.3,
          "affected_max": "11.10",
          "fixed_in": null,
          "published": "2011-07-01",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-2630"
        },
        {
          "cve": "CVE-2011-1824",
          "summary": "The VEGAOpBitmap::AddLine function in Opera before 10.61 does not properly initialize memory during processing of the SIZE attribute of a SELECT element, which allows remote attackers to trigger an invalid memory write operation, and conseq",
          "cvss": 4.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2011-05-10",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-1824"
        },
        {
          "cve": "CVE-2011-0682",
          "summary": "Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML form with a select element that contains a large number of children.",
          "cvss": 9.3,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0682"
        },
        {
          "cve": "CVE-2011-0450",
          "summary": "The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts a",
          "cvss": 7.6,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0450"
        },
        {
          "cve": "CVE-2011-0684",
          "summary": "Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentia",
          "cvss": 5,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0684"
        },
        {
          "cve": "CVE-2011-0686",
          "summary": "Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by vkontakte.ru.",
          "cvss": 5,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0686"
        },
        {
          "cve": "CVE-2011-0681",
          "summary": "The Cascading Style Sheets (CSS) Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL.",
          "cvss": 4.3,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0681"
        },
        {
          "cve": "CVE-2011-0683",
          "summary": "Opera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.",
          "cvss": 4.3,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0683"
        },
        {
          "cve": "CVE-2011-0687",
          "summary": "Opera before 11.01 does not properly implement Wireless Application Protocol (WAP) dropdown lists, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted WAP document.",
          "cvss": 4.3,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0687"
        },
        {
          "cve": "CVE-2011-0685",
          "summary": "The Delete Private Data feature in Opera before 11.01 does not properly implement the \"Clear all email account passwords\" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation.",
          "cvss": 2.1,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2011-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-0685"
        },
        {
          "cve": "CVE-2010-4581",
          "summary": "Unspecified vulnerability in Opera before 11.00 has unknown impact and attack vectors, related to \"a high severity issue.\"",
          "cvss": 10,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4581"
        },
        {
          "cve": "CVE-2010-4586",
          "summary": "The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and remote attack vectors, possibly a related issue to CVE-2010-4508.",
          "cvss": 10,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4586"
        },
        {
          "cve": "CVE-2010-4587",
          "summary": "Opera before 11.00 on Windows does not properly implement the Insecure Third Party Module warning message, which might make it easier for user-assisted remote attackers to have an unspecified impact via a crafted module.",
          "cvss": 9.3,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4587"
        },
        {
          "cve": "CVE-2010-4579",
          "summary": "Opera before 11.00 does not properly constrain dialogs to appear on top of rendered documents, which makes it easier for remote attackers to trick users into interacting with a crafted web site that spoofs the (1) security information dialo",
          "cvss": 5,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4579"
        },
        {
          "cve": "CVE-2010-4580",
          "summary": "Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site, which allows remote attackers to obtain sensitive information via an input field that has the same name as an input field on a previously visit",
          "cvss": 5,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4580"
        },
        {
          "cve": "CVE-2010-4582",
          "summary": "Opera before 11.00 does not properly handle security policies during updates to extensions, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.",
          "cvss": 5,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4582"
        },
        {
          "cve": "CVE-2010-4585",
          "summary": "Unspecified vulnerability in the auto-update functionality in Opera before 11.00 allows remote attackers to cause a denial of service (application crash) by triggering an Opera Unite update.",
          "cvss": 5,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4585"
        },
        {
          "cve": "CVE-2010-4583",
          "summary": "Opera before 11.00, when Opera Turbo is enabled, does not display a page's security indication, which makes it easier for remote attackers to spoof trusted content via a crafted web site.",
          "cvss": 2.6,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4583"
        },
        {
          "cve": "CVE-2010-4584",
