CVE-2026-87637

CVE-2026-87637 is a use-after-free vulnerability in the Extensions component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . The CNA-assigned CVSS 3.1 score is 9.6 (Cri...

CVE-2026-87531

Google Chrome prior to 153.0.8010.36 is affected by an information leak in CORS (Cross-Origin Resource Sharing) handling. A remote attacker who had already compromised the renderer process could obtain cross-origin data via a crafted HTML page. The vulnerability was rated Medium by Chromium and c...

CVE-2026-87563

CVE-2026-87563 is an origin validation error in the Paint component of Google Chrome (prior to 153.0.8010.36 ). A remote attacker could obtain cross-origin data by serving a crafted HTML page to a victim. The vulnerability is rated Medium severity by Chromium (CVSS 3.1 score 4.3 , requiring user ...

CVE-2026-87625

CVE-2026-87625 is a use-after-free vulnerability in V8 , the JavaScript engine used by Google Chrome, affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted Chrome extension delivered through social engineering to execute arbitrary code inside the Chrome sandbo...

CVE-2026-87510

Google Chrome prior to 153.0.8010.36 is affected by an improper input validation flaw in the FileAPI component. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox by serving a crafted HTML page. The Chromium team rated thi...

CVE-2026-87435

CVE-2026-87435 is an information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain sensitive information by serving a crafted HTML page. The Chromium security severity is Medium , with a CVSS 3.1 score...

CVE-2026-87431

CVE-2026-87431 is a missing authorization flaw in the Extensions component of Google Chrome prior to 153.0.8010.36 . A remote attacker can obtain sensitive information by delivering a crafted Chrome extension to a victim. NVD rates the CVSS 3.1 score at 7.5 (High) with a vector of AV:N/AC:L/PR:N/...

CVE-2026-87468

CVE-2026-87468 is an incorrect authorization flaw in the Isolated component of Google Chrome (Chromium) prior to 153.0.8010.36 . A remote attacker can bypass site isolation by delivering a crafted HTML page to a user. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N...

CVE-2026-87493

CVE-2026-87493 is a missing authorization flaw in the FileSystem component of Google Chrome prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering, can bypass system access restrictions by serving a crafted HTML page. The CVSS 3.1 score is 6.5 (Medium) , with the primar...

CVE-2026-87533

CVE-2026-87533 is a use after free vulnerability in DevTools within Google Chrome prior to version 153.0.8010.36 . A local attacker can leverage it via a local program to execute arbitrary code outside the sandbox, achieving high impact on confidentiality, integrity, and availability with changed...

CVE-2026-87641

A race condition in the Browser component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass system access restrictions by serving a crafted HTML page. The vulnerability is rated Medium severity by Chromium and scored 4.2 (CVSS 3.1) by NVD, reflecting high attack ...

CVE-2026-87535

CVE-2026-87535 is an information loss or omission vulnerability in the Safebrowsing component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could exploit this via a crafted HTML page to bypass system access restrictions . The vulnerability carries a CVSS ...

CVE-2026-87616

An improper initialization flaw in the Views component of Google Chrome on Windows (versions prior to 153.0.8010.36 ) allows a remote attacker who has already compromised the renderer process and leverages social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. C...

CVE-2026-87644

CVE-2026-87644 is an incorrect authorization flaw in Views in Google Chrome on Windows prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process and leveraged social engineering could execute arbitrary code outside the sandbox via a crafted HTML page. The fix shi...

CVE-2026-87635

Google Chrome 's Payments component is vulnerable to UI misrepresentation , where a remote attacker can spoof UI elements via a crafted HTML page. The flaw is classified as Medium severity by Chromium (CVSS v3.1 base score 5.4 , requiring user interaction with low impacts on confidentiality and a...

CVE-2026-87550

CVE-2026-87550 is an improper encoding or escaping flaw in CSS output in Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to bypass the web origin policy via a crafted HTML page. The Chromium security team rated the severity as Medium (CVSS 4.3), requiring user interaction with n...

CVE-2026-87530

Google Chrome on Windows is affected by an uncontrolled search path element in the CredentialProvider component, allowing a local attacker to execute arbitrary code outside the sandbox via a local program. The vulnerability affects versions prior to 153.0.8010.36 , where the fix was released. The...

CVE-2026-87494

A use after free vulnerability in the Browser component of Google Chrome for Windows (versions prior to 153.0.8010.36 ) allows a remote attacker, leveraging social engineering, to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is rated Medium by Chromium but...

CVE-2026-87589

CVE-2026-87589 is an incorrect authorization flaw in SiteIsolation in Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass system access restrictions . The Chromium security team rates the severity a...

CVE-2026-87484

CVE-2026-87484 is a UI misrepresentation vulnerability in the Geometry component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage social engineering to spoof UI elements via a crafted HTML page, requiring user interaction. The Chromium security team ra...

CVE-2026-87483

CVE-2026-87483 is an incorrect authorization flaw in Google Chrome on Android prior to 153.0.8010.36 , rated Medium severity by Chromium. A remote attacker could bypass system access restrictions by serving a crafted HTML page to the user, requiring no special privileges but user interaction to t...

CVE-2026-87454

CVE-2026-87454 is an information leak in Google Chrome Enterprise on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker can obtain sensitive information by luring a user into visiting a crafted HTML page . The vulnerability is rated Medium severity (CVSS 3.1: 6.5, vector AV:N...

CVE-2026-87540

CVE-2026-87540 is an incorrect authorization vulnerability in the Isolated component of Google Chrome , fixed in version 153.0.8010.36 . A remote attacker could deliver a crafted HTML page that causes the browser to spoof UI elements , potentially tricking users into interacting with fraudulent i...

