CVE-2026-87574

CVE-2026-87574 is an information leak in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker can exploit the flaw by delivering a crafted HTML page that causes the ServiceWorker to expose cross-origin data to the attacker, resulting in a low confidentiality imp...

CVE-2026-87496

CVE-2026-87496 is a UI misrepresentation vulnerability in the Browser component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof browser UI elements via a crafted HTML page. The CVSS 3.1 score is 5.4 (Medium) , reflecting a network attack vec...

CVE-2026-87458

CVE-2026-87458 is a UI misrepresentation vulnerability in the Geometry component of Google Chrome versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof UI elements via a crafted HTML page, requiring user interaction but no prior privileges. The Chromium t...

CVE-2026-87441

CVE-2026-87441 is a missing authorization vulnerability in the Downloads component of Google Chrome prior to 153.0.8010.36 . A remote attacker can leverage a crafted Chrome extension to bypass system access restrictions, resulting in a high integrity impact without confidentiality or availability...

CVE-2026-87567

A UI misrepresentation vulnerability in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering, to spoof the address bar using a crafted domain name. The Chromium security team rated this Medium severity. NVD scored it 4.3 (CVSS 3.1) with lo...

CVE-2026-87549

CVE-2026-87549 is an incomplete cleanup vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36 . A remote attacker leveraging social engineering can bypass system access restrictions by serving a crafted HTML page. The NVD scores it CVSS 3.1: 6.5 (Medium) with a ...

CVE-2026-87486

CVE-2026-87486 is a clickjacking vulnerability in TrustedWebActivities in Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A local attacker can exploit a co-installed app to spoof the address bar , potentially tricking users into interacting with a malicious page while belie...

CVE-2026-87649

CVE-2026-87649 is a UI misrepresentation vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could use a crafted HTML page to bypass system access restrictions. User interaction is required (the...

CVE-2026-87655

CVE-2026-87655 is a clickjacking vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could spoof UI elements via a crafted HTML page. The Chromium security severity is rated Medium , with a CVSS...

CVE-2026-87445

CVE-2026-87445 is a UI misrepresentation vulnerability in the Session component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can spoof UI elements by serving a crafted HTML page, requiring user interaction but no prior privileges. The vulnerability is rated Med...

CVE-2026-87472

CVE-2026-87472 is an improper input validation vulnerability in the FedCM (Federated Credential Management) component of Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to spoof UI elements ...

CVE-2026-87462

Google Chrome prior to 153.0.8010.36 contained a UI misrepresentation in FedCM (Federated Credential Management), allowing a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability is rated Medium severity (CVSS 3.1: 5.4 , AV:N/AC:L/PR:N/UI:R/...

CVE-2026-87452

CVE-2026-87452 is an incorrect authorization flaw in the GPU component of Google Chrome on Mac prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially obtain cross-origin data by serving a crafted HTML page. The vulnerability carries a...

CVE-2026-87501

CVE-2026-87501 is a UI misrepresentation vulnerability in the Passwords component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could exploit it by serving a crafted HTML page to spoof UI elements , potentially misleading users interacting with the browser's password managem...

CVE-2026-87548

CVE-2026-87548 affects the Installer component of Google Chrome prior to version 153.0.8010.36 . The root cause is an improper state validation flaw, which allows a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability requires user interaction (the attac...

CVE-2026-87516

A medium-severity vulnerability in the Navigation component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is described as an observable discrepancy in the Navigation subsystem. The CVSS v3.1 base score is 4.3 (AV...

CVE-2026-87507

CVE-2026-87507 is a UI misrepresentation vulnerability in the Downloads component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof UI elements via a crafted HTML page, potentially tricking users into interacting with malicious content disguis...

CVE-2026-87559

A UI misrepresentation vulnerability in Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering , to spoof UI elements via a crafted HTML page. The flaw resides in Chrome's UI subsystem, where a crafted page could cause the browser to render misleading interf...

CVE-2026-87599

CVE-2026-87599 is an improper input validation flaw in the Interstitials component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to spoof UI elements , rated Medium severity by Chromium (CVSS 3.1: 5.4, network vector, user ...

CVE-2026-87534

CVE-2026-87534 is a missing authorization flaw in the WebView component of Google Chrome on Android prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering, can bypass system access restrictions via specially crafted network traffic . The Chromium team rates the severity...

CVE-2026-87573

CVE-2026-87573 is an improper input validation vulnerability in the Network component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can bypass the web origin policy by serving a crafted HTML page, leading to a low confidentiality impact (no integrity or availability impact p...

CVE-2026-87643

CVE-2026-87643 is an integer overflow in the GPU component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by luring a user to a crafted HTML page. The vulnerability was rated Medium by Chromi...

CVE-2026-87508

CVE-2026-87508 is an incorrect authorization flaw in the Loader component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage a crafted HTML page to bypass the web origin policy , resulting in limited confidentiality impact. The vulnerability requires use...

CVE-2026-87562

CVE-2026-87562 is a medium-severity vulnerability in the Accessibility component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . The root cause is incorrect reference resolution , which allows a remote attacker to potentially spoof UI elements by serving a crafted HTML page....

CVE-2026-87556

CVE-2026-87556 is a missing authorization vulnerability in the Browser component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can bypass system access restrictions by delivering a crafted HTML page to the victim. The NVD-assigned CVSS v3.1 score is 4.3 (Medium) , with a net...

CVE-2026-87432

CVE-2026-87432 is an incorrect authorization flaw in the Navigation component of Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can exploit it to spoof UI elements via a crafted HTML page. The vulnerability requires user interaction and h...

