CVE-2026-87490

An information disclosure vulnerability in the Transactions Platform component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information by convincing a user to visit a crafted HTML page . The underlying root-cause mechanism beyond the crafted-page ...

CVE-2026-87605

CVE-2026-87605 is a missing authorization vulnerability in the Contacts component of Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could, by leveraging social engineering and serving a crafted HTML page, potentially obtain sensit...

CVE-2026-87583

A UI misrepresentation vulnerability in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36 ) allows a remote attacker to spoof UI elements via a crafted HTML page. The attacker requires user interaction but no prior privileges, with the primary consequence being low impac...

CVE-2026-87597

Google Chrome on Android versions prior to 153.0.8010.36 are affected by a UI misrepresentation vulnerability in the CustomTabs component. A remote attacker could spoof the address bar by leveraging a co-installed app. The vulnerability is rated Low by Chromium and carries a CVSS 3.1 base score o...

CVE-2026-87509

CVE-2026-87509 is an incorrect authorization flaw in the Updater component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker can leverage this to execute arbitrary code outside the sandbox via a local program. Chromium rates the severity as Low , while the...

CVE-2026-87624

Google Chrome for Android is affected by a UI misrepresentation vulnerability in the Passwords component, fixed in version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could spoof UI elements via a crafted HTML page. The CVSS 3.1 score is 4.2 (Medium) , refle...

CVE-2026-87617

A use-after-free vulnerability in DevTools within Google Chrome prior to 153.0.8010.36 allows a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium assigns a Low security severity, while the CNA-assigned CVSS 3.1 score is 8....

CVE-2026-87546

An incorrect type conversion or cast in the Safebrowsing component of Google Chrome on Mac allowed a remote attacker to bypass system access restrictions by exploiting a crafted file. The vulnerability is rated Low by Chromium and 4.3 (Medium) by NVD under CVSS v3.1, with the primary impact being...

CVE-2026-87523

A race condition in the DataTransfer component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to obtain sensitive information . The CVSS 3.1 score is 6.5 (MEDIUM) with high confidentiality impact , while Chromium rates the...

CVE-2026-87565

CVE-2026-87565 is an information disclosure vulnerability in Google Chrome for Android prior to 153.0.8010.36 , affecting the Passwords component. A remote attacker can exploit it by serving a crafted HTML page to leak sensitive information, with no privileges required but user interaction necess...

CVE-2026-87545

CVE-2026-87545 is an information leak vulnerability in Google Chrome Mobile on iOS prior to version 153.0.8010.36 . A remote attacker can leverage social engineering to exfiltrate sensitive information via a crafted HTML page. The underlying flaw is an information leak in the Mobile component. Ch...

CVE-2026-87463

CVE-2026-87463 is an incorrect authorization vulnerability in the Certificate component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially spoof the address bar via crafted network traffic. Chromium rates the security severity as Low , an...

CVE-2026-87538

CVE-2026-87538 is a clickjacking vulnerability in Google Chrome 's Input component, affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage social engineering to spoof UI elements via a crafted HTML page. Chromium rates the sev...

CVE-2026-87620

CVE-2026-87620 affects the SVG rendering component in Google Chrome prior to 153.0.8010.36 . An observable discrepancy in SVG processing allowed a remote attacker to obtain sensitive information by serving a crafted HTML page. The vulnerability requires user interaction (visiting a malicious page...

CVE-2026-87459

Google Chrome prior to 153.0.8010.36 contains an observable discrepancy in the Select HTML component that allows a remote attacker to obtain sensitive information via a crafted HTML page. The Chromium security team rated this as Low severity, while the NVD CVSS 3.1 score is 6.5 (MEDIUM) with a ve...

CVE-2026-87448

A use-after-free vulnerability in the DevTools component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. Chromium classifies the severity as Low , while the CVSS 3.1 score is 9.6 (Cr...

CVE-2026-87595

CVE-2026-87595 is a server-side request forgery (SSRF) vulnerability in Google Chrome (Mobile), affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could bypass system access restrictions via a crafted HTML page. The Chromium security severity is rated L...

