CVE-2026-48760
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.1
CVSS
6.1
Medio
EPSS
0.3%
p27
KEV
—
Exploit Today
8
0-100
Publicado: 14 jul 2026 · Última mod.: 15 jul 2026 · CWE-451 · CWE-1007
0.3%EPSS · 30 días0.3%
2026-08-182026-09-14
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.
- github.comhttps://github.com/symfony/symfony/commit/b21a626fd90f5c12d2db432c629eed3e780ba2f8
- github.comhttps://github.com/symfony/symfony/releases/tag/v6.4.41
- github.comhttps://github.com/symfony/symfony/releases/tag/v7.4.13
- github.comhttps://github.com/symfony/symfony/releases/tag/v8.0.13
- github.comhttps://github.com/symfony/symfony/security/advisories/GHSA-v3wm-qf9p-c549
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-87653—8.2%
——2UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)7dCVE-2026-876495.4 MED6.3%
——2UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)6dCVE-2026-87635—13.1%
——4UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)7dCVE-2026-876244.2 MED3.6%
——1UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)6dCVE-2026-875974.8 MED11.1%
——3UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app. (Chromium security severity: Low)6dCVE-2026-875835.4 MED6.1%
——2UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)6d