CVE Daily – Use-After-Free (High+Critical) https://cvedaily.com/pages/tags/use-after-free.html CVE Daily – Use-After-Free (High+Critical) en Wed, 03 Jun 2026 21:26:28 +0000 [High] CVE-2026-40290 – OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-s... https://nvd.nist.gov/vuln/detail/CVE-2026-40290 https://nvd.nist.gov/vuln/detail/CVE-2026-40290 Wed, 03 Jun 2026 18:16:23 +0000 High CVE-2026-40290

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs,…

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-44422 – FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0... https://nvd.nist.gov/vuln/detail/CVE-2026-44422 https://nvd.nist.gov/vuln/detail/CVE-2026-44422 Fri, 29 May 2026 20:16:24 +0000 High CVE-2026-44422

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor…

CVSS: 7.5 · CWE: CWE-415

View on NVD

]]> [High] CVE-2026-9997 – Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9997 https://nvd.nist.gov/vuln/detail/CVE-2026-9997 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9997

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9995 – Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9995 https://nvd.nist.gov/vuln/detail/CVE-2026-9995 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9995

Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9994 – Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allow... https://nvd.nist.gov/vuln/detail/CVE-2026-9994 https://nvd.nist.gov/vuln/detail/CVE-2026-9994 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9994

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9993 – Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9993 https://nvd.nist.gov/vuln/detail/CVE-2026-9993 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9993

Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9992 – Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a rem... https://nvd.nist.gov/vuln/detail/CVE-2026-9992 https://nvd.nist.gov/vuln/detail/CVE-2026-9992 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9992

Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9990 – Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216... https://nvd.nist.gov/vuln/detail/CVE-2026-9990 https://nvd.nist.gov/vuln/detail/CVE-2026-9990 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9990

Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9988 – Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allow... https://nvd.nist.gov/vuln/detail/CVE-2026-9988 https://nvd.nist.gov/vuln/detail/CVE-2026-9988 Thu, 28 May 2026 23:16:57 +0000 High CVE-2026-9988

Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9984 – Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed... https://nvd.nist.gov/vuln/detail/CVE-2026-9984 https://nvd.nist.gov/vuln/detail/CVE-2026-9984 Thu, 28 May 2026 23:16:56 +0000 High CVE-2026-9984

Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9978 – Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-9978 https://nvd.nist.gov/vuln/detail/CVE-2026-9978 Thu, 28 May 2026 23:16:56 +0000 High CVE-2026-9978

Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9970 – Use after free in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9970 https://nvd.nist.gov/vuln/detail/CVE-2026-9970 Thu, 28 May 2026 23:16:55 +0000 High CVE-2026-9970

Use after free in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9964 – Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allo... https://nvd.nist.gov/vuln/detail/CVE-2026-9964 https://nvd.nist.gov/vuln/detail/CVE-2026-9964 Thu, 28 May 2026 23:16:54 +0000 High CVE-2026-9964

Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

CVSS: 8.1 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9962 – Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remo... https://nvd.nist.gov/vuln/detail/CVE-2026-9962 https://nvd.nist.gov/vuln/detail/CVE-2026-9962 Thu, 28 May 2026 23:16:54 +0000 High CVE-2026-9962

Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9961 – Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowe... https://nvd.nist.gov/vuln/detail/CVE-2026-9961 https://nvd.nist.gov/vuln/detail/CVE-2026-9961 Thu, 28 May 2026 23:16:54 +0000 High CVE-2026-9961

Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9958 – Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remo... https://nvd.nist.gov/vuln/detail/CVE-2026-9958 https://nvd.nist.gov/vuln/detail/CVE-2026-9958 Thu, 28 May 2026 23:16:54 +0000 High CVE-2026-9958

Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9957 – Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-9957 https://nvd.nist.gov/vuln/detail/CVE-2026-9957 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9957

Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9956 – Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a ... https://nvd.nist.gov/vuln/detail/CVE-2026-9956 https://nvd.nist.gov/vuln/detail/CVE-2026-9956 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9956

Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9954 – Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a re... https://nvd.nist.gov/vuln/detail/CVE-2026-9954 https://nvd.nist.gov/vuln/detail/CVE-2026-9954 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9954

Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9952 – Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a re... https://nvd.nist.gov/vuln/detail/CVE-2026-9952 https://nvd.nist.gov/vuln/detail/CVE-2026-9952 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9952

Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9951 – Use after free in UI in Google Chrome prior to 148.0.7778.216 allowed a remote a... https://nvd.nist.gov/vuln/detail/CVE-2026-9951 https://nvd.nist.gov/vuln/detail/CVE-2026-9951 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9951

Use after free in UI in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9949 – Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allow... https://nvd.nist.gov/vuln/detail/CVE-2026-9949 https://nvd.nist.gov/vuln/detail/CVE-2026-9949 Thu, 28 May 2026 23:16:53 +0000 High CVE-2026-9949

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9948 – Use after free in Views in Google Chrome on Mac prior to 148.0.7778.216 allowed ... https://nvd.nist.gov/vuln/detail/CVE-2026-9948 https://nvd.nist.gov/vuln/detail/CVE-2026-9948 Thu, 28 May 2026 23:16:52 +0000 High CVE-2026-9948

Use after free in Views in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9947 – Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-9947 https://nvd.nist.gov/vuln/detail/CVE-2026-9947 Thu, 28 May 2026 23:16:52 +0000 High CVE-2026-9947

Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9946 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9946 https://nvd.nist.gov/vuln/detail/CVE-2026-9946 Thu, 28 May 2026 23:16:52 +0000 High CVE-2026-9946

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9945 – Use after free in Media in Google Chrome on Windows prior to 148.0.7778.216 allo... https://nvd.nist.gov/vuln/detail/CVE-2026-9945 https://nvd.nist.gov/vuln/detail/CVE-2026-9945 Thu, 28 May 2026 23:16:52 +0000 High CVE-2026-9945

Use after free in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9941 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9941 https://nvd.nist.gov/vuln/detail/CVE-2026-9941 Thu, 28 May 2026 23:16:52 +0000 High CVE-2026-9941

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9937 – Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed... https://nvd.nist.gov/vuln/detail/CVE-2026-9937 https://nvd.nist.gov/vuln/detail/CVE-2026-9937 Thu, 28 May 2026 23:16:51 +0000 High CVE-2026-9937

Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9936 – Use after free in GFX in Google Chrome on Mac prior to 148.0.7778.216 allowed a ... https://nvd.nist.gov/vuln/detail/CVE-2026-9936 https://nvd.nist.gov/vuln/detail/CVE-2026-9936 Thu, 28 May 2026 23:16:51 +0000 High CVE-2026-9936

Use after free in GFX in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9934 – Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-9934 https://nvd.nist.gov/vuln/detail/CVE-2026-9934 Thu, 28 May 2026 23:16:51 +0000 High CVE-2026-9934

Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9933 – Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9933 https://nvd.nist.gov/vuln/detail/CVE-2026-9933 Thu, 28 May 2026 23:16:51 +0000 High CVE-2026-9933

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9932 – Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allo... https://nvd.nist.gov/vuln/detail/CVE-2026-9932 https://nvd.nist.gov/vuln/detail/CVE-2026-9932 Thu, 28 May 2026 23:16:51 +0000 High CVE-2026-9932

Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9931 – Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-9931 https://nvd.nist.gov/vuln/detail/CVE-2026-9931 Thu, 28 May 2026 23:16:51 +0000 High CVE-2026-9931

Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9927 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9927 https://nvd.nist.gov/vuln/detail/CVE-2026-9927 Thu, 28 May 2026 23:16:50 +0000 High CVE-2026-9927

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9925 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9925 https://nvd.nist.gov/vuln/detail/CVE-2026-9925 Thu, 28 May 2026 23:16:50 +0000 High CVE-2026-9925