CVE-2026-87502

CVE-2026-87502 is a confused deputy vulnerability in the Fullscreen component of Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process and leverages social engineering can spoof UI elements via a crafted HTML page. Chromium rates the severity as...

CVE-2026-87592

CVE-2026-87592 is an out-of-bounds read vulnerability in the Tint component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can potentially read memory inside the sandbox by delivering a crafted HTML page that triggers the flaw. The CVSS 3.1 base score is 4.3 (Medium) with the...

CVE-2026-87511

CVE-2026-87511 is a missing authorization flaw in DevTools within Google Chrome prior to 153.0.8010.36 . A remote attacker could leverage a crafted Chrome extension to obtain cross-origin data . The vulnerability is rated Low severity by Chromium. The fix is available in Chrome 153.0.8010.36 . No...

CVE-2026-87627

CVE-2026-87627 is an interpretation conflict in the Safebrowsing component of Google Chrome on macOS , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering could use a crafted file to bypass system access restrictions . Chromium rates the security severity a...

CVE-2026-87656

CVE-2026-87656 is an improper state validation vulnerability in Google Chrome's Safebrowsing component, affecting versions prior to 153.0.8010.36 . A remote attacker could exploit it via a crafted HTML page to bypass system access restrictions . The NVD assigns a CVSS 3.1 score of 5.4 (MEDIUM) wi...

CVE-2026-87543

Google Chrome prior to 153.0.8010.36 contained a missing authorization flaw in the Core component. A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to bypass site isolation , a key sandboxing boundary in Chrome's multi-process architectur...

CVE-2026-87522

CVE-2026-87522 is a missing authorization vulnerability in the WebView component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can potentially bypass system access restrictions via crafted network traffic. Chromium rates ...

CVE-2026-87568

CVE-2026-87568 affects Chromium in Google Chrome prior to 153.0.8010.36 . An improper input validation flaw allowed a remote attacker who had already compromised the renderer process to spoof UI elements via crafted network traffic. Chromium rated the severity as Low ; NVD assigned CVSS 4.3 (Medi...

CVE-2026-87519

CVE-2026-87519 is an incorrect authorization vulnerability in the Safebrowsing component of Google Chrome prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering , can trick a user into interacting with a crafted HTML page that bypasses system access restrictions. The CV...

CVE-2026-87598

CVE-2026-87598 affects the ServiceWorker component in Google Chrome prior to 153.0.8010.36 , where an incorrect authorization allows a remote attacker to bypass the web origin policy by serving a crafted HTML page to the victim. Chromium rates the severity as Low ; the CVSS 3.1 score is 4.3 (Medi...

CVE-2026-87429

CVE-2026-87429 is a missing authorization flaw in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to bypass system access restrictions . Chromium rates the severity as...

CVE-2026-87561

CVE-2026-87561 affects Google Chrome prior to 153.0.8010.36 , where an incorrect authorization in the Web Authentication component allowed a remote attacker to bypass the web origin policy via a crafted Chrome extension. Chromium rated the issue Low severity; NVD assigned a CVSS 3.1 base score of...

CVE-2026-87619

CVE-2026-87619 affects Google Chrome prior to 153.0.8010.36 , where an observable discrepancy in the Prefetch mechanism allowed a remote attacker to leak cross-origin data via a crafted HTML page. The Chromium team rated this Low severity; NVD scores it CVSS 4.3 (Medium) with a network vector, lo...

CVE-2026-87614

CVE-2026-87614 is an incorrect authorization flaw in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could bypass the web origin policy via a crafted HTML page. Chromium rates the severity as Low (CVSS 3.1 ba...

CVE-2026-87618

CVE-2026-87618 affects Google Chrome on Windows prior to version 153.0.8010.36 . The vulnerability is an incorrect reference resolution in the Storage component, allowing a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox v...

CVE-2026-87653

CVE-2026-87653 is a UI misrepresentation vulnerability in the FullScreen component of Google Chrome on Windows prior to version 153.0.8010.36 . A remote attacker could exploit it via a crafted HTML page to spoof UI elements , potentially deceiving users into interacting with malicious interfaces ...