          "summary": "Opera before 11.00, when Opera Turbo is used, does not properly present information about problematic X.509 certificates on https web sites, which might make it easier for remote attackers to spoof trusted content via a crafted web site.",
          "cvss": 2.6,
          "affected_max": "11.00",
          "fixed_in": null,
          "published": "2010-12-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4584"
        },
        {
          "cve": "CVE-2010-4045",
          "summary": "Opera before 10.63 does not properly restrict web script in unspecified circumstances involving reloads and redirects, which allows remote attackers to spoof the Address Bar, conduct cross-site scripting (XSS) attacks, and possibly execute ",
          "cvss": 9.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4045"
        },
        {
          "cve": "CVE-2010-4043",
          "summary": "Opera before 10.63 does not prevent interpretation of a cross-origin document as a CSS stylesheet when the document lacks a CSS token sequence, which allows remote attackers to obtain sensitive information via a crafted document.",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4043"
        },
        {
          "cve": "CVE-2010-4044",
          "summary": "Opera before 10.63 does not ensure that the portion of a URL shown in the Address Bar contains the beginning of the URL, which allows remote attackers to spoof URLs by changing a window's size.",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4044"
        },
        {
          "cve": "CVE-2010-4046",
          "summary": "Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content.",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4046"
        },
        {
          "cve": "CVE-2010-4047",
          "summary": "Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4047"
        },
        {
          "cve": "CVE-2010-4048",
          "summary": "Opera before 10.63 allows user-assisted remote web servers to cause a denial of service (application crash) by sending a redirect during the saving of a file.",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4048"
        },
        {
          "cve": "CVE-2010-4049",
          "summary": "Opera before 10.63 allows remote attackers to cause a denial of service (application crash) via a Flash movie with a transparent Window Mode (aka wmode) property, which is not properly handled during navigation away from the containing HTML",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4049"
        },
        {
          "cve": "CVE-2010-4050",
          "summary": "Opera before 10.63 allows remote attackers to cause a denial of service (memory corruption) by referencing an SVG document in an IMG element.",
          "cvss": 4.3,
          "affected_max": "10.62",
          "fixed_in": null,
          "published": "2010-10-21",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-4050"
        },
        {
          "cve": "CVE-2010-3019",
          "summary": "Heap-based buffer overflow in Opera before 10.61 allows remote attackers to execute arbitrary code or cause a denial of service (application crash or hang) via vectors related to HTML5 canvas painting operations that occur during the applic",
          "cvss": 9.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-08-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-3019"
        },
        {
          "cve": "CVE-2010-2576",
          "summary": "Opera before 10.61 does not properly suppress clicks on download dialogs that became visible after a recent tab change, which allows remote attackers to conduct clickjacking attacks, and consequently execute arbitrary code, via vectors invo",
          "cvss": 6.8,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-08-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2576"
        },
        {
          "cve": "CVE-2010-3020",
          "summary": "The news-feed preview feature in Opera before 10.61 does not properly remove scripts, which allows remote attackers to force subscriptions to arbitrary feeds via crafted content.",
          "cvss": 5,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-08-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-3020"
        },
        {
          "cve": "CVE-2010-3021",
          "summary": "Unspecified vulnerability in Opera before 10.61 allows remote attackers to cause a denial of service (CPU consumption and application hang) via an animated PNG image.",
          "cvss": 4.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-08-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-3021"
        },
        {
          "cve": "CVE-2010-2657",
          "summary": "Opera before 10.60 on Windows and Mac OS X does not properly prevent certain double-click operations from running a program located on a web site, which allows user-assisted remote attackers to execute arbitrary code via a crafted web page ",
          "cvss": 9.3,
          "affected_max": "10.60",
          "fixed_in": "10.60",
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2657"
        },
        {
          "cve": "CVE-2010-2666",
          "summary": "Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection, which allows user-assisted remote attackers to create or modify arbitrary files, and conseque",
          "cvss": 9.3,
          "affected_max": "10.53",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2666"
        },
        {
          "cve": "CVE-2010-2658",
