CVE-2026-17892

Affected product: Google Chrome WebXR implementation. Vulnerable component/file: WebXR in Chrome. Root cause: Inappropriate WebXR implementation allowing a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. Affected versions: prior to 151.0.7922...

CVE-2026-17893

CVE-2026-17893: Google Chrome on macOS with Updater before 151.0.7922.72 is affected by insufficient input validation that could allow a remote attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page. Affected component is the Updater; root cause is input v...

CVE-2026-17890

CVE-2026-17890 concerns Google Chrome (DevTools) prior to 151.0.7922.72. The issue is described as insufficient validation of untrusted input in DevTools, which could allow a remote attacker who already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML pa...

CVE-2026-17888

CVE-2026-17888 affects Google Chrome WebUI due to insufficient validation of untrusted input, enabling a remote attacker to potentially perform a sandbox escape via malicious network traffic. The issue is described for Chrome versions before 151.0.7922.72 (Chromium family) with a Medium sever ity...

CVE-2026-17891

CVE-2026-17891 records a use-after-free in ANGLE within Google Chrome on Android, allowing a remote attacker with renderer access to potentially escape the sandbox via a crafted HTML page. The issue is tied to the ANGLE component in Chromium; upstream reference is chromium issue 524639223. The pu...

CVE-2026-17889

CVE-2026-17889 is an uninitialized-use flaw in the WebXR component of Chromium/Google Chrome. The issue allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chrome prior to version 151.0.7922.72 (Chromium-based). The upstream root cause is an uninitiali...

CVE-2026-17887

CVE-2026-17887 is a Use-After-Free in Chrome's TabStrip prior to 151.0.7922.72 that could allow a remote attacker to trigger heap corruption by convincing a user to perform specific UI gestures on a crafted HTML page. Affected product: Google Chrome (Chromium-based); root cause is use-after-free ...

CVE-2026-17886

CVE-2026-17886 : Use-after-free in Google Chrome (Enterprise builds) prior to 151.0.7922.72 can enable a remote attacker to potentially cause heap corruption via a crafted HTML page. Public sources reference Chrome stability updates addressing multiple related subsystems (Dawn, Compositing, Views...

CVE-2026-17884

CVE-2026-17884 affects Google Chrome’s WebRTC in Chromium, with an object lifecycle issue that could allow a remote attacker to potentially cause heap corruption via a crafted HTML page in Chrome versions before 151.0.7922.72. The issue is described as a WebRTC object lifecycle flaw upstream, lin...

CVE-2026-17885

CVE-2026-17885 affects Google Chrome’s Paint component. The issue arises from an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page, reported for Chrome versions prior to 151.0.7922.72. The provided sources indicate a Medium severity impac...

CVE-2026-17883

The CVE-2026-17883 entry concerns an inappropriate implementation in Chrome's Headless mode that allows a remote attacker to bypass the Same-Origin Policy via a crafted HTML page. The issue affects Headless in Google Chrome prior to version 151.0.7922.72, with the root cause described as an imple...

CVE-2026-17882

CVE-2026-17882 is a policy-bypass flaw in Chrome Extensions. Affects the Extensions component of Google Chrome before 151.0.7922.72; a user tricked into installing a malicious extension could bypass site isolation via a crafted Chrome Extension. Upstream chromium issue 523637452 is cited. Accordi...

CVE-2026-17881

The CVE-2026-17881 entry describes an Integer overflow in WebXR affecting Google Chrome before 151.0.7922.72. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Affected component: WebXR in Chrome (Chromium base). Impacted versions are prior to 151.0.7922.7...

CVE-2026-17877

CVE-2026-17877 describes an insecure implementation in Chromoting within Google Chrome on Linux prior to 151.0.7922.72, enabling a local attacker to achieve OS-level privilege escalation through malicious network traffic. Affected software: Google Chrome (Linux) with Chromoting. Root cause: inapp...

CVE-2026-17878

In Google Chrome/Chromium, CVE-2026-17878 is due to an inappropriate implementation in the CSS component, enabling UXSS via a crafted HTML page. Affected versions are before 151.0.7922.72, with the issue classified as Medium severity. Upstream reference: Chromium issue 522781838. Remediation is t...

CVE-2026-17879

CVE-2026-17879 affects Google Chrome Autofill. The vulnerability stems from an inappropriate implementation in Autofill prior to version 151.0.7922.72, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The CVSS 3.1 base score is 4.3 (Medium) with network attack vector,...

CVE-2026-17880

CVE-2026-17880 involves an inappropriate Autofill implementation in Google Chrome, affecting Chrome versions prior to 151.0.7922.72. The flaw allows a remote attacker to leak cross-origin data via a crafted HTML page, due to a vulnerability in how Autofill processes page content. The CVSS base im...

