CVE-2026-87521

CVE-2026-87521 is an information leak in WebMCP in Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain cross-origin data by delivering a crafted HTML page. The Chromium security team assigned this a Medium severity rating....

EUVD-2026-74344

Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87579

CVE-2026-87579 is a buffer overflow in the WebRTC component of Google Chrome prior to 153.0.8010.36 . A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to the victim. The Chromium project rates the severity as Medium . No public exploitation det...

CVE-2026-87497

CVE-2026-87497 is an uninitialized resource vulnerability in the Codecs component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage a crafted HTML page to read memory inside the browser sandbox , potentially leaking sensitive data. Chromium rates the se...

CVE-2026-87476

CVE-2026-87476 is an incorrect authorization flaw in the Loader component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit this via a crafted HTML page to obtain sensitive information . The Chromium team rates the security severity as Medium . The fix is available i...

CVE-2026-87645

CVE-2026-87645 is an improper state validation vulnerability in the Safebrowsing component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could leverage a crafted HTML page to bypass system access restrictions . Chromium assigns this a Medium security severity. The fix is inc...

CVE-2026-87577

CVE-2026-87577 is an incorrect authorization vulnerability in the Isolated component of Google Chrome prior to 153.0.8010.36 . A remote attacker could exploit it via a crafted HTML page to bypass the web origin policy into a privileged page . Chromium classifies the severity as Medium . The fix i...

EUVD-2026-74333

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74337

Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87466

CVE-2026-87466 is an incorrect authorization flaw in the Workers component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can bypass the web origin policy by serving a crafted HTML page to a victim. The Chromium project rates the security severity as Medium . The fix is to up...

CVE-2026-87603

CVE-2026-87603 is a missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit this via a crafted HTML page to bypass system access restrictions. The Chromium security team rates the severity as Medium . The fix ...

EUVD-2026-74328

Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87503

Google Chrome on Android prior to 153.0.8010.36 contains an inappropriate implementation in the Downloads component that allows a remote attacker, leveraging social engineering via a crafted HTML page, to bypass system access restrictions . Chromium assigns this a Medium security severity. Remedi...

EUVD-2026-74325

Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74321

Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74314

Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87465

An incorrect authorization flaw in the Downloads feature of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium rates the severity as Medium , reflecting the requirement that the ren...

EUVD-2026-74536

Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87434

Google Chrome prior to 153.0.8010.36 contains a missing authorization flaw in its CORS implementation. A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass the web origin policy . The issue was fixed in version 153.0.8010.36 , released on...

EUVD-2026-74308

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...