{"metadata": {"vulnerability": "CVE-2026-9111", "count": 59, "kinds": {"milestone": 14, "sighting": 5, "kev": 0, "other": 40}}, "data": [{"timestamp": "2026-05-15T00:00:00Z", "date_only": true, "value": "2026-05-15", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0633", "record": "CERTFR-2026-AVI-0633", "field": "vendor_advisories.3.published_at", "linked_record": true}, {"timestamp": "2026-05-19T00:00:00Z", "date_only": true, "value": "2026-05-19", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-9111", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9111", "record": "FKIE_CVE-2026-9111", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-05-20T17:39:14.333Z", "date_only": false, "value": "2026-05-20T17:39:14.333Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-9111", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-20T19:12:39.869Z", "date_only": false, "value": "2026-05-20T19:12:39.869Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-9111", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-20T19:12:39.869Z", "date_only": false, "value": "2026-05-20T19:12:39.869Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Chrome", "record": "CVE-2026-9111", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-20T20:03:36.284Z", "date_only": false, "value": "2026-05-20T20:03:36.284724Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/116608690801419755", "record": "CVE-2026-9111", "field": "creation_timestamp", "uuid": "58f7332f-fcd9-480f-8068-7cf80af33914", "content": "A new vulnerability with increased severity was disclosed for Google Chrome (CVE-2026-9111) https://vuldb.com/vuln/364917", "url": "https://infosec.exchange/users/vuldb/statuses/116608690801419755"}, {"timestamp": "2026-05-20T20:16:41Z", "date_only": false, "value": "2026-05-20T20:16:41Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6R32-H5RG-9M59", "record": "GHSA-6R32-H5RG-9M59", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-05-20T20:16:41.870Z", "date_only": false, "value": "2026-05-20T20:16:41.870", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9111", "record": "FKIE_CVE-2026-9111", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-20T21:31:32Z", "date_only": false, "value": "2026-05-20T21:31:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6R32-H5RG-9M59", "record": "GHSA-6R32-H5RG-9M59", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-20T21:31:32Z", "date_only": false, "value": "2026-05-20T21:31:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6R32-H5RG-9M59", "record": "GHSA-6R32-H5RG-9M59", "field": "modified", "linked_record": true}, {"timestamp": "2026-05-20T22:00:00Z", "date_only": false, "value": "2026-05-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-05-20T22:00:00Z", "date_only": false, "value": "2026-05-20T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-20T22:00:00Z", "date_only": false, "value": "2026-05-20T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "vulnerabilities.1.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-21T00:00:00Z", "date_only": false, "value": "2026-05-21T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-05-21T00:00:00Z", "date_only": true, "value": "2026-05-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0633", "record": "CERTFR-2026-AVI-0633", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-05-21T00:00:00Z", "date_only": false, "value": "2026-05-21T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "revisions.1.revision_date", "linked_record": true}, {"timestamp": "2026-05-21T03:55:44.097Z", "date_only": false, "value": "2026-05-21T03:55:44.097Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-9111", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-21T03:55:44.097Z", "date_only": false, "value": "2026-05-21T03:55:44.097Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-9111", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-21T22:00:00Z", "date_only": false, "value": "2026-05-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0633", "record": "CERTFR-2026-AVI-0633", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0633", "record": "CERTFR-2026-AVI-0633", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-05-22T00:00:00Z", "date_only": false, "value": "2026-05-22T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0633", "record": "CERTFR-2026-AVI-0633", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-05-25T18:00:00Z", "date_only": false, "value": "2026-05-25T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260526", "record": "CVE-2026-9111", "field": "creation_timestamp", "uuid": "4eeb3f55-74db-4a32-be1f-e1d3293a1ae0", "url": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260526"}, {"timestamp": "2026-05-25T22:00:00Z", "date_only": false, "value": "2026-05-25T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-05-25T22:00:00Z", "date_only": false, "value": "2026-05-25T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-05-26T12:17:35.569Z", "date_only": false, "value": "2026-05-26T12:17:35.569+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1623", "record": "WID-SEC-W-2026-1623", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-05-26T18:00:00Z", "date_only": false, "value": "2026-05-26T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260527", "record": "CVE-2026-9111", "field": "creation_timestamp", "uuid": "8b7b7151-6604-4e42-8dd9-f17d12d43d13", "url": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260527"}, {"timestamp": "2026-06-04T11:01:37.082Z", "date_only": false, "value": "2026-06-04T11:01:37.082832Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mnhhvwe37m2o", "record": "CVE-2026-9111", "field": "creation_timestamp", "uuid": "e14a2ee3-fcd9-426f-a6c0-fbd198d548ea", "content": "CVE-2026-9111 Google Chrome Linux\u7248 148.0.7778.179\u4ee5\u524d\u306e\u8106\u5f31\u6027\u3092\u308f\u304b\u308a\u3084\u3059\u304f\u89e3\u8aac\uff5c\u5f71\u97ff\u7bc4\u56f2\u3068\u5bfe\u7b56\u307e\u3068\u3081\n\nCVE-2026-9111 Google Chrome\u306eLinux\u7248\u306b\u304a\u3051\u308bWebRTC\u306eUse after free\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u304c\u7279\u5225\u306b\u4f5c\u6210\u3055\u308c\u305fHTML\u30da\u30fc\u30b8\u3092\u4ecb\u3057\u3066\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002", "url": "https://bsky.app/profile/keiwork35.bsky.social/post/3mnhhvwe37m2o"}, {"timestamp": "2026-06-10T00:00:00Z", "date_only": true, "value": "2026-06-10", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0734", "record": "CERTFR-2026-AVI-0734", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-06-11T00:00:00Z", "date_only": false, "value": "2026-06-11T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0734", "record": "CERTFR-2026-AVI-0734", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-06-11T00:00:00Z", "date_only": false, "value": "2026-06-11T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0734", "record": "CERTFR-2026-AVI-0734", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-11T00:00:00Z", "date_only": false, "value": "2026-06-11T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0734", "record": "CERTFR-2026-AVI-0734", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-07-20T20:10:00.110Z", "date_only": false, "value": "2026-07-20T20:10:00.