CVE-2026-87652

An incorrect authorization vulnerability in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass the web origin policy using a crafted HTML page. The flaw required user interaction and a pre-compromised renderer, limi...

CVE-2026-87603

CVE-2026-87603 is a missing authorization flaw in the FileSystem component of Google Chrome prior to 153.0.8010.36 . A remote attacker can exploit it by tricking a user into visiting a crafted HTML page , potentially bypassing system access restrictions . The CVSS 3.1 score is 6.5 (Medium) , with...

CVE-2026-87582

A confused deputy vulnerability in the DataTransfer component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 score is 8.3 (HIGH) with...

CVE-2026-87537

Google Chrome versions prior to 153.0.8010.36 are affected by a missing authorization vulnerability in the Extensions component. A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox via crafted network traffic. The vulnera...

CVE-2026-87471

CVE-2026-87471 is an incorrect authorization flaw in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . An attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass site isolation , potentially escalating access to data protected by ...

CVE-2026-87503

CVE-2026-87503 is an inappropriate implementation in the Downloads component of Google Chrome on Android (prior to 153.0.8010.36). A remote attacker can leverage social engineering with a crafted HTML page to bypass system access restrictions, potentially gaining unauthorized access to parts of t...

CVE-2026-87481

CVE-2026-87481 is an incorrect authorization flaw in WebView within Google Chrome on Android (versions prior to 153.0.8010.36 ). A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. Chromiu...

CVE-2026-87485

CVE-2026-87485 affects Google Chrome prior to 153.0.8010.36 and stems from incorrect authorization in CORS (Cross-Origin Resource Sharing). A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to bypass the web origin policy , potentially accessing ...

CVE-2026-87557

CVE-2026-87557 affects Google Chrome prior to 153.0.8010.36 , where a missing authorization in the LocalNetworkAccess component allowed a remote attacker who had already compromised the renderer process to bypass system access restrictions via a crafted HTML page. The vulnerability is rated Mediu...

CVE-2026-87457

CVE-2026-87457 is a race condition in the Updater component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker can leverage the flaw to execute arbitrary code outside the sandbox via a local program, leading to high impact on confidentiality, integrity, and...

CVE-2026-87433

A race condition in the FileAPI component of Google Chrome (prior to 153.0.8010.36 ) allows a remote attacker who has already compromised the renderer process to bypass site isolation by serving a crafted HTML page. Chromium assigns a severity of Medium , while the NVD scores it CVSS 3.1: 8.8 (HI...

CVE-2026-87506

Google Chrome contained a privilege elevation vulnerability in the WebUI component prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability ...

CVE-2026-87442

CVE-2026-87442 is a confused deputy vulnerability in the Prerender component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially bypass the web origin policy via a crafted HTML page, allowing cross-origin access to resourc...

CVE-2026-87553

CVE-2026-87553 is an improper input validation flaw in the SiteIsolation component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox by serving a crafted HTML page. The vulnerab...

CVE-2026-87547

Incorrect reference resolution in the FileSystem component of Google Chrome prior to 153.0.8010.36 allows a remote attacker, leveraging social engineering , to execute arbitrary code outside the sandbox via a crafted HTML page. The CNA-assigned CVSS v3.1 score is 9.6 (Critical) with a network att...

CVE-2026-87515

CVE-2026-87515 is an incorrect authorization vulnerability in the FileAPI component of Google Chrome versions prior to 153.0.8010.36 . A remote attacker can leverage social engineering to deliver a crafted HTML page that bypasses system access restrictions, resulting in a high integrity impact wi...

CVE-2026-87658

CVE-2026-87658 is an information leak in the Extensions component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could leverage social engineering to deliver a crafted Chrome extension, thereby obtaining cross-origin data that should have been isolated. The vulnerability is r...

CVE-2026-87465

CVE-2026-87465 is an incorrect authorization flaw in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to spoof UI elements . The CVSS 3.1 score is 4.2 (Medium...

CVE-2026-87456

CVE-2026-87456 is an uninitialized resource vulnerability in the Media component of Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to read memory outside the sandbox . The CVSS 3.1 score is 3....

CVE-2026-87606

A missing authorization in Google Chrome's SiteIsolation feature prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass site isolation via a crafted HTML page, potentially accessing data or functionality that should be restricted. The vulnerabi...

CVE-2026-87611

A missing authorization flaw in the FileSystem component of Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium rates the severity as Medium ; the CVSS 3.1 score is 3.1 (LOW) w...

CVE-2026-87636

A type confusion in the XML component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with required user interaction but no privileg...

CVE-2026-87453

Google Chrome versions prior to 153.0.8010.36 contained a confused deputy vulnerability in the BackgroundFetch component. A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to leak sensitive information . The CVSS 3.1 score is 5.3 (Medium) , refl...

CVE-2026-87588

CVE-2026-87588 is a use-after-free vulnerability in the Chromecast component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the sandbox . Chromium rates the security severity as Medium , whil...

CVE-2026-87434

CVE-2026-87434 is a missing-authorization vulnerability in CORS handling in Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could bypass the web origin policy using a crafted HTML page, leading to low confidentiality impact. The CVSS 3.1 s...

