Web browsers: vulnerabilities and fixes

Chrome, Firefox, Edge, Safari and the engines behind them. 718 CVEs tracked.

Web browsers has 718 tracked vulnerabilities, 152 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 715. Most recent: 2026-10-23. Highest priority: CVE-2026-85046 (score 86/100).

• CVE-2026-85046 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Google Chromium V8 Type Confusion Vulnerability
• CVE-2026-87491 HIGH 8.8 EXPLOITED UPGRADE Google Chromium V8 Out of Bounds Write Vulnerability
• CVE-2025-6424 CRITICAL 9.8 UPGRADE A use-after-free in FontFaceSet resulted in a potentially exploitable crash
• CVE-2023-4050 HIGH 7.5 UPGRADE MITIGATE In some cases, an untrusted input stream was copied to a stack buffer without checking its size
• CVE-2026-53633 CRITICAL 9.8 Vitest is a testing framework powered by Vite
• CVE-2023-29531 CRITICAL 9.8 UPGRADE UPGRADE An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption an
• CVE-2023-29542 CRITICAL 9.8 UPGRADE UPGRADE A newline in a filename could have been used to bypass the file extension security mechanisms that replace mal
• CVE-2025-49710 CRITICAL 9.8 UPGRADE An integer overflow was present in `OrderedHashTable` used by the JavaScript engine
• CVE-2026-16770 CRITICAL 9.8 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the sourc
• CVE-2023-34416 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12
• CVE-2026-16389 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions, integer overflow in the Libraries component in NSS
• CVE-2025-11708 CRITICAL 9.8 UPGRADE UPGRADE Use-after-free in MediaTrackGraphImpl::GetInstance()
• CVE-2025-11709 CRITICAL 9.8 UPGRADE UPGRADE A compromised web process was able to trigger out of bounds reads and writes in a more privileged process usin
• CVE-2025-11710 CRITICAL 9.8 UPGRADE UPGRADE A compromised web process using malicious IPC messages could have caused the privileged browser process to rev
• CVE-2026-5731 CRITICAL 9.8 DOWNGRADE DOWNGRADE Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.
• CVE-2026-5734 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 14
• CVE-2026-16353 CRITICAL 9.8 UPGRADE UPGRADE Invalid pointer in the DOM: Bindings (WebIDL) component
• CVE-2023-37202 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-37211 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12
• CVE-2026-16360 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152
• CVE-2026-16363 CRITICAL 9.8 UPGRADE UPGRADE JIT miscompilation in the JavaScript: WebAssembly component
• CVE-2026-16369 CRITICAL 9.8 UPGRADE UPGRADE Integer overflow in the JavaScript: WebAssembly component
• CVE-2026-16408 CRITICAL 9.8 UPGRADE Integer overflow in the Audio/Video: Playback component
• CVE-2026-5735 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1
• CVE-2026-113263 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-16350 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions in the Audio/Video: cubeb component
• CVE-2026-16355 CRITICAL 9.8 UPGRADE UPGRADE JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-16357 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions in the Graphics component
• CVE-2026-16367 CRITICAL 10.0 UPGRADE UPGRADE Sandbox escape due to invalid pointer in the Disability Access APIs component
• CVE-2026-43715 HIGH 8.8 UPGRADE UPGRADE A use-after-free issue was addressed with improved memory management
• CVE-2026-73032 CRITICAL 9.6 PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arb
• CVE-2023-25732 HIGH 8.8 UPGRADE UPGRADE When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded
• CVE-2023-25734 HIGH 8.1 UPGRADE UPGRADE After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a r
• CVE-2023-25735 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-25737 HIGH 8.8 UPGRADE UPGRADE An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behav
• CVE-2023-25739 HIGH 8.8 UPGRADE UPGRADE Module load requests that failed were not being checked as to whether or not they were cancelled causing a use
• CVE-2023-25743 HIGH 7.5 MITIGATE A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing bro
• CVE-2023-28162 HIGH 8.8 UPGRADE UPGRADE While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type
• CVE-2026-16351 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape due to use-after-free in the DOM: Navigation component
• CVE-2026-16352 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape due to use-after-free in the Disability Access APIs component
• CVE-2026-16356 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape due to use-after-free in the Disability Access APIs component
• CVE-2026-16368 CRITICAL 9.8 UPGRADE UPGRADE Incorrect boundary conditions in the JavaScript: WebAssembly component
• CVE-2026-16377 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the PDF Viewer component
• CVE-2026-16382 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the DOM: Service Workers component
• CVE-2026-16383 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the DOM: Networking component
