Kinetic Potential Blog

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11. 4.10, 11.3. 19, and 10. 6.19.

An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.

Tracked as CVE-2026-108097, the flaw sits in Field UI, the core module behind the admin pages where site builders manage fields and how they display. Drupal rates it 19 out of 25 on its own risk scale, the level the project calls critical.

The advisory does not name the contributed modules that open a path to the flaw, and custom code may also expose it. Drew Webber of the Security Team and Octavio Galland are credited with reporting it.

What to Do Now The fixed release for each supported branch:

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.

Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $250,000 reward for a full Chrome exploit.

The attack is a full chain: a set of bugs used together to break every layer of Chrome's protection, from a web page all the way to the computer.

Chrome runs web page code inside two nested sandboxes, the barriers that stop a hacked page from reaching the rest of the machine. The chain crossed both. The result was code running outside Chrome on Windows, with no need for the user to click or download anything.

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.

Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $250,000 reward for a full Chrome exploit.

The attack is a full chain: a set of bugs used together to break every layer of Chrome's protection, from a web page all the way to the computer.

Chrome runs web page code inside two nested sandboxes, the barriers that stop a hacked page from reaching the rest of the machine. The chain crossed both. The result was code running outside Chrome on Windows, with no need for the user to click or download anything.