CVE-2026-11225

Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Low...

CVE-2026-11225

Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Low...

CVE-2026-11209

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11204

Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11204

Google Chrome on iOS prior to version 149.0.7827.53 is vulnerable to a navigation restriction bypass caused by an inappropriate implementation in Signin . A remote attacker can exploit this by serving a crafted HTML page . While the Chromium security severity is rated as Medium , the vulnerabilit...

CVE-2026-11203

A policy bypass in the GPU component of Google Chrome on Mac (prior to version 149.0.7827.53) allows a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability is categorized with a Medium security severity. While general Chromium security updates are mentioned, no sp...

CVE-2026-11201

Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-11186

Google Chrome and Microsoft Edge browsers are vulnerable to a Cross-User Scripting (UXSS) flaw due to an inappropriate CSS implementation . This security issue allows a remote attacker to inject arbitrary scripts or HTML, potentially leading to the access of confidential data and compromising dat...

CVE-2026-11175

Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11161

Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11152

A security vulnerability exists in the Dawn component of the Google Chrome and Microsoft Edge web browsers. The issue is caused by an object lifecycle problem, specifically involving the use of memory after it has been freed. A remote attacker could exploit this via a crafted HTML page to potenti...

CVE-2026-11132

The Paint component in Google Chrome and Microsoft Edge (Chromium-based) is vulnerable to a Same-Origin Policy (SOP) bypass due to insufficient policy enforcement and a lack of mechanisms for verifying data sources. A remote attacker can exploit this by tricking a user into visiting a crafted HTM...

CVE-2026-11106

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11085

Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11000

Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-10977

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-10944

A vulnerability in Google Chrome on iOS prior to version 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is insufficient policy enforcement in the Autofill component. This issue is classified with High security severity by Chromium. No spec...

CVE-2026-10934

A Use after free vulnerability in the Autofill component of Google Chrome on Android (prior to version 149.0.7827.53 ) allows a remote attacker to perform a sandbox escape via a crafted HTML page after compromising the renderer process. The vulnerability is reported to have a High security severi...

CVE-2026-10920

A vulnerability exists in the WebShare component of Google Chrome and Microsoft Edge browsers due to insufficient validation of untrusted input . A remote attacker who has already compromised the renderer process can use a crafted HTML page to potentially perform a sandbox escape . Impact include...

CVE-2026-10914

Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...