Submit finding

All findings

CVE-2026-10702 + 5 more high

NebuSec publishes six accepted browser CVEs

NebuSec's fixed browser ledger maps three Firefox and three Chromium findings to public CVEs; five issue-only Chromium rows remain pending independent acceptance evidence.

Bug class
Browser memory safety, lifetime, and validation vulnerabilities
Affected codebase
Firefox and Chromium
Credited system
Nebu
Source snapshot
September 16, 2026
Coverage
Fixed browser rows visible by September 16, 2026
Attribution
Self-reported attribution
AI role
Discovery
Severity
high
Source status: Six fixed rows have public CVE records: three affect Firefox and three affect Chromium. Five more fixed Chromium tracker rows lack CVEs and were not independently verified as accepted, so they remain pending.

Summary

The Firefox subset comprises CVE-2026-10702, CVE-2026-16363, and CVE-2026-16368. The Chromium subset comprises CVE-2026-5865, CVE-2026-6307, and CVE-2026-7899.

Five additional tracker rows link Chromium issues 493534950, 493951261, 494914816, 497112471, and 503975738. The tracker marks them fixed, but the public evidence checked for this audit did not independently establish upstream acceptance for all five. They remain pending and do not affect either accepted finding or CVE totals. NebuSec supplies the AI attribution, so the six-CVE cluster remains self-reported.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.