CVE-2026-0248

Prisma Access Agent: Improper Certificate Validation Vulnerability

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google Palo Alto Networks Paloaltonetworks

Products

Android Chrome Os Prisma Access and 2 more

CVE-2024-50302

HID: core: zero-initialize the report buffer

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Listed

Vendors

Debian Google Linux and 2 more

Products

Debian Linux Android Linux Kernel and 39 more

CVE-2025-71255

Improper Input Validation Leads to Remote Denial of Service in Unisoc Modem IMS

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Unisoc

Products

Android Sc7731e Sc9832e and 14 more

CVE-2025-71254

Modem IMS Input Validation Flaw Causes Remote Denial of Service

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Unisoc

Products

Android Sc7731e Sc9832e and 14 more

CVE-2025-71251

Unisoc IMS Input Validation Vulnerability Leading to Remote Denial of Service

In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Unisoc

Products

Android Sc7731e Sc9832e and 14 more

CVE-2025-71253

Improper Input Validation in Unisoc Modem IMS Enables Remote Denial of Service

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Unisoc

Products

Android Sc7731e Sc9832e and 14 more

CVE-2025-71256

Remote Denial of Service via Improper Modem Input Validation

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Unisoc

Products

Android T8100 T8200 and 2 more

CVE-2025-71252

Improper Input Validation in Unisoc Modem IMS Enables Remote Denial of Service

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google Unisoc

Products

Android Sc7731e Sc9832e and 14 more

CVE-2026-7915

chromium-browser: Insufficient data validation in DevTools

Insufficient data validation in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-8020

chromium-browser: Uninitialized Use in GPU

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7913

chromium-browser: Insufficient policy enforcement in DevTools

Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7905

chromium-browser: Insufficient validation of untrusted input in Media

Insufficient validation of untrusted input in Media in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7941

chromium-browser: Insufficient validation of untrusted input in Mobile

Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7993

chromium-browser: Insufficient validation of untrusted input in Payments

Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-7912

chromium-browser: Integer overflow in GPU

Integer overflow in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2025-50053

WordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin <= 0.8.8.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Google Nebelhorn Wordpress

Products

Android Blappsta Mobile App Plugin Wordpress

CVE-2026-6920

Google Chrome: Chromium: chromium-browser: Out of bounds read in GPU

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google Linux Microsoft

Products

Android Chrome Linux Kernel and 1 more

CVE-2026-6921

Google Chrome: Chromium: chromium-browser: Race in GPU

Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google Linux Microsoft

Products

Android Chrome Linux Kernel and 1 more

CVE-2025-43201

Apple Music Classical Android May Leak Credentials

This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's credentials.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Apple Music Music Music Classical and 1 more

CVE-2026-6919

Google Chrome: Chromium: chromium-browser: Use after free in DevTools

Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google Linux Microsoft

Products

Android Chrome Linux Kernel and 1 more