CVE-2026-87609

A use-after-free vulnerability in the Sharing component of Google Chrome on iOS prior to version 153.0.8010.36 allows a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. The flaw requires user interaction and no prior privileges. The CNA-assigned CVSS 3.1 ...

CVE-2026-87626

CVE-2026-87626 is an incorrect authorization flaw in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 . A remote attacker can bypass the web origin policy via crafted network traffic, resulting in a high integrity impact with no confidentiality or availability i...

CVE-2026-87629

Google Chrome prior to version 153.0.8010.36 is affected by an incorrect authorization vulnerability in the Sources component. A remote attacker leveraging social engineering can leak sensitive information via a crafted HTML page. Chromium rates the security severity as Low . The CVSS 3.1 base sc...

CVE-2026-87634

CVE-2026-87634 is a use-after-free vulnerability in the WebPackaging component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page requiring user interaction. Despite a CVSS 3...

CVE-2026-87610

CVE-2026-87610 is an incorrect authorization flaw in the Omnibox component of Google Chrome prior to 153.0.8010.36 . A remote attacker can deliver a crafted HTML page that bypasses system access restrictions, granting access to a privileged page . The Chromium security severity is Medium (CVSS 3....

CVE-2026-87526

A use-after-free vulnerability in the Passwords component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker, leveraging social engineering and UI interaction, to potentially execute arbitrary code outside the sandbox . The CVSS 3.1 score is 9.6 (CRITICAL) , while Chromium r...

CVE-2026-87623

This Medium -severity vulnerability affects the DOM (Document Object Model) in Google Chrome prior to 153.0.8010.36 . An observable discrepancy in the DOM allows a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted HTML page. The CVSS v3.1 score is 6.5 ...

CVE-2026-87528

A type confusion in Rust in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium rates the severity as Medium , while the NVD CVSS 3.1 score is 9.6 (CRITICAL) with a network attack vec...

CVE-2026-87638

CVE-2026-87638 is an out of bounds write in the Media component of Google Chrome prior to 153.0.8010.36 . A remote attacker can potentially execute arbitrary code outside the sandbox by persuading a user to open a crafted HTML page. The CNA (chrome-cve-admin) assigns CVSS 3.1: 9.6 (CRITICAL) with...

CVE-2026-87455

A use-after-free vulnerability in the Aura component of Google Chrome prior to 153.0.8010.36 allows a remote attacker, via a crafted HTML page, to potentially execute arbitrary code outside the sandbox. Chromium rated this Medium severity, while the CNA-assigned CVSS 3.1 score is 9.6 (Critical) ,...

CVE-2026-87591

Incorrect authorization in the Extensions component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted Chrome extension. The attack requires user interaction but no prior privileges, with a High impact on integrity and no impact on ...

CVE-2026-87566

An observable discrepancy in the Layout component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information by convincing a user to open a crafted HTML page . The Chromium security team rated the severity as Medium , with a CVSS 3.1 base score of 5.3 (network...

CVE-2026-87584

An incorrect authorization flaw in the WebUI component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to a privileged page within the browser's WebUI by serving a crafted HTML page . The vulnerability requires use...

CVE-2026-87632

Google Chrome prior to 153.0.8010.36 is affected by a cross-site scripting vulnerability in the SanitizerAPI component. A remote attacker can deliver a crafted HTML page that bypasses the web origin policy , enabling unauthorized script execution in the context of another origin. The vulnerabilit...

CVE-2026-87470

CVE-2026-87470 is an improper quantity validation flaw in the Tint component of Google Chrome on Mac prior to 153.0.8010.36 . A remote attacker could execute arbitrary code outside the sandbox by serving a crafted HTML page, requiring user interaction to trigger the exploit. Chromium classifies t...

CVE-2026-87529

CVE-2026-87529 is a numeric truncation error in the Media component of Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium classifies the severity as Medium , while the CVSS 3.1 score is 9.6 ...

CVE-2026-87586

CVE-2026-87586 is an out-of-bounds read in ANGLE , the multi-platform graphics rendering layer used by Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit the flaw via a crafted HTML page to read memory outside the sandbox . The Chromium project rates the severity as Medi...