          "summary": "Opera before 10.60 does not properly restrict certain interaction between plug-ins, file inputs, and the clipboard, which allows user-assisted remote attackers to trigger the uploading of arbitrary files via a crafted web site.",
          "cvss": 4.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2658"
        },
        {
          "cve": "CVE-2010-2659",
          "summary": "Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains, which allows remote attackers to obtain potentially sensitive information via a crafted w",
          "cvss": 4.3,
          "affected_max": "10.50",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2659"
        },
        {
          "cve": "CVE-2010-2660",
          "summary": "Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict certain uses of homograph characters in domain names, which makes it easier for remote attackers to spoof IDN domains via unspecified",
          "cvss": 4.3,
          "affected_max": "10.53",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2660"
        },
        {
          "cve": "CVE-2010-2661",
          "summary": "Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a file selected for upload, which allows remote attackers to obtain potentially sensitive information ",
          "cvss": 4.3,
          "affected_max": "10.53",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2661"
        },
        {
          "cve": "CVE-2010-2662",
          "summary": "Opera before 10.60 allows remote attackers to bypass the popup blocker via a javascript: URL and a \"fake click.\"",
          "cvss": 4.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2662"
        },
        {
          "cve": "CVE-2010-2663",
          "summary": "Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC attribute of an AUDIO element.",
          "cvss": 4.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2663"
        },
        {
          "cve": "CVE-2010-2664",
          "summary": "Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPAN element with absolute positioning.",
          "cvss": 4.3,
          "affected_max": "10.60",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2664"
        },
        {
          "cve": "CVE-2010-2665",
          "summary": "Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of th",
          "cvss": 4.3,
          "affected_max": "10.53",
          "fixed_in": null,
          "published": "2010-07-08",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2665"
        },
        {
          "cve": "CVE-2010-2421",
          "summary": "Multiple unspecified vulnerabilities in Opera before 10.54 have unknown impact and attack vectors related to (1) \"extremely severe,\" (2) \"highly severe,\" (3) \"moderately severe,\" and (4) \"less severe\" issues.",
          "cvss": 10,
          "affected_max": "10.53",
          "fixed_in": null,
          "published": "2010-06-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-2421"
        },
        {
          "cve": "CVE-2010-1728",
          "summary": "Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via J",
          "cvss": 9.3,
          "affected_max": "10.52",
          "fixed_in": null,
          "published": "2010-05-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2010-1728"
        },
        {
          "cve": "CVE-2009-4072",
          "summary": "Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a \"moderately severe issue.\"",
          "cvss": 10,
          "affected_max": "10.10",
          "fixed_in": null,
          "published": "2009-11-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-4072"
        },
        {
          "cve": "CVE-2009-4071",
          "summary": "Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variables that can be read by a different web site, which allows remote attackers to obtain sensitive information or conduct cr",
          "cvss": 5.8,
          "affected_max": "10.10",
          "fixed_in": null,
          "published": "2009-11-24",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-4071"
        },
        {
          "cve": "CVE-2009-3831",
          "summary": "Opera before 10.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted domain name.",
          "cvss": 9.3,
          "affected_max": "10.01",
          "fixed_in": "10.01",
          "published": "2009-10-30",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3831"
        },
        {
          "cve": "CVE-2009-3832",
          "summary": "Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a crafted web site.",
          "cvss": 5.8,
          "affected_max": "10.01",
          "fixed_in": "10.01",
          "published": "2009-10-30",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3832"
        },
        {
          "cve": "CVE-2008-7245",
          "summary": "Opera 9.52 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loop, aka a \"printing DoS attack,\" possibly a related issue to CVE-2009-0821.",
          "cvss": 5,
          "affected_max": "9.52",
          "fixed_in": null,
          "published": "2009-09-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-7245"
        },
        {
          "cve": "CVE-2009-3269",
          "summary": "Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a series of automatic submissions of a form containing a KEYGEN element, a related issue to CVE-2009-1828.",
          "cvss": 5,
          "affected_max": "9.52",
          "fixed_in": null,
