CVE-2026-87449

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87645

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87645

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87466

CVE-2026-87466 is an incorrect authorization flaw in Service Workers within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can deliver a crafted HTML page that causes a bypass of the web origin policy , potentially allowing unauthorized cross-origin access with low ...

CVE-2026-87652

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74328

Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87603

CVE-2026-87603 is a missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit this via a crafted HTML page to bypass system access restrictions. The Chromium security team rates the severity as Medium . The fix ...

EUVD-2026-74325

Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87503

Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87503

Google Chrome on Android prior to 153.0.8010.36 is affected by an inappropriate implementation in the Downloads component. A remote attacker can leverage social engineering with a crafted HTML page to bypass system access restrictions , potentially gaining unauthorized access to parts of the syst...

CVE-2026-87503

Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74321

Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87481

Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74314

Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87515

Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87465

CVE-2026-87465 is an incorrect authorization flaw in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to spoof UI elements . The CVSS 3.1 score is 4.2 (Medium...

CVE-2026-87547

Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87453

Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87588

Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74536

Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...