CVE-2026-87622

CVE-2026-87622 is a Medium -severity vulnerability (CVSS 4.3) in Google Chrome 's FedCM (Federated Credential Management) component. A missing authorization check allowed a remote attacker to bypass the web origin policy by serving a crafted HTML page that required user interaction. The flaw affe...

CVE-2026-87450

Incorrect authorization in the Permissions component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted Chrome extension. The vulnerability is rated Medium by Chromium and 7.5 (HIGH) by NVD (CVSS 3.1: AV...

CVE-2026-87594

CVE-2026-87594 is an incorrect authorization flaw in the DataTransfer component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain sensitive information by delivering a crafted HTML page. The vulnerability is rated Medium seve...

CVE-2026-87505

CVE-2026-87505 is an incorrect authorization flaw in the FileSystem component of Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can bypass site isolation using a crafted PDF file , leading to high confidentiality and integrity impact (CVS...

CVE-2026-87518

An observable discrepancy in the Safebrowsing component of Google Chrome on iOS prior to version 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to potentially obtain sensitive information by delivering a crafted HTML page. The vulnerability was rated Medi...

CVE-2026-87570

CVE-2026-87570 is an incorrect authorization flaw in SiteIsolation in Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process and leverages social engineering can bypass site isolation by delivering a crafted file. The NVD assigns a CVSS 3.1 base ...

CVE-2026-87600

Google Chrome for Android prior to version 153.0.8010.36 is affected by an improper input validation vulnerability in the Safebrowsing component. A remote attacker can leverage social engineering to get a user to open a crafted HTML page, enabling a bypass of system access restrictions . The vuln...

CVE-2026-87532

CVE-2026-87532 is an improper state validation flaw in the Safebrowsing component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit the vulnerability by serving a crafted HTML page that causes Chrome to bypass system access restrictions, resulting in a h...

CVE-2026-87451

CVE-2026-87451 is an information leak in the Downloads component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain cross-origin data via a crafted HTML page. The vulnerability is rated Medium by Chromium and carries a CVSS 3....

CVE-2026-87439

CVE-2026-87439 is an information leak in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain sensitive information by serving a crafted HTML page. Chromium rates the severity as Medium (CVSS 3.1 scor...

CVE-2026-87541

CVE-2026-87541 is an information leak in the Navigation component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass site isolation , escalating from a partial renderer compromise to broader acc...

CVE-2026-87555

CVE-2026-87555 is an uninitialized resource flaw in the GPU component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker could exploit this via a crafted HTML page to read memory outside the sandbox , achieving low confidentiality impact with a scope chang...

CVE-2026-87495

CVE-2026-87495 is an information leak in the Scroll component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to leak cross-origin data , resulting in a low confidentiality impact . Chromium rates this ...

CVE-2026-87574

CVE-2026-87574 is an information leak in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker can exploit the flaw by delivering a crafted HTML page that causes the ServiceWorker to expose cross-origin data to the attacker, resulting in a low confidentiality imp...

CVE-2026-87496

CVE-2026-87496 is a UI misrepresentation vulnerability in the Browser component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof browser UI elements via a crafted HTML page. The CVSS 3.1 score is 5.4 (Medium) , reflecting a network attack vec...

CVE-2026-87458

CVE-2026-87458 is a UI misrepresentation vulnerability in the Geometry component of Google Chrome versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof UI elements via a crafted HTML page, requiring user interaction but no prior privileges. The Chromium t...

CVE-2026-87441

CVE-2026-87441 is a missing authorization vulnerability in the Downloads component of Google Chrome prior to 153.0.8010.36 . A remote attacker can leverage a crafted Chrome extension to bypass system access restrictions, resulting in a high integrity impact without confidentiality or availability...

CVE-2026-87567

A UI misrepresentation vulnerability in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering, to spoof the address bar using a crafted domain name. The Chromium security team rated this Medium severity. NVD scored it 4.3 (CVSS 3.1) with lo...

CVE-2026-87549

CVE-2026-87549 is an incomplete cleanup vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36 . A remote attacker leveraging social engineering can bypass system access restrictions by serving a crafted HTML page. The NVD scores it CVSS 3.1: 6.5 (Medium) with a ...

CVE-2026-87486

CVE-2026-87486 is a clickjacking vulnerability in TrustedWebActivities in Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A local attacker can exploit a co-installed app to spoof the address bar , potentially tricking users into interacting with a malicious page while belie...

CVE-2026-87649

CVE-2026-87649 is a UI misrepresentation vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could use a crafted HTML page to bypass system access restrictions. User interaction is required (the...

CVE-2026-87655

CVE-2026-87655 is a clickjacking vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could spoof UI elements via a crafted HTML page. The Chromium security severity is rated Medium , with a CVSS...

CVE-2026-87445

CVE-2026-87445 is a UI misrepresentation vulnerability in the Session component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can spoof UI elements by serving a crafted HTML page, requiring user interaction but no prior privileges. The vulnerability is rated Med...

CVE-2026-87472

CVE-2026-87472 is an improper input validation vulnerability in the FedCM (Federated Credential Management) component of Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to spoof UI elements ...

CVE-2026-87462

Google Chrome prior to 153.0.8010.36 contained a UI misrepresentation in FedCM (Federated Credential Management), allowing a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability is rated Medium severity (CVSS 3.1: 5.4 , AV:N/AC:L/PR:N/UI:R/...

CVE-2026-87452

CVE-2026-87452 is an incorrect authorization flaw in the GPU component of Google Chrome on Mac prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially obtain cross-origin data by serving a crafted HTML page. The vulnerability carries a...

CVE-2026-87501

CVE-2026-87501 is a UI misrepresentation vulnerability in the Passwords component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could exploit it by serving a crafted HTML page to spoof UI elements , potentially misleading users interacting with the browser's password managem...