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9923 – Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-9923 https://nvd.nist.gov/vuln/detail/CVE-2026-9923 Thu, 28 May 2026 23:16:50 +0000 High CVE-2026-9923

Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9922 – Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a ... https://nvd.nist.gov/vuln/detail/CVE-2026-9922 https://nvd.nist.gov/vuln/detail/CVE-2026-9922 Thu, 28 May 2026 23:16:50 +0000 High CVE-2026-9922

Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9905 – Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778... https://nvd.nist.gov/vuln/detail/CVE-2026-9905 https://nvd.nist.gov/vuln/detail/CVE-2026-9905 Thu, 28 May 2026 23:16:48 +0000 High CVE-2026-9905

Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9904 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9904 https://nvd.nist.gov/vuln/detail/CVE-2026-9904 Thu, 28 May 2026 23:16:48 +0000 High CVE-2026-9904

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9902 – Use after free in Accessibility in Google Chrome prior to 148.0.7778.216 allowed... https://nvd.nist.gov/vuln/detail/CVE-2026-9902 https://nvd.nist.gov/vuln/detail/CVE-2026-9902 Thu, 28 May 2026 23:16:48 +0000 High CVE-2026-9902

Use after free in Accessibility in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9901 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9901 https://nvd.nist.gov/vuln/detail/CVE-2026-9901 Thu, 28 May 2026 23:16:48 +0000 High CVE-2026-9901

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9899 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9899 https://nvd.nist.gov/vuln/detail/CVE-2026-9899 Thu, 28 May 2026 23:16:47 +0000 High CVE-2026-9899

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9897 – Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-9897 https://nvd.nist.gov/vuln/detail/CVE-2026-9897 Thu, 28 May 2026 23:16:47 +0000 High CVE-2026-9897

Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9894 – Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-9894 https://nvd.nist.gov/vuln/detail/CVE-2026-9894 Thu, 28 May 2026 23:16:47 +0000 High CVE-2026-9894

Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9893 – Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-9893 https://nvd.nist.gov/vuln/detail/CVE-2026-9893 Thu, 28 May 2026 23:16:47 +0000 High CVE-2026-9893

Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-9891 – Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a ... https://nvd.nist.gov/vuln/detail/CVE-2026-9891 https://nvd.nist.gov/vuln/detail/CVE-2026-9891 Thu, 28 May 2026 23:16:47 +0000 Critical CVE-2026-9891

Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)

CVSS: 9.0 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9890 – Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed... https://nvd.nist.gov/vuln/detail/CVE-2026-9890 https://nvd.nist.gov/vuln/detail/CVE-2026-9890 Thu, 28 May 2026 23:16:46 +0000 High CVE-2026-9890

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9888 – Use after free in WebView in Google Chrome on Android prior to 148.0.7778.216 al... https://nvd.nist.gov/vuln/detail/CVE-2026-9888 https://nvd.nist.gov/vuln/detail/CVE-2026-9888 Thu, 28 May 2026 23:16:46 +0000 High CVE-2026-9888

Use after free in WebView in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9887 – Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9887 https://nvd.nist.gov/vuln/detail/CVE-2026-9887 Thu, 28 May 2026 23:16:46 +0000 High CVE-2026-9887

Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC script. (Chromium security severity: Critical)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-9886 – Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a... https://nvd.nist.gov/vuln/detail/CVE-2026-9886 https://nvd.nist.gov/vuln/detail/CVE-2026-9886 Thu, 28 May 2026 23:16:46 +0000 Critical CVE-2026-9886

Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 9.6 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9884 – Use after free in Browser in Google Chrome on Mac prior to 148.0.7778.216 allowe... https://nvd.nist.gov/vuln/detail/CVE-2026-9884 https://nvd.nist.gov/vuln/detail/CVE-2026-9884 Thu, 28 May 2026 23:16:46 +0000 High CVE-2026-9884

Use after free in Browser in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9883 – Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-9883 https://nvd.nist.gov/vuln/detail/CVE-2026-9883 Thu, 28 May 2026 23:16:46 +0000 High CVE-2026-9883

Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-9881 – Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allo... https://nvd.nist.gov/vuln/detail/CVE-2026-9881 https://nvd.nist.gov/vuln/detail/CVE-2026-9881 Thu, 28 May 2026 23:16:46 +0000 Critical CVE-2026-9881

Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)

CVSS: 9.0 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9878 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9878 https://nvd.nist.gov/vuln/detail/CVE-2026-9878 Thu, 28 May 2026 23:16:45 +0000 High CVE-2026-9878

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9877 – Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-9877 https://nvd.nist.gov/vuln/detail/CVE-2026-9877 Thu, 28 May 2026 23:16:45 +0000 High CVE-2026-9877

Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-9876 – Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allo... https://nvd.nist.gov/vuln/detail/CVE-2026-9876 https://nvd.nist.gov/vuln/detail/CVE-2026-9876 Thu, 28 May 2026 23:16:45 +0000 Critical CVE-2026-9876

Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 9.6 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-9874 – Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-9874 https://nvd.nist.gov/vuln/detail/CVE-2026-9874 Thu, 28 May 2026 23:16:45 +0000 Critical CVE-2026-9874

Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 9.6 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9873 – Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a rem... https://nvd.nist.gov/vuln/detail/CVE-2026-9873 https://nvd.nist.gov/vuln/detail/CVE-2026-9873 Thu, 28 May 2026 23:16:45 +0000 High CVE-2026-9873

Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10016 – Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-10016 https://nvd.nist.gov/vuln/detail/CVE-2026-10016 Thu, 28 May 2026 23:16:43 +0000 High CVE-2026-10016

Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10014 – Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 al... https://nvd.nist.gov/vuln/detail/CVE-2026-10014 https://nvd.nist.gov/vuln/detail/CVE-2026-10014 Thu, 28 May 2026 23:16:43 +0000 High CVE-2026-10014

Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10013 – Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a r... https://nvd.nist.gov/vuln/detail/CVE-2026-10013 https://nvd.nist.gov/vuln/detail/CVE-2026-10013 Thu, 28 May 2026 23:16:43 +0000 High CVE-2026-10013

Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10012 – Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote... https://nvd.nist.gov/vuln/detail/CVE-2026-10012 https://nvd.nist.gov/vuln/detail/CVE-2026-10012 Thu, 28 May 2026 23:16:43 +0000 High CVE-2026-10012

Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10007 – Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote ... https://nvd.nist.gov/vuln/detail/CVE-2026-10007 https://nvd.nist.gov/vuln/detail/CVE-2026-10007 Thu, 28 May 2026 23:16:42 +0000 High CVE-2026-10007

Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10005 – Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216... https://nvd.nist.gov/vuln/detail/CVE-2026-10005 https://nvd.nist.gov/vuln/detail/CVE-2026-10005 Thu, 28 May 2026 23:16:42 +0000 High CVE-2026-10005

Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10003 – Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remot... https://nvd.nist.gov/vuln/detail/CVE-2026-10003 https://nvd.nist.gov/vuln/detail/CVE-2026-10003 Thu, 28 May 2026 23:16:42 +0000 High CVE-2026-10003

Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10002 – Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remo... https://nvd.nist.gov/vuln/detail/CVE-2026-10002 https://nvd.nist.gov/vuln/detail/CVE-2026-10002 Thu, 28 May 2026 23:16:41 +0000 High CVE-2026-10002

Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10001 – Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 al... https://nvd.nist.gov/vuln/detail/CVE-2026-10001 https://nvd.nist.gov/vuln/detail/CVE-2026-10001 Thu, 28 May 2026 23:16:41 +0000 High CVE-2026-10001

Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-10000 – Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 ... https://nvd.nist.gov/vuln/detail/CVE-2026-10000 https://nvd.nist.gov/vuln/detail/CVE-2026-10000 Thu, 28 May 2026 23:16:40 +0000 High CVE-2026-10000

Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-47331 – Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock wh... https://nvd.nist.gov/vuln/detail/CVE-2026-47331 https://nvd.nist.gov/vuln/detail/CVE-2026-47331 Thu, 28 May 2026 19:16:41 +0000 High CVE-2026-47331

Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code execution.

