CVE-2026-79055
Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to
CVSS
5.1
Medium
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Published: Aug 25, 2026 · Last modified: Aug 26, 2026 · CWE-200
0.1%EPSS · 30 days0.1%
2026-10-042026-11-01
Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-136475.8 MED—
——0The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.
Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.2hCVE-2026-1011786.6 MED—
——0Permission control vulnerability in the autofill service module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.4hCVE-2026-1011815.5 MED—
——0Permission control vulnerability in the WLAN module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.5hCVE-2026-1203103.1 LOW—
——0Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.9hCVE-2026-1203234.3 MED—
——0A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.10hCVE-2026-1202335.3 MED—
——0A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.20h