cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 47

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 8.8CVE-2026-113214EPSS 0.4%

    Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  2. 9.6CVE-2026-113211EPSS 0.3%

    Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  3. 6.5CVE-2026-113209EPSS 0.3%

    Incorrect authorization in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  4. 8.8CVE-2026-113208EPSS 0.3%

    Information leak in ContextualSearch in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

  5. 8.8CVE-2026-113207EPSS 0.3%

    Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  6. 8.8CVE-2026-113202EPSS 0.4%

    Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  7. 6.5CVE-2026-113201EPSS 0.3%

    Information leak in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  8. 8.8CVE-2026-113198EPSS 0.4%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  9. 8.8CVE-2026-113190EPSS 0.3%

    Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  10. 8.8CVE-2026-113187EPSS 0.3%

    Missing authorization in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  11. 9.6CVE-2026-113186EPSS 0.3%

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)

  12. 8.8CVE-2026-113185EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

  13. 8.8CVE-2026-113184EPSS 0.4%

    Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

  14. 8.8CVE-2026-113183EPSS 0.4%

    Incorrect authorization in FedCM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  15. 8.8CVE-2026-113180EPSS 0.3%

    Information leak in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Low)

  16. 8.8CVE-2026-113179EPSS 0.4%

    Missing authorization in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

  17. 6.5CVE-2026-113178EPSS 0.4%

    Missing authorization in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafte…

  18. 8.8CVE-2026-113177EPSS 0.3%

    Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  19. 8.8CVE-2026-113176EPSS 0.3%

    Information leak in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

  20. 8.8CVE-2026-113174EPSS 0.4%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  21. 8.8CVE-2026-113172EPSS 0.4%

    Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  22. 8.8CVE-2026-113155EPSS 0.3%

    Missing authorization in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  23. 8.8CVE-2026-113153EPSS 0.3%

    Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  24. 8.8CVE-2026-113152EPSS 0.3%

    Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

  25. 6.5CVE-2026-113151EPSS 0.3%

    Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  26. 8.8CVE-2026-113148EPSS 0.3%

    Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  27. 8.8CVE-2026-113146EPSS 0.3%

    Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  28. 6.5CVE-2026-113144EPSS 0.3%

    Missing authorization in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  29. 6.5CVE-2026-113142EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted Chrome extension. (Chr…

  30. 6.5CVE-2026-113139EPSS 0.3%

    Incorrect authorization in Autofill in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium securit…

  31. 8.8CVE-2026-113137EPSS 0.3%

    Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

  32. 8.8CVE-2026-113132EPSS 0.4%

    Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  33. 8.8CVE-2026-113131EPSS 0.3%

    Incorrect authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  34. 8.8CVE-2026-113130EPSS 0.4%

    Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  35. 6.5CVE-2026-113129EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

  36. 8.8CVE-2026-113128EPSS 0.3%

    Information leak in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  37. 8.8CVE-2026-113127EPSS 0.4%

    Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  38. 9.6CVE-2026-113126EPSS 0.4%

    Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  39. 8.8CVE-2026-113125EPSS 0.3%

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)

  40. 6.5CVE-2026-113122EPSS 0.3%

    Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  41. 8.8CVE-2026-113118EPSS 0.3%

    Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)

  42. 9.6CVE-2026-113116EPSS 0.2%

    Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)

  43. 8.8CVE-2026-113114EPSS 0.3%

    Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  44. 8.8CVE-2026-113113EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)

  45. 8.8CVE-2026-113110EPSS 0.4%

    Missing authorization in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  46. 8.8CVE-2026-113109EPSS 0.3%

    Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

  47. 8.8CVE-2026-113107EPSS 0.4%

    Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: L…

  48. 8.8CVE-2026-113105EPSS 0.3%

    Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium…

  49. 8.8CVE-2026-113101EPSS 0.4%

    Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu…

  50. 8.8CVE-2026-113099EPSS 0.3%

    Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)