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-46240 – In the Linux kernel, the following vulnerability has been resolved: media: iris... https://nvd.nist.gov/vuln/detail/CVE-2026-46240 https://nvd.nist.gov/vuln/detail/CVE-2026-46240 Thu, 28 May 2026 10:16:39 +0000 High CVE-2026-46240

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_internal_buffers() The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases") introduced a regression where session_release_buf() may free the buffer. The caller, iris_release_internal_buffers(), continued to access `buffer` after th…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46227 – In the Linux kernel, the following vulnerability has been resolved: sctp: reval... https://nvd.nist.gov/vuln/detail/CVE-2026-46227 https://nvd.nist.gov/vuln/detail/CVE-2026-46227 Thu, 28 May 2026 10:16:38 +0000 High CVE-2026-46227

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf()…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46215 – In the Linux kernel, the following vulnerability has been resolved: drm: Set ol... https://nvd.nist.gov/vuln/detail/CVE-2026-46215 https://nvd.nist.gov/vuln/detail/CVE-2026-46215 Thu, 28 May 2026 10:16:37 +0000 High CVE-2026-46215

In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be derefere…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46212 – In the Linux kernel, the following vulnerability has been resolved: batman-adv:... https://nvd.nist.gov/vuln/detail/CVE-2026-46212 https://nvd.nist.gov/vuln/detail/CVE-2026-46212 Thu, 28 May 2026 10:16:36 +0000 High CVE-2026-46212

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: prevent use-after-free when deleting claims When batadv_bla_del_backbone_claims() removes all claims for a backbone, it does this by dropping the link entry in the hash list. This list entry itself was one of the references which need to be dropped at the same time via batadv_claim_put(). But the batadv_claim_…

CVSS: 8.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46210 – In the Linux kernel, the following vulnerability has been resolved: media: iris... https://nvd.nist.gov/vuln/detail/CVE-2026-46210 https://nvd.nist.gov/vuln/detail/CVE-2026-46210 Thu, 28 May 2026 10:16:36 +0000 High CVE-2026-46210

In the Linux kernel, the following vulnerability has been resolved: media: iris: fix use-after-free of fmt_src during MBPF check During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internal…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46173 – In the Linux kernel, the following vulnerability has been resolved: exit: preve... https://nvd.nist.gov/vuln/detail/CVE-2026-46173 https://nvd.nist.gov/vuln/detail/CVE-2026-46173 Thu, 28 May 2026 10:16:32 +0000 High CVE-2026-46173

In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNING: must be called with preemption disabled!". If an oopsing task is preempted…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46166 – In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... https://nvd.nist.gov/vuln/detail/CVE-2026-46166 https://nvd.nist.gov/vuln/detail/CVE-2026-46166 Thu, 28 May 2026 10:16:32 +0000 High CVE-2026-46166

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.

CVSS: 8.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46125 – In the Linux kernel, the following vulnerability has been resolved: wifi: mac80... https://nvd.nist.gov/vuln/detail/CVE-2026-46125 https://nvd.nist.gov/vuln/detail/CVE-2026-46125 Thu, 28 May 2026 10:16:28 +0000 High CVE-2026-46125

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing station. Any "new_sta" is already being removed, s…

CVSS: 8.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46120 – In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Us... https://nvd.nist.gov/vuln/detail/CVE-2026-46120 https://nvd.nist.gov/vuln/detail/CVE-2026-46120 Thu, 28 May 2026 10:16:27 +0000 High CVE-2026-46120

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46116 – In the Linux kernel, the following vulnerability has been resolved: xfrm: defen... https://nvd.nist.gov/vuln/detail/CVE-2026-46116 https://nvd.nist.gov/vuln/detail/CVE-2026-46116 Thu, 28 May 2026 10:16:27 +0000 High CVE-2026-46116

