CVE-2026-95356

A flaw was found in chromium-browser. A use-after-free memory vulnerability in the WindowDialog component allows a remote attacker to execute arbitrary code outside the browser sandbox. By convincing a user to open a specially crafted HTML page, an attacker can exploit this flaw to compromise the...

CVE-2026-95343

A flaw was found in chromium-browser. A remote attacker could exploit a use-after-free memory vulnerability—where previously released memory is improperly accessed—in the WebAudio component by convincing a user to view a specially crafted HTML page. Successful exploitation could allow the attacke...

CVE-2026-95335

A flaw was found in chromium-browser. A use-after-free vulnerability in the Human Interface Device HID component allows a remote attacker to execute arbitrary code outside the browser sandbox. By convincing a user to visit a specially crafted web page, an attacker who has already compromised the...

CVE-2026-95325

A flaw was found in the ANGLE component of chromium-browser. This vulnerability allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a specially crafted HTML page. The issue stems from a use-after-free condition, which occurs when memory is referenc...

CVE-2026-95322

A flaw was found in chromium-browser. An out-of-bounds write vulnerability in the graphics processing unit GPU component allows a remote attacker to execute arbitrary code outside the browser sandbox. By enticing a user to view a specially crafted HTML page, an attacker who has already compromise...

CVE-2026-95299

A flaw was found in chromium-browser. A use-after-free memory corruption vulnerability exists within the Graphics Processing Unit GPU component. A remote attacker could exploit this flaw by enticing a user to visit a specially crafted web page. Successful exploitation could allow the attacker to...

CVE-2026-95283

A flaw was found in the Tint component of chromium-browser. This buffer overflow allows a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to view a specially crafted web page. Successful exploitation could compromise the host system by bypassing standard...

CVE-2026-95375

A flaw was found in chromium-browser. An incorrect authorization issue in the BrowserTag component allows a remote attacker who has compromised a renderer process to bypass the web origin policy via a crafted HTML page. This allows the attacker to circumvent the security boundary that isolates da...

CVE-2026-95361

A flaw was found in chromium-browser. A confused deputy issue in the DevTools feature allows a remote attacker to bypass the browser's web origin policy. By using social engineering to trick a user into viewing a specially crafted HTML page, an attacker can exploit this vulnerability to improperl...

CVE-2026-95340

A flaw was found in the Picture-in-Picture component of chromium-browser. An incorrect authorization issue allows a remote attacker to bypass the web origin policy—the security boundary that isolates data between different websites—by convincing a user to interact with a crafted HTML page...

CVE-2026-95312

A flaw was found in chromium-browser. A remote attacker who has compromised the browser's renderer process could exploit this vulnerability by convincing a user to visit a crafted HTML page. Successful exploitation allows the attacker to bypass cross-origin security boundaries and access sensitiv...

CVE-2026-95302

A flaw was found in chromium-browser. An incorrect authorization issue within the WebAPK Web Android Package implementation allows a local attacker to bypass security boundaries using a co-installed application. A malicious application installed on the same device can exploit this vulnerability t...

CVE-2026-95290

A flaw was found in chromium-browser. Due to missing authorization checks in the Near Field Communication NFC component, a remote attacker who has compromised a renderer process can bypass system access restrictions via a crafted HTML page. Successful exploitation allows the attacker to access...

CVE-2026-95372

A flaw was found in the Chromecast component of chromium-browser. This vulnerability can lead to arbitrary code execution outside the browser's security sandbox. A remote attacker who has already compromised the renderer process could trigger a use-after-free memory flaw by convincing a user to...

CVE-2026-95345

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution inside the restricted sandbox environment by enticing a user to open a specially crafted HTML page. The issue is caused by a use-after-free condition in the Actor component, where...

CVE-2026-95338

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code within the browser's sandbox by convincing a user to open a specially crafted PDF document. This issue is caused by a use-after-free vulnerability in the PDFium component, where memory is improperly accessed after ...

CVE-2026-95334

A flaw was found in chromium-browser. Incorrect reference resolution in the WebProtect feature allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the browser sandbox. By convincing a user to load a specially crafted HTML page, the...

CVE-2026-95352

A flaw was found in chromium-browser. An incorrect authorization issue in DevTools allows a remote attacker to bypass the web origin policy by using social engineering to convince a user to install a crafted browser extension. Successful exploitation could allow the attacker to access sensitive...

CVE-2026-95353

A flaw was found in chromium-browser. A use-after-free vulnerability in the browser bindings allows a remote attacker to achieve arbitrary code execution within the sandbox environment by convincing a user to open a specially crafted HTML page. Successful exploitation occurs when the application...

CVE-2026-95348

A flaw was found in chromium-browser. A use-after-free memory corruption issue exists within the Bluetooth component. A remote attacker who has already compromised the renderer process could exploit this vulnerability by convincing a user to load a crafted HTML page. Successful exploitation could...