CVE-2026-12450

CVE-2026-12450 describes an inappropriate implementation in the Media component of Google Chrome (Chromium-based) prior to build 149.0.7827.155. The underlying issue allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability...

CVE-2026-13805

CVE-2026-13805 is a use-after-free vulnerability in the GFX component of Google Chrome on macOS, fixed in Chrome 150.0.7871.47 and later. The issue allowed a remote attacker to execute arbitrary code via a crafted HTML page; severity is High. Affected are Chrome builds prior to 150.0.7871.47. Rem...

CVE-2026-13820

CVE-2026-13820 : An out-of-bounds read in Skia used by Google Chrome on macOS prior to 150.0.7871.47 allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue affects Chrome’s rendering path (Skia) on macOS, with the root cause ...

CVE-2026-13866

CVE-2026-13866 affects Google Chrome on Android prior to 150.0.7871.47. The issue is an inappropriate implementation in Input that lets a remote attacker with renderer access bypass site isolation via a crafted HTML page. Impact is a site-isolation bypass with potential access to other origins; n...

CVE-2026-13880

Google Chrome for macOS prior to 150.0.7871.47 is affected by CVE-2026-13880 due to a use-after-free in USB handling that could allow a remote attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page. The issue affects Chrome on Mac, with the mitigation bein...

CVE-2026-13932

The set of connected documents confirms CVE-2026-13932 affects Google Chrome on Android, due to an inappropriate implementation in Sharing that allowed a remote attacker with renderer access to leak cross-origin data via a crafted HTML page. Affected version range is prior to 150.0.7871.47; the i...

CVE-2026-13984

The CVE-2026-13984 entry covers Google Chrome’s TabStrip UI security flaw. Affects Chrome versions before 150.0.7871.47, allowing a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is due to incorrect security UI behavior in the TabStrip, as described across multi...

CVE-2026-14087

Affected software: Google Chrome on Windows. Vulnerable component: WebNN. Issue: heap buffer overflow leading to potential heap corruption. Root cause: heap overflow in WebNN path as described in multiple sources for CVE-2026-14087 (prior to version 150.0.7871.47). Impact: remote attacker who has...

CVE-2026-14097

CVE-2026-14097 describes an inappropriate implementation in WebAppInstalls for Google Chrome on macOS, prior to version 150.0.7871.47. The underlying issue allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Th...

CVE-2026-14124

CVE-2026-14124 affects Google Chrome on Windows (before version 150.0.7871.47). The vulnerability is due to an inappropriate CredentialProvider implementation, enabling a local attacker to escalate privileges via a malicious file. The described impact is OS-level, with high confidentiality, integ...

CVE-2026-15772

The CVE-2026-15772 entry describes a Use-After-Free in the GPU component of Google Chrome on Android prior to version 150.0.7871.125, which could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is classified...

CVE-2026-17793

CVE-2026-17793 describes an inappropriate implementation flaw in the Messages component of the Chromium-based Google Chrome on Android, prior to version 151.0.7922.72. The issue enables a remote attacker to perform UI spoofing via a crafted HTML page, due to the root cause described as an inappro...

CVE-2026-2320

CVE-2026-2320 affects Google Chrome prior to 145.0.7632.45, with an inappropriate implementation in the File input that allowed a remote attacker to induce UI spoofing via a crafted HTML page after social engineering a user into specific UI gestures. The impact is described as UI spoofing (Medium...

CVE-2026-4442

CVE-2026-4442 is a Chrome/Chromium-related vulnerability described as a heap buffer overflow in CSS that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Google Chrome prior to 146.0.7680.153. Impact as stated: high severity with potential for arbi...

CVE-2026-4461

CVE-2026-4461 affects Google Chrome’s V8 engine and Chrome/Chromium builds prior to 146.0.7680.153, where an inappropriate V8 implementation could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue is rated High severity (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, bas...

CVE-2026-4463

CVE-2026-4463 is a heap buffer overflow in Chrome’s WebRTC component that could allow remote heap corruption via a crafted HTML page. Affected product: Google Chrome (WebRTC path); root cause: heap buffer overflow; impact: high (remote code execution/impact on confidentiality, integrity, availabi...

CVE-2026-7334

CVE-2026-7334 is a report of a Use-After-Free in the Chromium-based Google Chrome browser’s Views component on macOS, leading to potential heap corruption via a crafted HTML page. The issue affects Google Chrome versions before 147.0.7727.138; multiple sources (NVD, Debian, Red Hat, EUVD) describ...

CVE-2026-78938

CVE-2026-78938 is a type confusion vulnerability in the V8 JavaScript engine shipped with Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit it by delivering a crafted HTML page , requiring only user interaction (visiting the page) to execute arbitrary code inside the br...