CVE-2026-87487

Missing authorization in the FileSystem component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker, who had already compromised the renderer process and leveraged social engineering, to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium p...

CVE-2026-87504

CVE-2026-87504 is a use-after-free in the Core component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can execute arbitrary code outside the sandbox via a crafted Chrome extension . Chromium rates the severity as Medium , while the...

CVE-2026-87478

An observable discrepancy in the Autofill component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information by delivering a crafted HTML page . The vulnerability carries a Medium Chromium security severity and a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR...

CVE-2026-87446

CVE-2026-87446 is an incomplete cleanup vulnerability in Google Chrome Extensions affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can install a crafted Chrome extension that bypasses system access restrictions. The Chromium security severity is Medium ,...

CVE-2026-87491

CVE-2026-87491 is an out of bounds write vulnerability in V8 , the JavaScript engine used by Google Chrome . The flaw allows a remote attacker to execute arbitrary code inside the Chrome sandbox by delivering a crafted HTML page to the user. The issue is fixed in Chrome 153.0.8010.36 . The CNA-as...

CVE-2026-87657

A use-after-free flaw in the V8 engine of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to read memory inside the sandbox by loading a crafted HTML page. The Chromium security team rated this Medium severity, and NVD assigned a CVS...

CVE-2026-87640

CVE-2026-87640 is an out-of-bounds read in WebView in Google Chrome on Android prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to read memory outside the sandbox . Chromium classifies the severity as Medium , and NVD a...

CVE-2026-87612

CVE-2026-87612 is a type confusion vulnerability in the V8 JavaScript engine within Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the Chrome sandbox , requiring user interaction (visiting a malicious page)....

CVE-2026-87480

A use after free vulnerability in the Printing component of Google Chrome (prior to 153.0.8010.36 ) allowed a remote attacker who had already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium project rates this as High...

CVE-2026-87581

Use after free vulnerability in the Payments component of Google Chrome prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering, can deliver a crafted HTML page that triggers the flaw, potentially allowing arbitrary code execution outside the browser sandbox . The flaw i...

CVE-2026-87536

CVE-2026-87536 is a use-after-free vulnerability in V8 , the JavaScript engine used by Google Chrome . A remote attacker can achieve arbitrary code execution inside the sandbox by convincing a user to load a crafted HTML page. The fix is included in Chrome 153.0.8010.36 . CVSS v3.1 scores this 8....

CVE-2026-87607

CVE-2026-87607 is a use after free vulnerability in the Device component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page to a user. The vulnerability is rated CRI...

CVE-2026-87474

A use after free vulnerability in the Payments component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium rates the severity as High ; the CVSS 3.1 base score is 9.6 (CRITICAL) with...

CVE-2026-87558

CVE-2026-87558 is a use-after-free vulnerability in the Payments component of Google Chrome on Mac prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , rated CVSS 9.6 (CRITICAL) . CISA's SSVC assessment indicates no know...

CVE-2026-87651

CVE-2026-87651 is an incorrect authorization vulnerability in the Paint component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker could obtain cross-origin data by persuading a user to open a crafted HTML page. The CVSS 3.1 score is 4.3 (Medium) with a vector of A...

CVE-2026-87498

Google Chrome versions prior to 153.0.8010.36 contain a missing authorization flaw in the WebUI component. A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to bypass the web origin policy . Chromium rates the severity as High , while the CNA-ass...

CVE-2026-87552

CVE-2026-87552 is a missing authorization vulnerability in TrustedWebActivities within Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A local attacker with a co-installed app can exploit this to obtain sensitive information. Chromium rates the severity as High ; the NVD-as...

CVE-2026-87587

A use-after-free flaw in the V8 JavaScript engine of Google Chrome (versions prior to 153.0.8010.36 ) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by luring a user into visiting a crafted HTML page. The vulnerability was rated High by Chromium and assigned a CVSS 3...

CVE-2026-87639

A use after free vulnerability in WebPackaging in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium security team rated this High severity. ...

CVE-2026-87564

CVE-2026-87564 is a type confusion vulnerability in the V8 JavaScript engine within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to read memory inside the sandbox . Google classifies the Chromium security severity as High , w...

CVE-2026-87499

CVE-2026-87499 is an incorrect authorization flaw in the Network component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could use a crafted HTML page to bypass site isolation , escalating their access beyond the intended sandbox boun...

CVE-2026-87572

CVE-2026-87572 is an injection vulnerability in DevTools within Google Chrome versions prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 base score is 8.3 (Hi...

CVE-2026-87460

A use-after-free vulnerability in the Platform component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to execute arbitrary code inside the sandbox by convincing a user to open a crafted HTML page. The vulnerability is rated High severity by Chromium and scored 8.8 on C...

CVE-2026-87647

CVE-2026-87647 is an uninitialized resource vulnerability in the GPU component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could read memory outside the sandbox by serving a crafted HTML page. Chromium assigned a security severity o...

CVE-2026-87646

CVE-2026-87646 is a use-after-free vulnerability in Web Authentication in Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS v3.1 score is 9.6 (CRITICAL) with a changed scope (AV:N/AC:L/PR:N/UI:R/S:C/C:...