CVE WatchJul 22, 2026

CVE-2026-45702

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the

CVSS

4.4

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jun 3, 2026 · Last modified: Jul 22, 2026 · CWE-843

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-032026-07-30

Technical description

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_CORE_SEL1_SPMC=y` and `CFG_SECURE_PARTITION=y`. Version 4.11.0 fixes the issue.

Official references

github.comhttps://github.com/OP-TEE/optee_os/security/advisories/GHSA-86pj-8xgw-66p5

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-179898.8 HIG

14.5%

——4Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)1d CVE-2026-179487.5 HIG

2.9%

——1Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)1d CVE-2026-178665.8 MED

9.9%

——3Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)1d CVE-2026-177258.8 HIG

20.2%

——6Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)1d CVE-2026-176979.6 CRI

23.8%

——7Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)1d CVE-2026-176879.6 CRI

23.8%

——7Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)1d