CVE-2026-19149

CRITICAL9.6

Published 2026-08-06 · Updated 2026-08-07 · Source chrome-cve-admin@google.com

Description

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE-416

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-14365
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.
2026-08-07 · score 9.8
CVE-2026-14364
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
2026-08-07 · score 9.8
CVE-2026-70332
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
2026-08-07 · score 9.6
CVE-2026-68823
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
2026-08-07 · score 9.1
CVE-2026-65667
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
2026-08-07 · score 10.0