CVE-2026-78958

CVE-2026-78958 is an uninitialized resource vulnerability in the Skia library within Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially obtain cross-origin data by serving a crafted HTML page to the victim. The Chrom...

CVE-2026-78961

CVE-2026-78961 is an incorrect authorization vulnerability in the Core component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who has already compromised the renderer process and leverages social engineering can craft an HTML page that bypasses the web origin policy . The C...

CVE-2026-79076

CVE-2026-79076 is an improper input validation flaw in the Sync component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit this by sending crafted network traffic to obtain sensitive information from the browser. The Chromium project classifies the severity as Med...

CVE-2026-79088

An incorrect authorization flaw in the FileSystem component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker, leveraging social engineering , to bypass system access restrictions by delivering a crafted HTML page. The Chromium project rated the issue as Medium severity. The fix i...

CVE-2026-79104

CVE-2026-79104 is a missing authorization vulnerability in the Sensor component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could obtain sensitive information by serving a crafted HTML page. The Chromium project rates this a...

CVE-2026-79216

A buffer overflow in the Blink engine of Google Chrome (versions prior to 152.0.7977.65 ) allows a remote attacker who has already compromised the renderer process to execute arbitrary code inside the sandbox via a crafted HTML page. The Chromium security team classified this as Medium severity, ...

CVE-2026-79222

CVE-2026-79222 is an incorrect authorization flaw in CustomTabs in Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A local attacker can leverage a co-installed app to bypass the web origin policy , potentially gaining unauthorized access to web content or data within Chrome...

CVE-2026-79007

CVE-2026-79007 is an uninitialized resource vulnerability in the GPU component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially read memory outside the sandbox by delivering a crafted HTML page. The Chromium pro...

CVE-2026-79030

An observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information by delivering a crafted HTML page. The vulnerability was rated Medium severity by Chromium. Remediation is to update Chrome to version 152.0.7977.65 or later. No...

CVE-2026-79071

CVE-2026-79071 is a race condition in the GPU component of Google Chrome prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox by serving a crafted HTML page. Chromium assigns it a Medium security s...

CVE-2026-78893

An information leak vulnerability exists in the QUIC component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit this flaw via a crafted HTML page to exfiltrate sensitive information from the browser. Chromium classifies the security severity as Medium . The fix is a...

CVE-2026-79209

CVE-2026-79209 is a type confusion vulnerability in the Animation component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker could exploit it via a crafted HTML page to potentially execute arbitrary code inside the sandbox . Chromium rated the severity as Medium . ...

CVE-2026-79078

CVE-2026-79078 is a use-after-free vulnerability in the FedCM component of Google Chrome prior to version 152.0.7977.65 . A remote attacker, leveraging social engineering , can exploit this flaw through a crafted HTML page to execute arbitrary code outside the sandbox , rated High severity by Chr...

CVE-2026-78952

CVE-2026-78952 is an out-of-bounds write in the Crashpad component of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to execute arbitrary code outside the sandb...

CVE-2026-79078

Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-79236

A type confusion vulnerability in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.65 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user into visiting a crafted HTML page. The Chromium security team rates this as High severity. The code exe...

CVE-2026-78899

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-78954

Google Chrome versions prior to 152.0.7977.65 contain an incorrect authorization flaw in the Extensions component. An attacker who has already compromised the renderer process can exploit this to bypass web origin policy by serving a crafted HTML page. The Chromium project rates this as High seve...

CVE-2026-79027

Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: High...

CVE-2026-78904

CVE-2026-78904 is a type confusion vulnerability in ANGLE , a graphics rendering library used by Google Chrome versions prior to 152.0.7977.65 . A remote attacker could exploit this by serving a crafted HTML page to potentially achieve arbitrary code execution outside the sandbox . Chromium rates...