          "published": "2009-09-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3269"
        },
        {
          "cve": "CVE-2009-3046",
          "summary": "Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate.",
          "cvss": 7.5,
          "affected_max": "10.00",
          "fixed_in": "10.00",
          "published": "2009-09-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3046"
        },
        {
          "cve": "CVE-2009-3044",
          "summary": "Opera before 10.00 does not properly handle a (1) '\\0' character or (2) invalid wildcard character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary",
          "cvss": 5,
          "affected_max": "10.00",
          "fixed_in": null,
          "published": "2009-09-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3044"
        },
        {
          "cve": "CVE-2009-3045",
          "summary": "Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate.",
          "cvss": 5,
          "affected_max": "10.00",
          "fixed_in": null,
          "published": "2009-09-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3045"
        },
        {
          "cve": "CVE-2009-3049",
          "summary": "Opera before 10.00 does not properly display all characters in Internationalized Domain Names (IDN) in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode.",
          "cvss": 5,
          "affected_max": "10.00",
          "fixed_in": null,
          "published": "2009-09-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3049"
        },
        {
          "cve": "CVE-2009-3047",
          "summary": "Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs.",
          "cvss": 4.3,
          "affected_max": "10.00",
          "fixed_in": null,
          "published": "2009-09-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3047"
        },
        {
          "cve": "CVE-2009-3048",
          "summary": "Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the \"INPUT TYPE=file\" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a \"dropped file.\"",
          "cvss": 4.3,
          "affected_max": "10.00",
          "fixed_in": null,
          "published": "2009-09-02",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3048"
        },
        {
          "cve": "CVE-2009-3013",
          "summary": "Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting ",
          "cvss": 4.3,
          "affected_max": "9.52",
          "fixed_in": null,
          "published": "2009-08-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-3013"
        },
        {
          "cve": "CVE-2009-2577",
          "summary": "Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption, and application hang) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.",
          "cvss": 5,
          "affected_max": "9.52",
          "fixed_in": null,
          "published": "2009-07-22",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-2577"
        },
        {
          "cve": "CVE-2009-2540",
          "summary": "Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.",
          "cvss": 4.3,
          "affected_max": "9.64",
          "fixed_in": null,
          "published": "2009-07-20",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-2540"
        },
        {
          "cve": "CVE-2009-2351",
          "summary": "Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying",
          "cvss": 4.3,
          "affected_max": "9.52",
          "fixed_in": null,
          "published": "2009-07-07",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-2351"
        },
        {
          "cve": "CVE-2009-2059",
          "summary": "Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by",
          "cvss": 6.8,
          "affected_max": "9.22",
          "fixed_in": null,
          "published": "2009-06-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-2059"
        },
        {
          "cve": "CVE-2009-2063",
          "summary": "Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response t",
          "cvss": 6.8,
          "affected_max": "9.24",
          "fixed_in": null,
          "published": "2009-06-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-2063"
        },
        {
          "cve": "CVE-2009-2067",
          "summary": "Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https ifra",
          "cvss": 6.8,
          "affected_max": "9.22",
          "fixed_in": null,
          "published": "2009-06-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-2067"
        },
        {
          "cve": "CVE-2009-0916",
          "summary": "Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a \"moderately severe issue.\"",
          "cvss": 10,
          "affected_max": "9.63",
          "fixed_in": null,
          "published": "2009-03-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-0916"
        },
        {
          "cve": "CVE-2009-0914",
          "summary": "Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.",
          "cvss": 9.3,
          "affected_max": "9.63",
          "fixed_in": null,
          "published": "2009-03-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-0914"
        },
        {
          "cve": "CVE-2009-0915",
          "summary": "Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.",
          "cvss": 6.8,
          "affected_max": "9.64",
          "fixed_in": "9.64",
          "published": "2009-03-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2009-0915"
        },
        {
          "cve": "CVE-2008-5680",
