webview security

CVE-2026-13964 is a medium-severity Chrome vulnerability affecting Android versions before 150.0.7871.47. The public description says insufficient policy enforcement in WebView could allow a remote attacker using crafted HTML to bypass navigation restrictions after user interaction. CISA’s...

Google fixed CVE-2026-13924 in Chrome for Android 150.0.7871.47. The vulnerability involves insufficient validation of untrusted input in WebView and could allow a remote attacker who had already compromised the renderer process to use crafted HTML to bypass the same-origin policy. Organizations...

Google fixed CVE-2026-13870 in Chrome for Android 150.0.7871.47, closing a CWE-416 WebView use-after-free flaw triggered by crafted HTML. Before that release, a remote attacker could potentially execute arbitrary code inside the browser sandbox after required user interaction. Chromium rates the...

CVE-2026-11167 is a newly published Chrome-for-Android WebView vulnerability, disclosed on June 4, 2026, affecting Google Chrome versions before 149.0.7827.53 and describing a potential sandbox escape after renderer compromise through a crafted HTML page. The awkward part is not just the bug; it...

CVE-2026-11007 is a medium-severity Chrome for Android WebView vulnerability, published June 4, 2026 and modified June 8, that affected versions before 149.0.7827.53 and could let a remote attacker leak cross-origin data after compromising the renderer process. The uncomfortable part is not the...

The ZOLL ePCR iOS mobile application contains a WebView-based input‑sanitization flaw (tracked as CVE‑2025‑12699) that can be triggered by attacker‑controlled strings in patient care report (PCR) fields, allowing injected HTML/JavaScript to read local application files that may contain device...