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9111", "record": "FKIE_CVE-2026-9111", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-08-31T08:40:44Z", "date_only": false, "value": "2026-08-31T08:40:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-08-31T08:40:44Z", "date_only": false, "value": "2026-08-31T08:40:44Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-08-31T08:40:44Z", "date_only": false, "value": "2026-08-31T08:40:44Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2026-08-31T08:40:44Z", "date_only": false, "value": "2026-08-31T08:40:44Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-16T20:11:40Z", "date_only": false, "value": "2026-09-16T20:11:40Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-16T20:35:59Z", "date_only": false, "value": "2026-09-16T20:35:59Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-16T21:12:31Z", "date_only": false, "value": "2026-09-16T21:12:31Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-09-16T21:38:57Z", "date_only": false, "value": "2026-09-16T21:38:57Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-09-17T17:06:14Z", "date_only": false, "value": "2026-09-17T17:06:14Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-09-17T17:06:14Z", "date_only": false, "value": "2026-09-17T17:06:14Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:10841-1", "record": "OPENSUSE-SU-2026:10841-1", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-09-17T17:33:39Z", "date_only": false, "value": "2026-09-17T17:33:39Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-10-08T18:02:42Z", "date_only": false, "value": "2026-10-08T18:02:42Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2026-10-09T09:51:09Z", "date_only": false, "value": "2026-10-09T09:51:09Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.5.date", "linked_record": true}, {"timestamp": "2026-10-10T08:44:54Z", "date_only": false, "value": "2026-10-10T08:44:54Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.6.date", "linked_record": true}, {"timestamp": "2026-10-10T16:06:14Z", "date_only": false, "value": "2026-10-10T16:06:14Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.7.date", "linked_record": true}, {"timestamp": "2026-10-11T11:56:28Z", "date_only": false, "value": "2026-10-11T11:56:28Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.revision_history.8.date", "linked_record": true}, {"timestamp": "2026-10-11T11:56:28Z", "date_only": false, "value": "2026-10-11T11:56:28Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:20849-1", "record": "OPENSUSE-SU-2026:20849-1", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-30T15:40:11Z", "date_only": false, "value": "2026-10-30T15:40:11.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/x-qedaudit/aad9824b2a193ad6be4051074da3bc7e", "record": "CVE-2026-9111", "field": "creation_timestamp", "uuid": "2cdcee7a-e6be-4ad3-ac60-50545f830aa3", "content": "Tesla Attack Surface\n\n  .viz-root {\n    color-scheme: light;\n    --surface-1: #fcfcfb;\n    --surface-2: #f5f5f3;\n    --text-primary: #0b0b0b;\n    --text-secondary: #52514e;\n    --text-muted: #8a8985;\n    --border: #e0dfdc;\n    --critical: #e34948;\n    --high: #eb6834;\n    --medium: #eda100;\n    --low: #1baf7a;\n    --info: #2a78d6;\n    --ring-1: rgba(234,73,72,0.08);\n    --ring-2: rgba(235,104,52,0.06);\n    --ring-3: rgba(237,161,0,0.05);\n    --ring-4: rgba(26,175,122,0.04);\n  }\n  @media (prefers-color-scheme: dark) {\n    :root:not([data-theme=\"light\"]) .viz-root {\n      color-scheme: dark;\n      --surface-1: #1a1a19;\n      --surface-2: #242423;\n      --text-primary: #f0efec;\n      --text-secondary: #c3c2b7;\n      --text-muted: #7a7970;\n      --border: #3a3a38;\n      --critical: #e66767;\n      --high: #d95926;\n      --medium: #c98500;\n      --low: #199e70;\n      --info: #3987e5;\n      --ring-1: rgba(230,103,103,0.12);\n      --ring-2: rgba(217,89,38,0.10);\n      --ring-3: rgba(201,133,0,0.08);\n      --ring-4: rgba(25,158,112,0.06);\n    }\n  }\n  :root[data-theme=\"dark\"] .viz-root {\n    color-scheme: dark;\n    --surface-1: #1a1a19;\n    --surface-2: #242423;\n    --text-primary: #f0efec;\n    --text-secondary: #c3c2b7;\n    --text-muted: #7a7970;\n    --border: #3a3a38;\n    --critical: #e66767;\n    --high: #d95926;\n    --medium: #c98500;\n    --low: #199e70;\n    --info: #3987e5;\n    --ring-1: rgba(230,103,103,0.12);\n    --ring-2: rgba(217,89,38,0.10);\n    --ring-3: rgba(201,133,0,0.08);\n    --ring-4: rgba(25,158,112,0.06);\n  }\n  * { margin: 0; box-sizing: border-box; }\n  body { background: var(--surface-1); color: var(--text-primary); }\n  .viz-root { max-width: 1100px; margin: 0 auto; padding: 24px 16px; }\n  h1 { font-size: 22px; font-weight: 700; margin-bottom: 4px; }\n  .subtitle { color: var(--text-secondary); font-size: 13px; margin-bottom: 24px; }\n  .stats-row { display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 24px; }\n  .stat { background: var(--surface-2); border-radius: 8px; padding: 12px 16px; min-width: 120px; flex: 1; }\n  .stat-value { font-size: 28px; font-weight: 700; }\n  .stat-label { font-size: 11px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.5px; margin-top: 2px; }\n  .diagram-container { position: relative; width: 100%; aspect-ratio: 1; max-width: 700px; margin: 0 auto 32px; }\n  .ring { position: absolute; border-radius: 50%; border: 1.5px solid var(--border); display: flex; align-items: center; justify-content: center; }\n  .ring-1 { width: 100%; height: 100%; top: 0; left: 0; background: var(--ring-1); }\n  .ring-2 { width: 72%; height: 72%; top: 14%; left: 14%; background: var(--ring-2); }\n  .ring-3 { width: 44%; height: 44%; top: 28%; left: 28%; background: var(--ring-3); }\n  .ring-4 { width: 20%; height: 20%; top: 40%; left: 40%; background: var(--ring-4); border: 2px solid var(--border); }\n  .ring-label { position: absolute; font-size: 10px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.5px; }\n  .ring-1 > .ring-label { top: 6px; left: 50%; transform: translateX(-50%); }\n  .ring-2 > .ring-label { top: 6px; left: 50%; transform: translateX(-50%); }\n  .ring-3 > .ring-label { top: 6px; left: 50%; transform: translateX(-50%); }\n  .ring-4 > .ring-label { top: 50%; left: 50%; transform: translate(-50%, -50%); font-size: 12px; font-weight: 600; color: var(--text-secondary); white-space: nowrap; }\n  .node { position: absolute; border-radius: 50%; cursor: pointer; display: flex; align-items: center; justify-content: center; font-size: 11px; font-weight: 700; color: #fff; transition: transform 0.15s, box-shadow 0.15s; z-index: 2; }\n  .node:hover { transform: scale(1.15); box-shadow: 0 4px 16px rgba(0,0,0,0.25); z-index: 10; }\n  .node-label { position: absolute; font-size: 10px; color: var(--text-primary); font-weight: 600; white-space: nowrap; pointer-events: none; }\n  .tooltip { display: none; position: fixed; background: var(--surface-2); border: 1px solid var(--border); border-radius: 8px; padding: 12px 16px; max-width: 420px; z-index: 100; box-shadow: 0 8px 24px rgba(0,0,0,0.15); font-size: 12px; line-height: 1.5; }\n  .tooltip.active { display: block; }\n  .tooltip h3 { font-size: 13px; font-weight: 700; margin-bottom: 6px; }\n  .tooltip .finding { padding: 4px 0; border-bottom: 1px solid var(--border); }\n  .tooltip .finding:last-child { border-bottom: none; }\n  .tooltip .fid { font-family: monospace; font-size: 10px; color: var(--text-muted); }\n  .tooltip .ftitle { font-size: 11px; }\n  .sev-badge { display: inline-block; padding: 1px 6px; border-radius: 3px; font-size: 10px; font-weight: 600; color: #fff; margin-right: 4px; }\n  .sev-critical { background: var(--critical); }\n  .sev-high { background: var(--high); }\n  .sev-medium { background: var(--medium); color: #000; }\n  .sev-low { background: var(--low); }\n  .chain-section { margin-top: 32px; }\n  .chain-section h2 { font-size: 16px; font-weight: 700; margin-bottom: 12px; }\n  .chain { background: var(--surface-2); border-radius: 8px; padding: 16px; margin-bottom: 12px; border-left: 3px solid var(--critical); }\n  .chain-title { font-size: 13px; font-weight: 700; margin-bottom: 8px; }\n  .chain-steps { font-size: 12px; color: var(--text-secondary); line-height: 1.8; }\n  .chain-steps .step { display: inline; }\n  .chain-steps .arrow { color: var(--critical); font-weight: 700; margin: 0 4px; }\n  .table-section { margin-top: 32px; }\n  .table-section h2 { font-size: 16px; font-weight: 700; margin-bottom: 12px; }\n  table { width: 100%; border-collapse: collapse; font-size: 12px; }\n  th { text-align: left; padding: 8px; border-bottom: 2px solid var(--border); color: var(--text-muted); font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; }\n  td { padding: 6px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }\n  td:first-child { font-family: monospace; font-size: 10px; color: var(--text-muted); }\n  tr:hover td { background: var(--surface-2); }\n  .filter-row { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 16px; }\n  .filter-btn { padding: 4px 12px; border-radius: 16px; border: 1px solid var(--border); background: var(--surface-1); color: var(--text-secondary); font-size: 11px; cursor: pointer; transition: all 0.1s; }\n  .filter-btn.active { background: var(--text-primary); color: var(--surface-1); border-color: var(--text-primary); }\n  .filter-btn:hover { border-color: var(--text-secondary); }\n  @media (max-width: 600px) {\n    .diagram-container { max-width: 100%; }\n    .node-label { font-size: 9px; }\n    .stats-row { gap: 8px; }\n    .stat { min-width: 80px; padding: 8px 12px; }\n    .stat-value { font-size: 22px; }\n  }\n\n\n\n\n  \nTesla MCU2 Attack Surface Map\n  \n224 findings across 9 components \u2014 firmware 2026.26.6.1 / 2026.26.6.5\n\n  \n\n    \n\n90\nDirect entry points\n    \n\n134\nPost-exploitation\n    \n\n9\nComponents\n    \n\n3\nAttack chains\n  \n\n  \n\n    \nTier 1 \u2014 Remote 0-click\n    \nTier 2 \u2014 Proximity\n    \nTier 3 \u2014 Conditional\n    \nMCU2\n  \n\n  \n\n    \nAttack Chains\n    \n\n      \nChain 1: WiFi \u2192 Persistent Compromise\n      \n\n        WiFi connect\u2192\n        Hermes proxy (20rmj77k)\u2192\n        Receipt capture\u2192\n        Replay (lzpmnqjl)\u2192\n        Shell cmd\u2192\n        tar CAP_MKNOD (s1q31odz)\u2192\n        Raw disk\u2192\n        Persistent implant\n      \n    \n    \n\n      \nChain 2: OTA MitM \u2192 Fleet Downgrade\n      \n\n        WiFi MitM\u2192\n        HTTP MQTT inject (qdhzc3us)\u2192\n        OTA redirect\u2192\n        Handshake bypass (bwmc764i)\u2192\n        Bank rollback (j2sukksh)\u2192\n        Signed downgrade\n      \n    \n    \n\n      \nChain 3: Post-RCE \u2192 Fleet-Wide\n      \n\n        Initial RCE\u2192\n        OTA TOCTOU (y7sc037h)\u2192\n        Unsigned FW\u2192\n        Expired cert (qopg0q34)\u2192\n        Blank VIN (obmi0r83)\u2192\n        All vehicles\n      \n    \n  \n\n  \n\n    \nAll Entry Points by Attack Surface\n    \n\n    \n\n      FindingSeveritySurfaceComponentDescription\n      \n    \n  \n\n\n\n\n\n\nconst surfaces = [\n  {\n    id: \"sms\", name: \"SMS\", tier: 1, angle: 270, color: \"#e34948\",\n    desc: \"Global 0-click \u2014 send SMS to phone number\",\n    findings: [\n      {id:\"6csm972vpl7zlp2t\",sev:\"high\",t:\"+CMT SMS user-data overflow (CVE-2023-2794 unpatched)\"},\n      {id:\"xtl8xejzclcu4qup\",sev:\"high\",t:\"+CDS status report overflow (CVE-2023-4232 unpatched)\"},\n      {id:\"gxxgklk72y71egto\",sev:\"high\",t:\"CMT TP-UDL bypass overflow (likely FP \u2014 decoder validates)\"},\n      {id:\"wnlkmijxcmwd4ark\",sev:\"medium\",t:\"UCS-2 SMS length underflow OOB read\"},\n      {id:\"dxu5jt0lpu9qx2i8\",sev:\"medium\",t:\"SMSC alphanumeric offset misparse\"},\n      {id:\"84wpo7v4beuub8xw\",sev:\"high\",t:\"Multipart SMS count truncation heap overflow\"},\n      {id:\"hl2806ftnjs0vphy\",sev:\"medium\",t:\"SMS reassembly no quota/expiry (DoS)\"},\n      {id:\"39c9peq3ovyin5fe\",sev:\"low\",t:\"Uninitialized SMS PDU buffer info leak\"},\n    ]\n  },\n  {\n    id: \"webrtc\", name: \"WebRTC\", tier: 1, angle: 330, color: \"#6250d6\",\n    desc: \"Internet \u2014 Sentry Mode camera streaming\",\n    findings: [\n      {id:\"cce7khuh3wadtbju\",sev:\"high\",t:\"AV1 dav1d tile-group heap UAF (CVE-2026-9111)\"},\n      {id:\"9rqglq0fythtcjlm\",sev:\"high\",t:\"NetEq CNG\u2192L16 48kHz heap overflow\"},\n      {id:\"bo853v5y6y5pb6yl\",sev:\"high\",t:\"H.264 SPS/PPS OOB memory corruption\"},\n      {id:\"9y1f3lu0n3gwjxzq\",sev:\"high\",t:\"DTLS handshake transport UAF\"},\n      {id:\"uz52z36wduezghl4\",sev:\"high\",t:\"TURN redirect \u2192 private network SSRF\"},\n      {id:\"j28nztwbnm3dqb27\",sev:\"high\",t:\"DCEP OPEN SID iterator + channel free\"},\n      {id:\"ncv6r3aow4d856br\",sev:\"high\",t:\"SCTP SACK gap blocks \u2192 process kill\"},\n    ]\n  },\n  {\n    id: \"cbs\", name: \"CBS\", tier: 1, angle: 230, color: \"#eb6834\",\n    desc: \"Rogue BTS \u2014 Cell Broadcast\",\n    findings: [\n      {id:\"dguha5nrqzc350jp\",sev:\"high\",t:\"CBS multipart expiry double-free (upstream 0-day confirmed)\"},\n      {id:\"cp0z9zcnpzrndy60\",sev:\"high\",t:\"CBM hex decoder stack overflow\"},\n      {id:\"clslm4jkff3vi8oq\",sev:\"high\",t:\"CBS PDU stack overflow pre-validation\"},\n      {id:\"neu71vnx83w3uqep\",sev:\"high\",t:\"CBS base-station timer UAF\"},\n    ]\n  },\n  {\n    id: \"ussd\", name: \"USSD\", tier: 1, angle: 195, color: \"#e87ba4\",\n    desc: \"Rogue BTS/gateway \u2014 USSD push\",\n    findings: [\n      {id:\"eusgd57ekfcdvmw2\",sev:\"high\",t:\"CUSD hex decode overflow (CONFIRMED on real binary: 400B\u2192168B)\"},\n      {id:\"79xo0vgywv4cka1x\",sev:\"high\",t:\"+CUSD 168B stack overflow\"},\n      {id:\"e5ry2zlfktz1qw9s\",sev:\"medium\",t:\"USSD uninitialized stack buffer\"},\n    ]\n  },\n  {\n    id: \"wifi\", name: \"WiFi\", tier: 2, angle: 45, color: \"#2a78d6\",\n    desc: \"Proximity \u2014 rogue AP, 0-click\",\n    findings: [\n      {id:\"5rj9ofaklwezd720\",sev:\"high\",t:\"OWE BSS cache eviction UAF (0-day)\"},\n      {id:\"ggqextgqbl927w70\",sev:\"high\",t:\"HS 2.0 OSU icon count heap overflow (0-day)\"},\n      {id:\"mq7ilahdlqnszb7n\",sev:\"medium\",t:\"Legacy WPA msg3 GTK install bypass (0-day)\"},\n      {id:\"zynw0gpfdh7gmv83\",sev:\"high\",t:\"SSID confusion \u2192 MitM (CVE-2023-52424 class)\"},\n      {id:\"4n83dmlqgxnvt359\",sev:\"high\",t:\"TEAP unauthenticated PAC