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluste…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46113 – In the Linux kernel, the following vulnerability has been resolved: KVM: x86: F... https://nvd.nist.gov/vuln/detail/CVE-2026-46113 https://nvd.nist.gov/vuln/detail/CVE-2026-46113 Thu, 28 May 2026 10:16:26 +0000 High CVE-2026-46113

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest page tables are modified between VM entries (similar to commit aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE…

CVSS: 8.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46111 – In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... https://nvd.nist.gov/vuln/detail/CVE-2026-46111 https://nvd.nist.gov/vuln/detail/CVE-2026-46111 Thu, 28 May 2026 10:16:26 +0000 High CVE-2026-46111

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching the pattern used b…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46099 – In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ... https://nvd.nist.gov/vuln/detail/CVE-2026-46099 https://nvd.nist.gov/vuln/detail/CVE-2026-46099 Wed, 27 May 2026 14:17:31 +0000 High CVE-2026-46099

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() unconditionally. On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can release the underlying pcpu_rt between…

CVSS: 8.1 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46058 – In the Linux kernel, the following vulnerability has been resolved: media: amph... https://nvd.nist.gov/vuln/detail/CVE-2026-46058 https://nvd.nist.gov/vuln/detail/CVE-2026-46058 Wed, 27 May 2026 14:17:25 +0000 High CVE-2026-46058

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m job_abort and device_run Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_try_run(): v4l2_m2m_ctx_release(): lock/unlock…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46036 – In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: S... https://nvd.nist.gov/vuln/detail/CVE-2026-46036 https://nvd.nist.gov/vuln/detail/CVE-2026-46036 Wed, 27 May 2026 14:17:22 +0000 High CVE-2026-46036

In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the vdev->cdx_irqs array based on its value, but provides no serialization against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race such that one observes config_msi as set while anothe…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-46011 – In the Linux kernel, the following vulnerability has been resolved: media: mtk-... https://nvd.nist.gov/vuln/detail/CVE-2026-46011 https://nvd.nist.gov/vuln/detail/CVE-2026-46011 Wed, 27 May 2026 14:17:19 +0000 High CVE-2026-46011

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: fix use-after-free in release path due to uncancelled work The mtk_jpeg_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->jpeg_work. This creates a race window where the workqueue callback may still be accessing the context memory after it has been…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45984 – In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix u... https://nvd.nist.gov/vuln/detail/CVE-2026-45984 https://nvd.nist.gov/vuln/detail/CVE-2026-45984 Wed, 27 May 2026 14:17:15 +0000 High CVE-2026-45984

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area.…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45980 – In the Linux kernel, the following vulnerability has been resolved: accel/amdxd... https://nvd.nist.gov/vuln/detail/CVE-2026-45980 https://nvd.nist.gov/vuln/detail/CVE-2026-45980 Wed, 27 May 2026 14:17:15 +0000 High CVE-2026-45980

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Stop job scheduling across aie2_release_resource() Running jobs on a hardware context while it is in the process of releasing resources can lead to use-after-free and crashes. Fix this by stopping job scheduling before calling aie2_release_resource() and restarting it after the release completes. Additionally, a…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45970 – In the Linux kernel, the following vulnerability has been resolved: bonding: al... https://nvd.nist.gov/vuln/detail/CVE-2026-45970 https://nvd.nist.gov/vuln/detail/CVE-2026-45970 Wed, 27 May 2026 14:17:13 +0000 High CVE-2026-45970

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN. However, the root cause is that rlb…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45951 – In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a ... https://nvd.nist.gov/vuln/detail/CVE-2026-45951 https://nvd.nist.gov/vuln/detail/CVE-2026-45951 Wed, 27 May 2026 14:17:11 +0000 High CVE-2026-45951

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free of BTF object Refcounting in the check_pseudo_btf_id() function is incorrect: the __check_pseudo_btf_id() function might get called with a zero refcounted btf. Fix this, and patch related code accordingly. v3: rephrase a comment (AI) v2: fix a refcount leak introduced in v1 (AI)

