CVE-2026-87521

An information leak in WebMCP within Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to obtain cross-origin data via a crafted HTML page. This vulnerability has a Chromium security severity of Medium . Microsoft Edge is also affected ...

CVE-2026-87497

Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87476

Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87579

Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87579

Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87579

A heap-based buffer overflow vulnerability exists in WebRTC within Google Chrome (and other Chromium-based browsers like Microsoft Edge) prior to version 153.0.8010.36 . A remote attacker can exploit this flaw by delivering a crafted HTML page to execute arbitrary code inside the browser's sandbo...

CVE-2026-87645

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87449

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74333

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87443

Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87645

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87577

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74337

Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87645

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87645

CVE-2026-87645 is an improper state validation flaw in the Safebrowsing component of Google Chrome prior to 153.0.8010.36 . A remote attacker could leverage a crafted HTML page to bypass system access restrictions. The Chromium project rates the severity as Medium , with NVD assigning a CVSS 3.1 ...

CVE-2026-87603

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87652

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87603

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87466

Google Chrome versions prior to 153.0.8010.36 are vulnerable to CVE-2026-87466 due to incorrect authorization in Workers . A remote attacker could exploit this by using a crafted HTML page to bypass the web origin policy . This vulnerability is also addressed in Microsoft Edge as it ingests Chrom...

CVE-2026-87503

Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...