provisioning\"},\n      {id:\"zp6jf9szbin4zzgu\",sev:\"high\",t:\"OpenSSL session double-free in EAP\"},\n      {id:\"h2du1regdr1tbekl\",sev:\"high\",t:\"DPP Presence Announcement NULL deref crash\"},\n      {id:\"lhh8pf9tbtggjuny\",sev:\"medium\",t:\"SAE H2E group downgrade bypass\"},\n    ]\n  },\n  {\n    id: \"ble\", name: \"BLE\", tier: 2, angle: 135, color: \"#1baf7a\",\n    desc: \"Proximity \u2014 paired BLE device\",\n    findings: [\n      {id:\"sc2lmfxwdpdecr8q\",sev:\"high\",t:\"AVRCP imaging length wrap \u2192 heap underalloc (0-day)\"},\n      {id:\"93viipxjbu7spkic\",sev:\"high\",t:\"MAP 256-instance count wrap \u2192 heap overflow (0-day)\"},\n      {id:\"wazth4qn6fqtgr6b\",sev:\"high\",t:\"OBEX imaging 16-bit wrap \u2192 heap underalloc (0-day)\"},\n      {id:\"k1swr9kgct61s7e8\",sev:\"high\",t:\"PBAP PAC handler UAF\"},\n      {id:\"7s7n9hfk4ofydsro\",sev:\"high\",t:\"OBEX cleanup timer UAF\"},\n      {id:\"81w1is9u0wil1h1v\",sev:\"medium\",t:\"HID DATA_IND zero-length OOB read\"},\n    ]\n  },\n  {\n    id: \"mitm\", name: \"WiFi MitM\", tier: 3, angle: 0, color: \"#eda100\",\n    desc: \"Conditional \u2014 car on attacker's WiFi\",\n    findings: [\n      {id:\"qdhzc3us6d96bq3z\",sev:\"high\",t:\"Plaintext HTTP MQTT config injection\"},\n      {id:\"rkirujrqd1xo6wn2\",sev:\"high\",t:\"Hostname validation substring bypass\"},\n    ]\n  },\n  {\n    id: \"mothership\", name: \"Mothership\", tier: 3, angle: 90, color: \"#008300\",\n    desc: \"Internal only \u2014 post-exploitation / internal net\",\n    findings: [\n      {id:\"lzpmnqjlbh2vrj0m\",sev:\"critical\",t:\"Hermes receipt replay \u2192 1hr arbitrary command\"},\n      {id:\"8ych2cg6qkd7u0te\",sev:\"high\",t:\"Shell command replay (expiry/ID ignored)\"},\n      {id:\"qopg0q34e4d1nfks\",sev:\"high\",t:\"Expired certificates accepted (--allow-expired)\"},\n      {id:\"78dw9yjk8vzql7j6\",sev:\"high\",t:\"No CRL/OCSP \u2014 revoked certs work\"},\n    ]\n  },\n  {\n    id: \"updater\", name: \"OTA\", tier: 3, angle: 160, color: \"#52514e\",\n    desc: \"Post-exploitation \u2014 persistence & escalation\",\n    findings: [\n      {id:\"y7sc037hz4j7h564\",sev:\"high\",t:\"OTA validation\u2192install TOCTOU \u2192 unsigned FW\"},\n      {id:\"g1ryvzvyz2e2p4cu\",sev:\"high\",t:\"Signature not bound to mounted package\"},\n      {id:\"j2sukkshvp48vez9\",sev:\"high\",t:\"Active-bank rollback \u2192 signed downgrade\"},\n      {id:\"s1q31odzcp2738dq\",sev:\"high\",t:\"tar CAP_MKNOD \u2192 local privilege escalation\"},\n      {id:\"obmi0r83dcdxr5xd\",sev:\"high\",t:\"Blank VIN restriction \u2192 all vehicles\"},\n      {id:\"dx4zfard00l05w9v\",sev:\"high\",t:\"Pre-existing mount bypasses all auth\"},\n    ]\n  }\n];\n\nconst diagram = document.getElementById(\"diagram\");\nconst tooltip = document.getElementById(\"tooltip\");\nconst tbody = document.getElementById(\"findings-table\");\nconst filterRow = document.getElementById(\"filters\");\n\n// Place nodes on the diagram\nsurfaces.forEach(s => {\n  const tierRadii = {1: 42, 2: 30, 3: 18};\n  const r = tierRadii[s.tier];\n  const rad = (s.angle - 90) * Math.PI / 180;\n  const cx = 50 + r * Math.cos(rad);\n  const cy = 50 + r * Math.sin(rad);\n  const size = Math.max(32, Math.min(56, 20 + s.findings.length * 3));\n\n  const node = document.createElement(\"div\");\n  node.className = \"node\";\n  node.style.cssText = `width:${size}px;height:${size}px;left:calc(${cx}% - ${size/2}px);top:calc(${cy}% - ${size/2}px);background:${s.color};font-size:${size > 40 ? 