          "summary": "Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area, or allow (2) user-assisted remote attackers to execute arbitrary code via a long host name in a file: URL.  N",
          "cvss": 9.3,
          "affected_max": "9.62",
          "fixed_in": null,
          "published": "2008-12-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-5680"
        },
        {
          "cve": "CVE-2008-5683",
          "summary": "Unspecified vulnerability in Opera before 9.63 allows remote attackers to \"reveal random data\" via unknown vectors.",
          "cvss": 7.8,
          "affected_max": "9.62",
          "fixed_in": null,
          "published": "2008-12-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-5683"
        },
        {
          "cve": "CVE-2008-5681",
          "summary": "Opera before 9.63 does not block unspecified \"scripted URLs\" during the feed preview, which allows remote attackers to read existing subscriptions and force subscriptions to arbitrary feed URLs.",
          "cvss": 4.3,
          "affected_max": "9.62",
          "fixed_in": null,
          "published": "2008-12-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-5681"
        },
        {
          "cve": "CVE-2008-5682",
          "summary": "Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XSLT templates.",
          "cvss": 4.3,
          "affected_max": "9.62",
          "fixed_in": null,
          "published": "2008-12-19",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-5682"
        },
        {
          "cve": "CVE-2008-4694",
          "summary": "Unspecified vulnerability in Opera before 9.60 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a redirect that specifies a crafted URL.",
          "cvss": 9.3,
          "affected_max": "9.60",
          "fixed_in": null,
          "published": "2008-10-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4694"
        },
        {
          "cve": "CVE-2008-4698",
          "summary": "Opera before 9.61 does not properly block scripts during preview of a news feed, which allows remote attackers to create arbitrary new feed subscriptions and read the contents of arbitrary feeds.",
          "cvss": 5.8,
          "affected_max": "9.60",
          "fixed_in": null,
          "published": "2008-10-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4698"
        },
        {
          "cve": "CVE-2008-4697",
          "summary": "The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains this URL, which allows remote attackers to conduct cross-sit",
          "cvss": 4.3,
          "affected_max": "9.60",
          "fixed_in": null,
          "published": "2008-10-23",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4697"
        },
        {
          "cve": "CVE-2008-4292",
          "summary": "Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors.  NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a securit",
          "cvss": 10,
          "affected_max": "9.51",
          "fixed_in": null,
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4292"
        },
        {
          "cve": "CVE-2008-4197",
          "summary": "Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitr",
          "cvss": 8.8,
          "affected_max": "9.52",
          "fixed_in": "9.52",
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4197"
        },
        {
          "cve": "CVE-2008-4200",
          "summary": "Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of a page containing web script controlled by the attacker.",
          "cvss": 6.4,
          "affected_max": "9.51",
          "fixed_in": null,
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4200"
        },
        {
          "cve": "CVE-2008-4195",
          "summary": "Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which allows remote attackers to trigger the display of an arbitrary address in a frame via unspecified u",
          "cvss": 5,
          "affected_max": "9.51",
          "fixed_in": null,
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4195"
        },
        {
          "cve": "CVE-2008-4198",
          "summary": "Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog reporting a secure connection, which might allow remote attackers to trick a user in",
          "cvss": 5,
          "affected_max": "9.51",
          "fixed_in": null,
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4198"
        },
        {
          "cve": "CVE-2008-4199",
          "summary": "Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the validity of local filenames via vectors involving \"detection of JavaScript events and",
          "cvss": 5,
          "affected_max": "9.51",
          "fixed_in": null,
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4199"
        },
        {
          "cve": "CVE-2008-4196",
          "summary": "Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
          "cvss": 4.3,
          "affected_max": "9.51",
          "fixed_in": null,
          "published": "2008-09-27",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-4196"
        },
        {
          "cve": "CVE-2008-3078",
          "summary": "Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory contents by using JavaScript to read a canvas image.",
          "cvss": 7.8,
          "affected_max": "9.50",
          "fixed_in": null,
          "published": "2008-07-09",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-3078"
        },
        {
