Cross-Site Request Forgery

Every one of the 38 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equ…CVE-2013-6166Google · 1.9% likely

   CWE-352

2. Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows rem…CVE-2010-1767Google · 1.0% likely

   CWE-352

3. Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2019-5814Google · 0.9% likely

   CWE-352

4. Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.CVE-2022-3057Google · CVSS 6.5 · 0.7% likely

   CWE-352

5. Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Pyth…CVE-2011-1364Google · 0.5% likely

   CWE-352

6. Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests wi…CVE-2018-19335Google · 0.4% likely

   CWE-352

7. Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests wi…CVE-2018-19334Google · 0.3% likely

   CWE-352

8. Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests wi…CVE-2018-10099Google · 0.3% likely

   CWE-352

9. Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security seve…CVE-2026-5283Google · CVSS 6.5 · 0.3% likely

   CWE-352

10. Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severit…CVE-2026-14016Google · CVSS 6.5 · 0.2% likely

    CWE-352

11. Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data…CVE-2026-13887Google · CVSS 6.5 · 0.2% likely

    CWE-352

12. Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin…CVE-2026-13826Google · CVSS 6.5 · 0.2% likely

    CWE-352

13. Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigat…CVE-2026-17936Google · CVSS 6.5 · 0.2% likely

    CWE-352

14. Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security s…CVE-2026-2317Google · CVSS 6.5 · 0.2% likelycovered by CyberSIXT

    CWE-352

15. Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file. (Chromium security s…CVE-2026-11020Google · CVSS 6.5 · 0.2% likely

    CWE-352

16. Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…CVE-2026-87449Google · CVSS 4.3 · 0.2% likely

    CWE-352

17. Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secu…CVE-2026-13952Google · CVSS 4.3 · 0.2% likely

    CWE-352

18. Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom…CVE-2026-13946Google · CVSS 4.3 · 0.2% likely

    CWE-352

19. Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security se…CVE-2026-11265Google · CVSS 7.5 · 0.2% likely

    CWE-352

20. Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin…CVE-2026-11195Google · CVSS 6.5 · 0.2% likely

    CWE-352

21. Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy…CVE-2026-106216Google · CVSS 5.4 · 0.2% likely

    CWE-352

22. Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium securi…CVE-2026-11270Google · CVSS 6.5 · 0.2% likely

    CWE-352

23. Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security sever…CVE-2026-11106Google · CVSS 6.5 · 0.2% likely

    CWE-352

24. Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-ori…CVE-2026-13963Google · CVSS 3.1 · 0.2% likely

    CWE-352

25. Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to lea…CVE-2026-13944Google · CVSS 3.1 · 0.2% likely

    CWE-352

26. Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security sev…CVE-2026-11194Google · CVSS 6.5 · 0.2% likely

    CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.