Alertas de Seguridad de la Información

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12018] Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a l…

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12019] Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowe…

Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12020] Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker…

Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12022] Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who …

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12023] Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who …

Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12008] Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attac…

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12009] Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7…

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12010] Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote att…

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12011] Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attac…

Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12012] Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileg…

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12014] Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local net…

Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12007] Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker…

Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53819] OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows …

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53810] OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extensio…

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, bypassing security scanning.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53811] OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom featu…

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authenticated accounts to match policy entries through mutable display name metadata. Attackers with the ability to change display names can receive agent access intended for another Matrix identity, potentially gaining unauthorized permissions depending on operator configuration.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53812] OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control th…

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53813] OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading wh…

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts from unintended local locations, potentially executing malicious code or accessing sensitive data.

nvdaltovulnerabilidad CVSS 7.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53814] OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent r…

OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid hook token can exploit the /hooks/agent endpoint to cause spawned CLI runtimes to access or invoke owner-only MCP tools, potentially executing privileged actions like persistent cron…

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53816] OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event…

OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway, steering target sessions into exec-event paths that expose capabilities the reduced node surface should not …

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53817] OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that al…

OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insufficient locality-derived trust validation to convert temporary shared access into persistent administrative credentials that survive token rotation.

nvdaltovulnerabilidad CVSS 8.8 NVD