CVE-2026-17963

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18002

CVE-2026-18002 concerns Google's Chrome with Google Lens: insufficient validation of untrusted input in Lens can allow a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected component: Google Lens integration within C...

EUVD-2026-50889

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17932

Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17895

The CVE-2026-17895 entry concerns Google Chrome before 151.0.7922.72, where an inappropriate DataTransfer implementation could allow a remote attacker to leak cross-origin data via a crafted HTML page after convincing a user to perform specific UI gestures. The vulnerability depends on how DataTr...

CVE-2026-17780

This CVE concerns Google Chrome’s Isolated Web Apps. The flaw is an inappropriate implementation that enables a remote attacker to bypass navigation restrictions via a crafted HTML page, affecting versions prior to 151.0.7922.72. Practical impact is limited to bypassing navigation controls within...

EUVD-2026-50726

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-50677

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-50843

Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-17689

CVE-2026-17689 describes an uninitialized use in ANGLE affecting Google Chrome before version 151.0.7922.72, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is identified with Chromium security severity: High. Connected sources confirm the issue and...

CVE-2026-17672

The CVE concerns Chromecast in Google Chrome with insufficient validation of untrusted input, allowing a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected component: Chromecast in Chrome; vulnerable conditio...

CVE-2026-17657

Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-65978

Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 150 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 150.0.7871.46 Linux 150.0.7871.46/.47 Windows/Mac contains a number of fixes and improvements -- a list of changes is...