CVE-2026-17874

CVE-2026-17874 affects Google Chrome on iOS (Chrome for iOS). The vulnerability stems from an inappropriate implementation in Chrome for iOS prior to version 151.0.7922.72, enabling a remote attacker to perform UI spoofing via a crafted HTML page. Impact is UI spoofing; exploitation details are n...

CVE-2026-17875

CVE-2026-17875 is a use-after-free in PDFium used by Google Chrome (desktop) prior to 151.0.7922.72. The vulnerability allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted PDF file. The description and connected sources confirm the underlying issue as a PDFiu...

CVE-2026-17876

CVE-2026-17876 describes an inappropriate implementation in Google Chrome's Payments component that allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome, with the issue present in versions prior to 151.0.7922.72 (as noted in the descripti...

CVE-2026-17873

CVE-2026-17873 affects Google Chrome on iOS prior to 151.0.7922.72 due to insufficient policy enforcement, allowing a remote attacker to bypass discretionary access control via a crafted HTML page. The connected sources do not provide exploitation details (no vector/exploit status stated). Remedi...

CVE-2026-17871

Technical details for CVE-2026-17871 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-17870

CVE-2026-17870 affects Google Chrome (Cast component) with insufficient validation of untrusted input, allowing a local-network attacker to leak cross-origin data via malicious network traffic. Vulnerable in Chrome builds prior to 151.0.7922.72 (Chromium security severity: Medium). The issue is f...

CVE-2026-17872

The CVE-2026-17872 entry describes a Cryptographic Flaw in WebAppInstalls within Google Chrome on Android before version 151.0.7922.72. This vulnerability could allow a local attacker to potentially perform a sandbox escape via a crafted HTML page. The documented impact is a sandbox escape with a...

CVE-2026-17866

CVE-2026-17866 affects Google Chrome on Android (before 151.0.7922.72): Type Confusion in Tab can be exploited by a malicious crafted HTML page after renderer compromise to potentially escape the sandbox. Impact per sources: sandbox escape risk with Low/Low-Impact confidentiality/integrity/availa...

CVE-2026-17869

CVE-2026-17869 is a documented out-of-bounds read in Chrome’s WebXR component. Affected product: Google Chrome (WebXR/Chromium). Root cause: out-of-bounds memory read via a crafted HTML page. Impact: remote attacker could trigger memory read; Chromium notes severity as Medium; CVSS appears as hig...

CVE-2026-17868

CVE-2026-17868 : The provided documents describe an vulnerability in Google Chrome where insufficient policy enforcement in USB handling could enable a remote attacker to escalate privileges via a crafted HTML page. The impact is stated as privilege escalation with high/total impact, and the affe...

CVE-2026-17867

CVE-2026-17867 is an insufficient validation of untrusted input in Dawn (Chromium/Google Chrome) that could allow a remote attacker to escape the sandbox via a crafted HTML page. Upstream description ties this to Dawn in Chrome prior to 151.0.7922.72; Red Hat and Debian entries reference the same...

CVE-2026-17865

CVE-2026-17865 describes an insecure implementation in the Crypto component of Google Chrome on macOS prior to 151.0.7922.72, where a renderer process compromise could enable a sandbox escape via a crafted HTML page. The issue originates in the Chromium Crypto path (upstream bug 520516655). Impac...

CVE-2026-17862

CVE-2026-17862 is a use-after-free in Chromium’s Tracing component affecting Google Chrome on Windows, where a local attacker could escalate to OS-level privileges via a malicious file. Upstream references point to Chromium issue 520426287 describing the flaw. Red Hat notes the use-after-free in ...

CVE-2026-17864

CVE-2026-17864: In Google Chrome on macOS, the Updater has an inappropriate implementation flaw prior to version 151.0.7922.72 that enables local attackers to escalate privileges via a malicious file. Affected component: Chrome for macOS updater; root cause: improper Updater implementation. Impac...

CVE-2026-17863

CVE-2026-17863 describes an insecure implementation in Google Chrome on Windows, before version 151.0.7922.72, enabling a local attacker to escalate privileges via a malicious file. The issue is attributed to an improper or insecure code path in the browser and is listed with a Chromium security ...

CVE-2026-17859

CVE-2026-17859 concerns an inappropriate implementation in Chrome’s favicon handling that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is described as affecting Google Chrome prior to version 151.0.7922.72, with a Chromium security severity of...

