CVE-2026-13971

Google Chrome (versions prior to 150.0.7871.47) is vulnerable to an uninitialized use flaw in the Skia component. A remote attacker who has compromised the renderer process can exploit this by using a crafted HTML page to obtain potentially sensitive information from process memory. Security upda...

CVE-2026-13962

Insufficient data validation in PDF in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13961

Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security...

CVE-2026-13958

A Use of Uninitialized Variable flaw (CWE-457) exists in the Codecs component of the Google Chrome browser on Windows . This vulnerability affects versions prior to 150.0.7871.47 and allows a remote attacker to obtain potentially sensitive information from process memory by navigating to a crafte...

CVE-2026-13949

Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13947

A vulnerability in the XR component of the Chromium browser (affecting Google Chrome and Microsoft Edge ) was caused by an uninitialized use flaw. A remote attacker who had compromised the renderer process could use a crafted HTML page to obtain potentially sensitive information from process memo...

CVE-2026-13943

Uninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13936

An inappropriate implementation flaw exists in the Passwords component of the Chromium browser, affecting Google Chrome on Android prior to version 150.0.7871.47 . A remote attacker can exploit this by using a crafted HTML page to obtain potentially sensitive information from process memory. This...

CVE-2026-13937

A vulnerability in the Passwords component of the Chromium browser (including Google Chrome and Microsoft Edge ) is caused by a lack of access control (insufficient policy enforcement). A remote attacker who has successfully compromised the renderer process can leverage this flaw to leak cross-or...

CVE-2026-13932

Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13932

An inappropriate implementation flaw in the Sharing component of the Chromium browser (affecting Google Chrome on Android prior to version 150.0.7871.47 ) allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. This vulnerability is cat...

CVE-2026-13931

Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13926

Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13924

The WebView component in the Chromium browser (including Google Chrome on Android ) is vulnerable to an insufficient validation of untrusted input flaw (CVE-2026-13924 ). A remote attacker who has already compromised the renderer process can exploit this by using a crafted HTML page to bypass the...

CVE-2026-13923

Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13914

Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. Chromium security severity: Medium...

CVE-2026-13911

The Spellcheck component in Google Chrome and Microsoft Edge is vulnerable to insufficient data validation. A remote attacker who has compromised the renderer process can exploit this flaw by using a crafted HTML page to obtain potentially sensitive information from process memory. This issue was...

CVE-2026-13905

Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. Chromium security severity: Medium...

CVE-2026-13901

A remote attacker who has compromised the renderer process in Google Chrome (prior to version 150.0.7871.47 ) can perform a sandbox escape due to insufficient policy enforcement in the Serial component. The root cause is identified as insufficient validation of untrusted input , which allows the ...

CVE-2026-13891

The Extensions component in the Chromium browser (used by Google Chrome and Microsoft Edge ) is vulnerable to insufficient validation of untrusted input . A remote attacker who has compromised the renderer process can exploit this flaw via a crafted HTML page to perform privilege escalation or ca...