Alertas de Seguridad de la Información

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13861] Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com…

Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13846] Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who h…

Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13851] Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 15…

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.1 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13852] Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 15…

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.1 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13853] Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had…

Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13854] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w…

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13843] Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.…

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13796] Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who…

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13797] Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 all…

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13798] Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker…

Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13782] Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had …

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 10.0 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13785] Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker…

Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13789] Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp…

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13792] Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker …

Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13775] Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp…

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13776] Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com…

Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13780] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed …

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13781] Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a…

Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-58449] txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body …

txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs __import__ and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured (authentication is opt-in, so all endpoints are unauthenticated) and the index is configured writable, a rem…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-50003] A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode wr…

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

nvdcriticovulnerabilidad CVSS 9.8 NVD