CVE-2026-11072

A use after free vulnerability exists in the WebView component of Google Chrome on Android prior to version 149.0.7827.53 . This flaw allows a local attacker to achieve arbitrary code execution by interacting with a malicious file . While the CVE metrics indicate a High base severity (CVSS 3.1 sc...

CVE-2026-11072

Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: Medium...

CVE-2026-11072

Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: Medium...

CVE-2026-11072

Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. Chromium security severity: Medium...

CVE-2026-11035

An inappropriate implementation in Custom Tabs within Google Chrome on Android (prior to version 149.0.7827.53) allows a local attacker to perform privilege escalation by providing a crafted XML file . The vulnerability is associated with CWE-20 (Improper Input Validation). While the CVSS3.1 scor...

CVE-2026-11034

Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via malicious network traffic. Chromium security severity: Medium...

CVE-2026-11029

CVE-2026-11029 affects Google Chrome for Android prior to 149.0.7827.53. The issue is caused by insufficient validation of untrusted input in the Drag and Drop path, which could allow a renderer process that’s already been compromised to potentially escape the browser sandbox via a crafted HTML p...

CVE-2026-11019

In Google Chrome on Android prior to version 149.0.7827.53 , an inappropriate implementation in the Payments component allows a remote attacker who has compromised the renderer process to perform domain spoofing via a crafted HTML page. This vulnerability can also be utilized to facilitate spear-...

CVE-2026-11012

Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11012

A use after free vulnerability exists in the Web Serial API interface of Google Chrome and Microsoft Edge browsers on Android operating systems (prior to version 149.0.7827.53). A remote attacker who has compromised the renderer process can exploit this flaw via a crafted HTML page to potentially...

CVE-2026-11012

Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11010

Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11010

Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11010

Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-11007

A vulnerability exists in the WebView component of Google Chrome on Android prior to version 149.0.7827.53 . The issue stems from insufficient validation of untrusted input , which could allow a remote attacker who has already compromised the renderer process to leak cross-origin data via a craft...

CVE-2026-11007

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-10984

Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2026-10984

Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2026-10967

A use after free vulnerability exists in SurfaceCapture within Google Chrome on Android (prior to version 149.0.7827.53). A remote attacker who has already compromised the renderer process could leverage this flaw to potentially perform a sandbox escape by navigating to a crafted HTML page. This ...

CVE-2026-10967

Use after free in SurfaceCapture in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...