13 : 11}px;`;\n  node.textContent = s.findings.length;\n  node.setAttribute(\"data-surface\", s.id);\n\n  const label = document.createElement(\"div\");\n  label.className = \"node-label\";\n  const labelX = cx > 55 ? \"4px\" : cx < 45 ? `${-60}px` : `${-20}px`;\n  const labelY = cy > 55 ? \"4px\" : `${-16}px`;\n  label.style.cssText = `left:calc(100% + 4px);top:50%;transform:translateY(-50%);`;\n  if (cx > 65) label.style.cssText = `right:calc(100% + 4px);top:50%;transform:translateY(-50%);text-align:right;`;\n  if (cy < 20) { label.style.cssText = `left:50%;bottom:calc(100% + 4px);transform:translateX(-50%);text-align:center;`; }\n  if (cy > 80) { label.style.cssText = `left:50%;top:calc(100% + 4px);transform:translateX(-50%);text-align:center;`; }\n  label.textContent = s.name;\n  node.appendChild(label);\n\n  node.addEventListener(\"mouseenter\", e => {\n    let html = `\n${s.name} \u2014 ${s.desc}`;\n    s.findings.slice(0, 8).forEach(f => {\n      const sevClass = f.sev === \"critical\" ? \"sev-critical\" : f.sev === \"high\" ? \"sev-high\" : f.sev === \"medium\" ? \"sev-medium\" : \"sev-low\";\n      html += `\n${f.sev}${f.t}${f.id}`;\n    });\n    if (s.findings.length > 8) html += `\n+${s.findings.length - 8} more`;\n    tooltip.innerHTML = html;\n    tooltip.classList.add(\"active\");\n    const rect = node.getBoundingClientRect();\n    tooltip.style.left = Math.min(rect.right + 8, window.innerWidth - 440) + \"px\";\n    tooltip.style.top = Math.max(8, rect.top - 20) + \"px\";\n  });\n  node.addEventListener(\"mouseleave\", () => tooltip.classList.remove(\"active\"));\n\n  diagram.appendChild(node);\n});\n\n// Build filter buttons\nlet activeFilter = \"all\";\nconst allBtn = document.createElement(\"button\");\nallBtn.className = \"filter-btn active\";\nallBtn.textContent = \"All (90)\";\nallBtn.onclick = () => { activeFilter = \"all\"; renderTable(); updateFilters(); };\nfilterRow.appendChild(allBtn);\nsurfaces.forEach(s => {\n  const btn = document.createElement(\"button\");\n  btn.className = \"filter-btn\";\n  btn.textContent = `${s.name} (${s.findings.length})`;\n  btn.setAttribute(\"data-id\", s.id);\n  btn.onclick = () => { activeFilter = s.id; renderTable(); updateFilters(); };\n  filterRow.appendChild(btn);\n});\n\nfunction updateFilters() {\n  filterRow.querySelectorAll(\".filter-btn\").forEach(b => {\n    b.classList.toggle(\"active\", b.getAttribute(\"data-id\") === activeFilter || (activeFilter === \"all\" && !b.getAttribute(\"data-id\")));\n  });\n}\n\nfunction renderTable() {\n  tbody.innerHTML = \"\";\n  surfaces.forEach(s => {\n    if (activeFilter !== \"all\" && activeFilter !== s.id) return;\n    s.findings.forEach(f => {\n      const tr = document.createElement(\"tr\");\n      const sevClass = f.sev === \"critical\" ? \"sev-critical\" : f.sev === \"high\" ? \"sev-high\" : f.sev === \"medium\" ? \"sev-medium\" : \"sev-low\";\n      tr.innerHTML = `${f.id}${f.sev}${s.name}ofonod/wpa/btd${f.t}`;\n      tbody.appendChild(tr);\n    });\n  });\n}\nrenderTable();\n\n", "url": "https://gist.github.com/x-qedaudit/aad9824b2a193ad6be4051074da3bc7e"}], "metrics": {"as_of": "2026-11-03T21:49:36.690Z", "anchors": {"origin": {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 14507376.690366, "hours": 4029.826858435, "days": 167.90945243479166, "min_seconds": 14420976.690366, "max_seconds": 14507376.690366, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-20T00:00:00Z", "date_only": false, "value": "2026-05-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0613", "record": "CERTFR-2026-AVI-0613", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-03T21:49:36.690Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}