CVE-2026-14037

An insufficient policy enforcement flaw exists in the GPU component of the Chromium browser (including Google Chrome and Microsoft Edge). A remote attacker who has compromised the renderer process can potentially perform a sandbox escape by navigating to a crafted HTML page. This vulnerability af...

CVE-2026-14038

The New Tab Page component in the Chromium browser (affecting Google Chrome and Microsoft Edge ) is vulnerable to an insufficient validation of untrusted input flaw. A remote attacker who has already compromised the renderer process can leverage this vulnerability to perform a sandbox escape by p...

CVE-2026-14037

Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14037

Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14038

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14036

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14037

Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14036

A vulnerability exists in the Bluetooth component of Google Chrome (prior to version 150.0.7871.47) due to insufficient policy enforcement . A remote attacker can exploit this defect by using a crafted HTML page to perform privilege escalation . Similar vulnerabilities have been reported in Micro...

CVE-2026-14033

A flaw in the Media component of the Chromium browser allows a remote attacker to bypass site isolation via a crafted HTML page. This vulnerability exists in versions prior to 150.0.7871.47 on Windows. Remediation is available in the 150.0.7871.47 update and subsequent patches.

CVE-2026-14035

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14034

An inappropriate implementation flaw in the WebXR component of the Chromium browser (affected on Android prior to version 150.0.7871.47 ) allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The root cause is identified as an Improper Access Control (CWE-284) issue....

CVE-2026-14033

Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14033

Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14035

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14031

Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14031

Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14030

An incorrect security UI flaw in the SplitView component of the Chromium browser (including Google Chrome and Microsoft Edge ) allows a remote attacker to spoof the contents of the Omnibox (URL bar) . This occurs when a user is convinced to perform specific UI gestures while visiting a crafted HT...

CVE-2026-14030

Inappropriate implementation in SplitView in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14028

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14028

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...