CVE-2026-11308

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-11294

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-11294

CVE-2026-11294 affects Google Chrome (Chromium-based) Passwords UI handling. The issue is described as an inappropriate implementation in Passwords that enables a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is associated with versions prior to 149.0.7827.53, ...

CVE-2026-11293

Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-11271

CVE-2026-11271 affects Google Chrome (component: Passwords) with an inappropriate implementation prior to version 149.0.7827.53. A remote attacker could entice a user to perform specific UI gestures, allowing leakage of cross-origin data via a crafted HTML page. Severity is labeled Low (CVSS 3.1:...

CVE-2026-11269

CVE-2026-11269 involves an inappropriate implementation in Google Chrome extensions that allows an attacker with a privileged network position to run arbitrary code in the sandbox via a crafted extension. Affected product: Google Chrome (Extensions component). Root cause: inappropriate extension ...

CVE-2026-11261

Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-11209

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11209

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11209

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11186

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11182

CVE-2026-11182 involves an inappropriate SVG implementation in Google Chrome before 149.0.7827.53 that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The underlying issue is in the SVG handling within Chromium-based Chromium builds, leading to cross-origin data e...

CVE-2026-11166

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11150

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11150

Summary: CVE-2026-11150 is an UXSS (arbitrary script/HTML) in Chrome due to an inappropriate XML implementation. Affected product: Google Chrome (Chromium base); vulnerable component: XML handling in the browser; root cause: improper XML processing leads to script/HTML injection via a crafted HTM...

CVE-2026-11150

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11134

CVE-2026-11134 arises from an insufficient data validation issue in the Media component of Google Chrome (Chromium-based) before version 149.0.7827.53. The flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page. The description and connected sources consistently indi...

CVE-2026-11106

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11030

Mode C: Affects Google Chrome networking stack; Use-after-Free in Network component leads to heap corruption via crafted network traffic. Vulnerable before version 149.0.7827.53; exploitation depends on remote network input with user interaction. Patch is to update to Chrome 149.0.7827.53 or newe...

CVE-2026-10959

The connected documents confirm CVE-2026-10959 affects Google Chrome on Android (before version 149.0.7827.53). The underlying issue is a use-after-free in Input, enabling a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. Impact is a high-severity remote...