• CVE-2026-16388 CRITICAL 9.8 UPGRADE UPGRADE Sandbox escape in the DOM: Networking component
• CVE-2026-66321 HIGH 7.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
• CVE-2023-32214 HIGH 7.5 UPGRADE UPGRADE Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note:
• CVE-2026-112994 HIGH 8.8 UPGRADE Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbi
• CVE-2026-113147 HIGH 8.8 UPGRADE Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pot
• CVE-2026-16395 CRITICAL 9.8 UPGRADE Integer overflow in the Audio/Video component
• CVE-2026-16402 CRITICAL 9.8 UPGRADE UPGRADE Integer overflow in the Graphics: ImageLib component
• CVE-2026-57990 HIGH 7.4 MITIGATE Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized
• CVE-2026-58596 HIGH 8.3 UPGRADE Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate pr
• CVE-2026-65802 HIGH 7.4 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
• CVE-2023-0767 HIGH 8.8 UPGRADE UPGRADE An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes v
• CVE-2026-113022 HIGH 8.8 UPGRADE Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially e
• CVE-2026-113092 HIGH 8.8 UPGRADE Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113099 HIGH 8.8 UPGRADE Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote at
• CVE-2026-16361 CRITICAL 9.8 UPGRADE UPGRADE Memory safety bugs present in Thunderbird ESR 140.12
• CVE-2026-16410 CRITICAL 9.8 UPGRADE UPGRADE JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-17655 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17687 CRITICAL 9.6 UPGRADE Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17697 CRITICAL 9.6 UPGRADE Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perfo
• CVE-2026-19149 CRITICAL 9.6 UPGRADE Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentia
• CVE-2023-23605 HIGH 8.8 UPGRADE UPGRADE Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox
• CVE-2023-25744 HIGH 8.8 UPGRADE UPGRADE Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7
• CVE-2023-25746 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox ESR 102.7
• CVE-2023-28176 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 110 and Firefox ESR 102.8
• CVE-2023-29536 HIGH 8.8 UPGRADE UPGRADE An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled me
• CVE-2023-29539 HIGH 8.8 UPGRADE UPGRADE When handling the filename directive in the Content-Disposition header, the filename would be truncated if the
• CVE-2023-29550 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 111 and Firefox ESR 102.9
• CVE-2023-32207 HIGH 8.8 UPGRADE UPGRADE A missing delay in popup notifications could have made it possible for an attacker to trick a user into granti
• CVE-2023-32213 HIGH 8.8 UPGRADE UPGRADE When reading a file, an uninitialized value could have been used as read limit
• CVE-2023-37207 MEDIUM 6.5 UPGRADE UPGRADE A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external
• CVE-2025-10533 HIGH 8.8 UPGRADE UPGRADE Integer overflow in the SVG component
• CVE-2026-112995 HIGH 8.8 UPGRADE Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbit
• CVE-2026-113009 HIGH 8.8 UPGRADE Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113014 CRITICAL 9.6 UPGRADE Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potenti
• CVE-2026-113023 CRITICAL 9.6 UPGRADE Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to p
• CVE-2026-113072 CRITICAL 9.6 UPGRADE Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially exec
• CVE-2026-113089 CRITICAL 9.6 UPGRADE Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113141 HIGH 8.8 UPGRADE Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113146 HIGH 8.8 UPGRADE Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113186 CRITICAL 9.6 UPGRADE Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arb
• CVE-2026-113189 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary
• CVE-2026-113235 CRITICAL 9.6 UPGRADE Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to po
• CVE-2026-113252 CRITICAL 9.6 UPGRADE Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote atta
• CVE-2026-113261 CRITICAL 9.6 UPGRADE Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113270 CRITICAL 9.6 UPGRADE Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbit
• CVE-2026-113283 CRITICAL 9.6 UPGRADE Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote
• CVE-2026-113300 CRITICAL 9.6 UPGRADE Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially
• CVE-2026-113328 CRITICAL 9.6 UPGRADE Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113336 CRITICAL 9.6 UPGRADE Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113342 CRITICAL 9.6 UPGRADE Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbi
• CVE-2026-16392 CRITICAL 9.1 UPGRADE UPGRADE JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2026-16407 CRITICAL 9.8 UPGRADE UPGRADE Mitigation bypass in the DOM: Service Workers component
• CVE-2026-17671 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17676 CRITICAL 9.6 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-17682 CRITICAL 9.6 UPGRADE Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise
