Brendon Tiszka

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** An information leakage issue exists where visiting a maliciously crafted website may lead to the exposure of sensitive data. This occurs due to insufficient validation. **Recommendations** Update iOS to version 18.7.9 or 26.5. Update iPadOS to version 18.7.9 or 26.5. Update macOS Sequoia to version 15.7.7. Update macOS Sonoma to version 14.8.7. Update macOS Tahoe to version 26.5. Update tvOS to version 26.5. Update visionOS to version 26.5. Update watchOS to version 26.5.

**Name of the Vulnerable Software and Affected Versions** libimagecodec.quram.so versions prior to SMR Jan-2026 Release 1 **Description** An out-of-bounds read issue exists in libimagecodec.quram.so. This allows a remote attacker to access memory outside of the intended boundaries. The issue is present in versions prior to SMR Jan-2026 Release 1. **Recommendations** Update libimagecodec.quram.so to SMR Jan-2026 Release 1 or later.

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 Safari versions prior to 18.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue was addressed with improved checks. Processing maliciously crafted web content may lead to an unexpected process crash. Recommendations: For watchOS versions prior to 11.2, update to watchOS 11.2 or later. For visionOS versions prior to 2.2, update to visionOS 2.2 or later. For tvOS versions prior to 18.2, update to tvOS 18.2 or later. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2 or later. For Safari versions prior to 18.2, update to Safari 18.2 or later. For iOS versions prior to 18.2, update to iOS 18.2 or later. For iPadOS versions prior to 18.2, update to iPadOS 18.2 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 125.0.6422.112 Description: The issue is related to a type confusion vulnerability in the V8 engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability has been actively exploited in the wild, with APT29 using it to target Android users. A Proof-of-Concept (PoC) exploit has been made public. The vulnerability is considered high severity by Chromium. Recommendations: For Google Chrome versions prior to 125.0.6422.112, update to version 125.0.6422.112 or later to fix the issue. As a temporary workaround, consider restricting access to potentially vulnerable API endpoints or disabling the use of specific features that may be exploited until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 101.0.4951.41 **Description** The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker to obtain potentially sensitive information from process memory. This can be achieved via a crafted HTML page. **Recommendations** For versions prior to 101.0.4951.41, update to version 101.0.4951.41 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially sensitive information until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 97.0.4692.99 **Description** The issue is related to an inappropriate implementation in Fenced Frames, allowing a remote attacker who has compromised the renderer process to bypass navigation restrictions via a crafted HTML page. This could potentially lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For versions prior to 97.0.4692.99, update to version 97.0.4692.99 or later to resolve the issue. As a temporary workaround, consider restricting access to Fenced Frames functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 96.0.4664.93 **Description** The issue is related to an out of bounds write in WebRTC, which can be exploited by a remote attacker using crafted WebRTC packets, potentially leading to heap corruption. This could impact the confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 96.0.4664.93, update to version 96.0.4664.93 or later to resolve the issue. As a temporary workaround, consider restricting the use of WebRTC functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 90.0.4430.85 **Description** The issue is related to a use after free in navigation, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could lead to unauthorized access to confidential information or cause a denial of service. **Recommendations** For Google Chrome versions prior to 90.0.4430.85, update to version 90.0.4430.85 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 90.0.4430.85 **Description** The issue is related to an out of bounds memory access in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may lead to unauthorized access to confidential information or cause a denial of service. The vulnerability is associated with the Array.prototype.concat implementation in V8. **Recommendations** For Google Chrome versions prior to 90.0.4430.85, update to version 90.0.4430.85 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable HTML pages until the update is applied. Avoid using the `Array.prototype.concat` function in sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 69.0.3497.81 **Description** The issue is related to a use-after-free error in the V8 JavaScript engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved through a specially crafted HTML page. The problem arises from a reentrancy issue in JavaScript handling. **Recommendations** For versions prior to 69.0.3497.81, update to version 69.0.3497.81 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious HTML pages until the update is applied.