CVE-2026-87513

CVE-2026-87513 is a missing authorization flaw in the ControlledFrame component of Google Chrome (Chromium), affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can trick a user into interacting with a crafted HTML page , bypassing system access restriction...

CVE-2026-87539

Google Chrome (prior to 153.0.8010.36 ) is affected by an observable discrepancy in the Network component that allows a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability is rated Medium by Chromium and scored 3.1 (Low) on CVSS v3.1, reflecting high attack comp...

CVE-2026-87479

CVE-2026-87479 is an insufficient policy enforcement vulnerability in the Extensions component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage social engineering and a crafted HTML page to execute arb...

CVE-2026-87521

Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to obtain cross-origin data via a crafted HTML page. The vulnerability requires the renderer to be compromised first, making it a secondary exploit primiti...

CVE-2026-87560

CVE-2026-87560 is a missing authorization vulnerability in the Browser component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it by serving a crafted HTML page , enabling them to bypass system access restrictions . The NVD-assigned CVSS 3.1 score is 4.3 (Medium)...

CVE-2026-87648

A use-after-free vulnerability in ANGLE within Google Chrome on Windows (prior to 153.0.8010.36 ) allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability requires user interactio...

CVE-2026-87436

CVE-2026-87436 is an incomplete cleanup flaw in the Browser component of Google Chrome prior to 153.0.8010.36 , allowing a remote attacker leveraging social engineering to bypass the web origin policy via a crafted Chrome extension. The CVSS 3.1 score is 6.5 (Medium) with an attack vector of netw...

CVE-2026-87475

CVE-2026-87475 is a missing authorization flaw in the Omnibox component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering via a crafted HTML page, can bypass system access restrictions and gain access to a privileged page. The flaw carries a Medium Chromiu...

CVE-2026-87476

Incorrect authorization in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability carries a Medium Chromium security severity with a CVSS v3.1 base score of 6.5 (network vector, user...

CVE-2026-87579

A buffer overflow in WebRTC within Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the browser's sandbox by luring a user into visiting a crafted HTML page. The vulnerability is classified as Medium severity by Chromium, while the CVSS 3.1 s...

CVE-2026-87580

Incorrect authorization in the WebAppInstalls component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass site isolation via a crafted HTML page, leveraging social engineering. The vulnerability carries a CVSS 3.1 score of...

CVE-2026-87497

CVE-2026-87497 is an uninitialized resource vulnerability in the Codecs component of Google Chrome prior to version 153.0.8010.36 , allowing a remote attacker to read memory inside the sandbox via a crafted HTML page. The Chromium security team rates this as Medium severity with a CVSS v3.1 score...

CVE-2026-87482

CVE-2026-87482 is a cleartext transmission vulnerability in the HttpsUpgrades component of Google Chrome on iOS , affecting versions prior to 153.0.8010.36 . A remote attacker can leak sensitive information via crafted network traffic, rated CVSS 5.9 (Medium) by Chromium. The fix is to update Goo...

CVE-2026-87576

CVE-2026-87576 is an uninitialized resource in the GPU component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit this via a crafted HTML page to read memory outside the sandbox . The Chromiu...

CVE-2026-87645

CVE-2026-87645 is an improper state validation flaw in the Safebrowsing component of Google Chrome prior to 153.0.8010.36 . A remote attacker could leverage a crafted HTML page to bypass system access restrictions. The Chromium project rates the severity as Medium , with NVD assigning a CVSS 3.1 ...

CVE-2026-87443

Google Chrome prior to 153.0.8010.36 is affected by a missing authorization vulnerability in the Actor component. A remote attacker could obtain sensitive information by luring a user into visiting a crafted HTML page. The Chromium project rates this as Medium severity, with a CVSS 3.1 score of 6...

CVE-2026-87577

Google Chrome versions prior to 153.0.8010.36 are affected by an incorrect authorization flaw in the Isolated component. A remote attacker can leverage a crafted HTML page to bypass the web origin policy and reach a privileged page, resulting in a limited confidentiality impact. The vulnerability...

CVE-2026-87590

CVE-2026-87590 is an improper input validation vulnerability in the Passwords component of Google Chrome (also affecting chromium-browser packages on Linux distributions). Versions prior to 153.0.8010.36 allow a remote attacker to potentially leak sensitive information by sending crafted network ...

CVE-2026-87630

CVE-2026-87630 is an integer overflow in WebRTC within Google Chrome prior to version 153.0.8010.36 , allowing a remote attacker to read memory inside the sandbox via a crafted HTML page. The Chromium team classified the severity as Medium , with a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C...

CVE-2026-87449

CVE-2026-87449 is a cross-site request forgery (CSRF) vulnerability in DeviceBoundSessionCredentials within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker could bypass the web origin policy by serving a crafted HTML page to a user, requiring user interaction (CVSS 4...

CVE-2026-87613

CVE-2026-87613 is an incorrect reference resolution flaw in the Extensions component of Google Chrome prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium classifies the severity as Medium , while the CNA-ass...

CVE-2026-87615

CVE-2026-87615 is a race condition in the Payments component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can spoof UI elements via a crafted HTML page, achieving low impact on confidentiality and availability with no integrity imp...

CVE-2026-87466

CVE-2026-87466 is an incorrect authorization flaw in Service Workers within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can deliver a crafted HTML page that causes a bypass of the web origin policy , potentially allowing unauthorized cross-origin access with low ...

CVE-2026-87642

CVE-2026-87642 is an uninitialized resource vulnerability in the WebGL component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit a crafted HTML page to leak cross-origin data . The Chromium security team rated this as Medium severity, with a CVSS 3.1 s...