CVE-2026-17858

CVE-2026-17858 concerns Google Chrome WebNN on Windows with uninitialized use in WebNN. Affects Chrome versions prior to 151.0.7922.72; exploitation could allow a remote attacker to leak cross-origin data via a crafted HTML page. Upstream bug referenced: chromium issue 520191468. Red Hat and Debi...

CVE-2026-17861

CVE-2026-17861 describes insufficient input validation in the Google Chrome Updater prior to 151.0.7922.72, which allowed a local attacker to escalate to OS-level privileges via a malicious file. The affected component is the Updater within Google Chrome (Chromium-based) and the root cause is unt...

CVE-2026-17860

CVE-2026-17860 corresponds to an insufficient validation of untrusted input in the Mobile component of Google Chrome on Android. A local attacker could spoof the Omnibox (URL bar) by leveraging a malicious file, with impact described as: bypassing input validation in Chromium/Chrome Mobile prior ...

CVE-2026-17855

The CVE-2026-17855 issue is a race in Chrome’s DevTools (Chromium) on macOS that could allow a remote attacker who already compromised the renderer process to escape the sandbox via a crafted HTML page. Affected: Google Chrome with DevTools on macOS before 151.0.7922.72. Root cause: race conditio...

CVE-2026-17856

CVE-2026-17856 affects Google Chrome on macOS before version 151.0.7922.72. An inappropriate implementation in the Network component of Chromium allows a remote attacker who has already compromised a renderer process to potentially perform a sandbox escape via a crafted HTML page. Upstream and Re...

CVE-2026-17857

The CVE-2026-17857 entry affects Google Chrome’s Network component, with an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions are Chrome prior to 151.0.7922.72 (and related builds noted in the linked advisories). T...

CVE-2026-17854

The CVE-2026-17854 entry concerns Google Chrome/Chromium WebMCP with insufficient policy enforcement, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected product is Chromium-based; the vulnerability is tied to WebMCP in Chrome prior to version 151.0.7922....

CVE-2026-17851

CVE-2026-17851 : Side-channel information leakage in Autofill for Google Chrome. A remote attacker who had compromised the renderer could leak cross-origin data via a crafted HTML page. Affected products are Chrome versions prior to 151.0.7922.72; impact is information disclosure (no exploitation...

CVE-2026-17852

CVE-2026-17852 affects Google Chrome’s Media Router component and describes an inappropriate implementation that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability is associated with upstream Chromium bug 519348818 and is stated as affecting Chro...

CVE-2026-17853

CVE-2026-17853 concerns an inappropriate implementation in Chrome’s DevTools (Chromium) prior to 151.0.7922.72. A remote attacker who has compromised the renderer process can inject scripts or HTML into a privileged page via a crafted HTML page. Affected product/component: Chrome/DevTools in Chro...

CVE-2026-17848

CVE-2026-17848 concerns the Google Chrome/Chromium codecs component where an integer overflow in Codecs could allow a remote attacker to perform a sandbox escape via a crafted video file. Affected: Chrome/Chromium environments using Codecs prior to 151.0.7922.72. The vulnerability arises from ins...

CVE-2026-17850

CVE-2026-17850 : In Google Chrome/Chromium, an inappropriate implementation in the Permissions component allows a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected versions are Chrome/Chromium prior to 151.0.7922.72. Impact is described as partial in some reports,...

CVE-2026-17849

In Chrome for iOS (Google Chrome on iOS), CVE-2026-17849 arises from an inappropriate implementation that allowed a remote attacker to spoof the Omnibox (URL bar) by sending malicious network traffic. The issue affects Chrome on iOS prior to version 151.0.7922.72. Root cause is described as an un...

CVE-2026-17844

CVE-2026-17844 affects Google Chrome (Cast component) with insufficient validation of untrusted input, allowing a local-network attacker to leak cross-origin data through malicious traffic. The public descriptions consistently cite the Cast feature as the vulnerable surface, with the issue existi...

CVE-2026-17846

CVE-2026-17846 stems from an inappropriate implementation in the Chromium-based Chrome Media component on Windows, allowing a remote attacker who already compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected software is Google Chrome on Windows, with ...

CVE-2026-17847

The CVE-2026-17847 entry describes an insufficient validation of untrusted input in ANGLE within Chromium-based browsers, enabling a potential sandbox escape via a crafted HTML page. Public documents consistently identify ANGLE as the affected component and Chrome/Chromium versions prior to 151.0...

CVE-2026-17845

The CVE-2026-17845 issue is an Inappropriate implementation in the CSS component of Google Chrome/Chromium that enables UXSS by crafting HTML pages. Affected software: Google Chrome (Chromium-based) with CSS handling before version 151.0.7922.72. Root cause: CSS implementation flaw in Chromium le...