          "cve": "CVE-2008-2716",
          "summary": "Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.",
          "cvss": 5,
          "affected_max": "9.5",
          "fixed_in": "9.5",
          "published": "2008-06-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2008-2716"
        }
      ]
    }
  ],
  "extensions": [
    {
      "id": "cjpalhdlnbpafiamejdnhcphjbkeiagm",
      "name": "uBlock Origin",
      "cves": []
    },
    {
      "id": "nngceckbapebfimnlniiiahkandclblb",
      "name": "Bitwarden Password Manager",
      "cves": []
    },
    {
      "id": "aeblfdkhhhdcdjpifhhbdiojplfjncoa",
      "name": "1Password – Password Manager",
      "cves": [
        {
          "cve": "CVE-2024-42219",
          "summary": "1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.",
          "cvss": 7.8,
          "affected_max": "8.10.36",
          "fixed_in": "8.10.36",
          "published": "2024-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-42219"
        },
        {
          "cve": "CVE-2024-42218",
          "summary": "1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.",
          "cvss": 4.7,
          "affected_max": "8.10.38",
          "fixed_in": "8.10.38",
          "published": "2024-08-06",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-42218"
        },
        {
          "cve": "CVE-2022-32550",
          "summary": "An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a",
          "cvss": 4.8,
          "affected_max": "7.9.3",
          "fixed_in": "7.9.3",
          "published": "2022-06-15",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-32550"
        },
        {
          "cve": "CVE-2022-29868",
          "summary": "1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affec",
          "cvss": 5.5,
          "affected_max": "7.9.3",
          "fixed_in": "7.9.3",
          "published": "2022-05-09",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2022-29868"
        },
        {
          "cve": "CVE-2021-41795",
          "summary": "The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable component of this extension, a malicious web page could read a subset of 1Password vau",
          "cvss": 6.5,
          "affected_max": "7.8.7",
          "fixed_in": "7.8.7",
          "published": "2021-09-29",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-41795"
        },
        {
          "cve": "CVE-2014-3753",
          "summary": "AgileBits 1Password through 1.0.9.340 allows security feature bypass",
          "cvss": 5.5,
          "affected_max": "1.0.9.340",
          "fixed_in": null,
          "published": "2020-01-09",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2014-3753"
        }
      ]
    },
    {
      "id": "hdokiejnpimakedhajhdlcegeplioahd",
      "name": "LastPass: Free Password Manager",
      "cves": [
        {
          "cve": "CVE-2013-5113",
          "summary": "LastPass prior to 2.5.1 has an insecure PIN implementation.",
          "cvss": 6.8,
          "affected_max": "2.5.1",
          "fixed_in": "2.5.1",
          "published": "2020-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-5113"
        },
        {
          "cve": "CVE-2013-5114",
          "summary": "LastPass prior to 2.5.1 allows secure wipe bypass.",
          "cvss": 6.1,
          "affected_max": "2.5.1",
          "fixed_in": "2.5.1",
          "published": "2020-01-31",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2013-5114"
        },
        {
          "cve": "CVE-2019-16371",
          "summary": "LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking.",
          "cvss": 8.2,
          "affected_max": "4.33.0",
          "fixed_in": "4.33.0",
          "published": "2019-09-16",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2019-16371"
        },
        {
          "cve": "CVE-2018-10193",
          "summary": "LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resource consumption of onloadwff.js grows with the number of INPUT elements.",
          "cvss": 7.5,
          "affected_max": "4.15.0",
          "fixed_in": null,
          "published": "2018-04-18",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2018-10193"
        }
      ]
    },
    {
      "id": "bkdgflcldnnnapblkhphbgpggdiikppg",
      "name": "DuckDuckGo Privacy Essentials",
      "cves": []
    },
    {
      "id": "pkehgijcmpdhfbdbbnkijodmdjhbjlgp",
      "name": "Privacy Badger",
      "cves": []
    },
    {
      "id": "eimadpbcbfnmbkopoojfekhnkhdbieeh",
      "name": "Dark Reader",
      "cves": [
        {
          "cve": "CVE-2026-92706",
          "summary": "Ability to request icon-like bitmaps from certain local web servers",
          "cvss": 3.4,
          "affected_max": "4.9.126",
          "fixed_in": "4.9.126",
          "published": "2026-09-18",
          "link": "https://github.com/darkreader/darkreader/security/advisories/GHSA-jh5x-rphw-x532"
        },
        {
          "cve": "CVE-2025-68467",
          "summary": "Ability to request style sheets from local web servers",
          "cvss": 3.4,
          "affected_max": "4.9.117",
          "fixed_in": "4.9.117",
          "published": "2026-03-03",
          "link": "https://github.com/darkreader/darkreader/security/advisories/GHSA-x369-mcw8-8rvj"
        }
      ]
    },
    {
      "id": "dbepggeogbaibhgnhhndojpepiihcmeb",
      "name": "Vimium",
      "cves": []
    },
    {
      "id": "kbfnbcaeplbcioakkpcpgfkobkghlhen",
      "name": "Grammarly",
      "cves": []
    }
  ]
}