Safari type confusion bug allows remote code execution
CVE-2026-86974 is scored CVSS 8.8 and requires a user to open a malicious page or file.
Stories per day · 30 days
1 RSS
17 stories, newest first · one card per story
Stories tagged #type-confusion
DBI before 1.656 crashes on profile type confusion (CVE-2026-108518)
Destroying a handle under a Profile Path containing an {attr} element confuses types in dbi_profile.
Cpanel::JSON::XS before 4.80 has 15 Perl JSON flaws
The notice describes decoded-key leakage, stack exhaustion under allow_tags, and missed duplicate non-ASCII bare keys.
Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug
Google Chrome 154 patches 32 flaws including critical ANGLE buffer overflow CVE-2026-102331 and multiple V8 type-confusion bugs; no active exploitation reported.
CVE-2026-85644: XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference
CVE-2026-85644: Perl XS::Parse::Infix 0.40 through 0.49 can treat a number as an array reference.
ZDI-26-715: Linux Mint Xreader PDF File Parsing Type Confusion Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-19772, a PDF type confusion flaw (CVSS 7.8) in Linux Mint Xreader allowing remote code execution via malicious files.
CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
Apache Airflow FAB provider 2.4.2-3.8.x password reset never deletes sessions because a string/int _user_id comparison is always false.
ZDI-26-671: Adobe Acrobat Reader DC Dialog Object Type Confusion Remote Code Execution Vulnerability
ZDI disclosed a type confusion RCE (CVE-2026-80161, CVSS 7.8) in Adobe Acrobat Reader DC requiring user interaction to exploit.
CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks
CISA added the actively exploited Chromium V8 type confusion zero-day CVE-2026-85046 to its KEV catalog, urging patching of Chrome, Edge, and Opera.
Google patches actively exploited Chrome zero-day (CVE-2026-85046)
Google patches actively exploited Chrome zero-day CVE-2026-85046, a V8 type confusion bug enabling sandboxed code execution via crafted HTML pages.
2
Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)
Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.
U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Chrome V8 type-confusion flaw CVE-2026-85046 (CVSS 8.8) to its KEV catalog; Google patched it in Chrome 152.
7
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability with evidence of active exploitation, to its KEV Catalog.
Google fixes the sixth actively exploited Chrome zero
Google patched 12 Chrome flaws including actively exploited V8 type confusion zero-day CVE-2026-85046 (CVSS 8.8), enabling sandboxed remote code execution via crafted webpages.
4
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
Google patches actively exploited Chrome V8 zero-day CVE-2026-85046 (CVSS 8.8); CISA adds it to KEV with a September 18 deadline.
2
CISA KEV: Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 (CVE-2026-85046)
CISA added actively exploited Chromium V8 type confusion CVE-2026-85046 to the KEV catalog, requiring federal mitigation by September 18.
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
Critical type-confusion flaw in isolated-vm Node.js sandbox (GHSA-864f-rcv7-6rh4) enables guest-to-host escape and potential RCE; fixed in 6.2.0 and 7.0.1.
4