CVE-2023-35382
Windows Kernel Elevation of Privilege Vulnerability
CVSS
7.8
High
EPSS
5.6%
p93
KEV
—
Exploit Today
28
0-100
Published: Aug 8, 2023 · Last modified: Aug 10, 2026 · CWE-416
5.6%EPSS · 30 days5.6%
2026-10-062026-11-02
Windows Kernel Elevation of Privilege Vulnerability
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-104608——
———A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.8hCVE-2026-121257——
———Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)10hCVE-2026-121250——
———Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)10hCVE-2026-1212469.6 CRI—
———Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)2hCVE-2026-1212419.6 CRI—
———Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)9hCVE-2026-1212388.8 HIG—
———Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)9h