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45929 – In the Linux kernel, the following vulnerability has been resolved: ovpn: fix p... https://nvd.nist.gov/vuln/detail/CVE-2026-45929 https://nvd.nist.gov/vuln/detail/CVE-2026-45929 Wed, 27 May 2026 14:17:08 +0000 High CVE-2026-45929

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix possible use-after-free in ovpn_net_xmit When building the skb_list in ovpn_net_xmit, skb_share_check will free the original skb if it is shared. The current implementation continues to use the stale skb pointer for subsequent operations: - peer lookup, - skb_dst_drop (even though all segments produced by skb_gso_segm…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45910 – In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: F... https://nvd.nist.gov/vuln/detail/CVE-2026-45910 https://nvd.nist.gov/vuln/detail/CVE-2026-45910 Wed, 27 May 2026 14:17:05 +0000 High CVE-2026-45910

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45861 – In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix s... https://nvd.nist.gov/vuln/detail/CVE-2026-45861 https://nvd.nist.gov/vuln/detail/CVE-2026-45861 Wed, 27 May 2026 14:16:58 +0000 High CVE-2026-45861

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-fr…

CVSS: 7.8 · CWE: N/A

View on NVD

]]> [High] CVE-2026-24200 – NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where ... https://nvd.nist.gov/vuln/detail/CVE-2026-24200 https://nvd.nist.gov/vuln/detail/CVE-2026-24200 Tue, 26 May 2026 18:16:39 +0000 High CVE-2026-24200

NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause a use-after-free for stack memory. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

CVSS: 7.0 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-24187 – NVIDIA Display Driver for Linux contains a vulnerability where an attacker could... https://nvd.nist.gov/vuln/detail/CVE-2026-24187 https://nvd.nist.gov/vuln/detail/CVE-2026-24187 Tue, 26 May 2026 18:16:37 +0000 High CVE-2026-24187

NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-46727 – An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a us... https://nvd.nist.gov/vuln/detail/CVE-2026-46727 https://nvd.nist.gov/vuln/detail/CVE-2026-46727 Fri, 22 May 2026 18:16:22 +0000 High CVE-2026-46727

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-bas…

CVSS: 8.1 · CWE: CWE-362

View on NVD

]]> [High] CVE-2026-43497 – In the Linux kernel, the following vulnerability has been resolved: fbdev: udlf... https://nvd.nist.gov/vuln/detail/CVE-2026-43497 https://nvd.nist.gov/vuln/detail/CVE-2026-43497 Thu, 21 May 2026 13:16:19 +0000 High CVE-2026-43497

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mm…

CVSS: 7.3 · CWE: N/A

View on NVD

]]> [High] CVE-2026-45251 – A file descriptor can be closed while a thread is blocked in a poll(2) or select... https://nvd.nist.gov/vuln/detail/CVE-2026-45251 https://nvd.nist.gov/vuln/detail/CVE-2026-45251 Thu, 21 May 2026 10:16:26 +0000 High CVE-2026-45251

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the obj…

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9126 – Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remo... https://nvd.nist.gov/vuln/detail/CVE-2026-9126 https://nvd.nist.gov/vuln/detail/CVE-2026-9126 Wed, 20 May 2026 20:16:45 +0000 High CVE-2026-9126

Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9120 – Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remo... https://nvd.nist.gov/vuln/detail/CVE-2026-9120 https://nvd.nist.gov/vuln/detail/CVE-2026-9120 Wed, 20 May 2026 20:16:43 +0000 High CVE-2026-9120

Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-9118 – Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed... https://nvd.nist.gov/vuln/detail/CVE-2026-9118 https://nvd.nist.gov/vuln/detail/CVE-2026-9118 Wed, 20 May 2026 20:16:43 +0000 High CVE-2026-9118

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVSS: 8.8 · CWE: CWE-416

View on NVD

]]>