• CVE-2026-17691 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to p
• CVE-2026-17695 CRITICAL 9.6 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17704 CRITICAL 9.6 UPGRADE Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17717 CRITICAL 9.6 UPGRADE Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially per
• CVE-2026-5732 HIGH 8.8 UPGRADE Incorrect boundary conditions, integer overflow in the Graphics: Text component
• CVE-2026-66312 MEDIUM 6.5 UPGRADE Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a netwo
• CVE-2026-76036 CRITICAL 9.6 UPGRADE Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to ex
• CVE-2023-25747 HIGH 7.5 UPGRADE A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API b
• CVE-2023-3600 HIGH 8.8 UPGRADE UPGRADE During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potenti
• CVE-2023-4049 MEDIUM 5.9 UPGRADE MITIGATE Race conditions in reference counting code were found through code inspection
• CVE-2026-112992 CRITICAL 9.6 UPGRADE Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially e
• CVE-2026-113007 CRITICAL 9.6 UPGRADE Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113056 CRITICAL 9.6 UPGRADE Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113116 CRITICAL 9.6 UPGRADE Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially ex
• CVE-2026-113118 HIGH 8.8 UPGRADE Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute a
• CVE-2026-113126 CRITICAL 9.6 UPGRADE Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113138 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to poten
• CVE-2026-113169 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att
• CVE-2026-113171 CRITICAL 9.6 UPGRADE Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker t
• CVE-2026-113211 CRITICAL 9.6 UPGRADE Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potent
• CVE-2026-113222 CRITICAL 9.6 UPGRADE Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute
• CVE-2026-113331 HIGH 8.8 UPGRADE Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially
• CVE-2026-15904 HIGH 8.8 UPGRADE Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convin
• CVE-2026-16390 CRITICAL 9.1 UPGRADE UPGRADE Mitigation bypass in the Enterprise Policies component
• CVE-2026-17675 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comprom
• CVE-2026-17701 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a r
• CVE-2026-17718 CRITICAL 9.6 UPGRADE Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perfo
• CVE-2026-17721 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially
• CVE-2026-17801 CRITICAL 9.6 UPGRADE Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to pot
• CVE-2026-17894 HIGH 8.8 UPGRADE Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentia
• CVE-2026-54730 HIGH 8.6 authentik is an open-source identity provider
• CVE-2026-66315 HIGH 7.5 UPGRADE Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netwo
• CVE-2026-76035 CRITICAL 9.6 UPGRADE Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote atta
• CVE-2026-113078 CRITICAL 9.6 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113084 CRITICAL 9.6 UPGRADE Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113163 HIGH 8.8 UPGRADE Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to exe
• CVE-2026-15764 HIGH 7.5 UPGRADE Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convin
• CVE-2026-15776 HIGH 8.8 UPGRADE Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execu
• CVE-2026-16349 CRITICAL 9.8 UPGRADE UPGRADE Same-origin policy bypass in the DOM: Navigation component
• CVE-2026-16358 CRITICAL 9.8 UPGRADE UPGRADE Site isolation issue in the Graphics: WebRender component
• CVE-2026-16364 CRITICAL 9.1 UPGRADE UPGRADE Incorrect boundary conditions in the Audio/Video: Playback component
• CVE-2026-16370 CRITICAL 9.1 UPGRADE UPGRADE Mitigation bypass in the DOM: Networking component
• CVE-2026-16375 CRITICAL 9.8 UPGRADE UPGRADE Site isolation issue in the Networking: HTTP component
• CVE-2026-16380 CRITICAL 9.1 UPGRADE UPGRADE Mitigation bypass in the Networking component
• CVE-2026-16387 CRITICAL 9.8 UPGRADE UPGRADE Site isolation issue in the Networking component
• CVE-2026-16393 CRITICAL 9.1 UPGRADE UPGRADE Incorrect boundary conditions in the Graphics: WebGPU component
• CVE-2026-16420 HIGH 8.8 UPGRADE Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbit
• CVE-2026-16421 HIGH 8.8 UPGRADE Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to
• CVE-2026-16806 HIGH 8.8 UPGRADE Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitra
• CVE-2026-17681 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.79

FAQ

How do I fix Web browsers vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Web browsers being exploited right now?

Yes: 2 Web browsers CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Web browsers CVE should I patch first?

CVE-2026-85046 currently ranks highest (86/100): Google Chromium V8 Type Confusion Vulnerability.

Software in this group

People search for: chrome, firefox, edge, safari, browser.

← Back to latest CVEs