CVE-2026-7906

CVE-2026-7906 is a Chrome SVG use-after-free vulnerability affecting Chrome prior to 148.0.77 78.96. A crafted HTML page could trigger a remote exploit to execute arbitrary code inside the Chrome sandbox. Connected advisories corroborate the issue as a use-after-free in SVG rendering with high se...

CVE-2026-79064

CVE-2026-79064 is a use after free in the Network component of Google Chrome on Mac (versions prior to 152.0.7977.65 ). A remote attacker leveraging social engineering can achieve arbitrary code execution outside the sandbox via a crafted Chrome extension . Chromium rates the severity as Medium ,...

CVE-2026-7914

CVE-2026-7914 describes a Type Confusion in Chrome on Windows (Accessibility component) that could allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page. The issue affects Google Chrome before version 148.0.7778.96. The root cause is a type confusion in the Accessibi...

CVE-2026-79149

CVE-2026-79149 is a use-after-free vulnerability in ANGLE , a rendering component used in Google Chrome prior to version 152.0.7977.65 . A remote attacker can trigger the flaw by delivering a crafted HTML page to the victim, leading to arbitrary code execution outside the Chrome sandbox and poten...

CVE-2026-7917

CVE-2026-7917 describes a use-after-free in Chrome’s Fullscreen handling on Windows, prior to version 148.0.7778.96. A remote attacker who has already compromised the renderer could potentially escape the sandbox via a crafted HTML page. The issue is tied to Google Chrome/Chromium security fixes ...

CVE-2026-79224

CVE-2026-79224 is a use-after-free vulnerability in the Chromecast component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to execute arbitrary code outside the sandbo...

CVE-2026-79293

An information leak in the Animation component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to obtain sensitive information by visiting a crafted HTML page . The vulnerability is rated Medium severity (CVSS 3.1: 6.5 ) with a network attack vector, no privileges requir...

CVE-2026-8517

The CVE-2026-8517 entry describes an object lifecycle issue in Chrome’s WebShare on macOS prior to version 148.0.7778.168. The vulnerability allows a remote attacker to execute arbitrary code when a user is persuaded to perform specific UI gestures on a crafted HTML page. This is tied to the Chro...

CVE-2026-8574

This CVE concerns Google Chrome on Windows, where a Use-after-Free in Core could let a remote attacker who already compromised the renderer process escape the sandbox via a crafted HTML page. Affected versions are before 148.0.7778.168. The root cause is a use-after-free in Core; the document spe...

CVE-2026-8575

CVE-2026-8575 : In Google Chrome (Chromium UI) before 148.0.7778.168, a use-after-free in the UI could be triggered by a crafted HTML page after an attacker compromised the renderer process, potentially enabling a sandbox escape. The reported impact is a high-severity outcome (per CVSS) with cros...

CVE-2026-87586

CVE-2026-87586 is an out-of-bounds read in ANGLE , the multi-platform graphics rendering layer used by Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit the flaw via a crafted HTML page to read memory outside the sandbox . The Chromium project rates the severity as Medi...

CVE-2026-9122

CVE-2026-9122 : Out-of-bounds read in the GPU component of Google Chrome on macOS, before version 148.0.7778.179. A remote attacker could read potentially sensitive data from process memory via a crafted HTML page. Existence of fixed version is implied by the version boundary; update to the patch...

CVE-2026-9900

CVE-2026-9900 is an out-of-bounds write in ANGLE found in Google Chrome prior to 148.0.7778.216, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. The issue affects ANGLE within Chromium/Chrome and is discussed in multiple sources (NVD, ENISA EU...

CVE-2026-9935

Summary (CVE-2026-9935): Uninitialized Use in ANGLE affects Google Chrome’s ANGLE component, prior to version 148.0.7778.216. The root cause is an uninitialized use flaw in ANGLE, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The CVSSv3.1 vector (AV:N/AC:L/PR:N...

CVE-2026-9961

This CVE concerns a use-after-free in SurfaceCapture in Google Chrome prior to 148.0.7778.216, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. Root cause: use-after-free in SurfaceCapture. Impact: high severity (C:H/I:H/A:H). Mitigation: upgrade Chrome to ...

CVE-2025-12905

CVE-2025-12905 affects Google Chrome on Windows: an Inappropriate implementation in Downloads allows bypass of Mark of the Web via a crafted HTML page. Root cause is improper handling in Chrome’s Downloads feature prior to 140.0.7339.80. Impact is bypass of a security boundary (MOF) with low seve...

CVE-2026-10930

CVE-2026-10930 describes an out-of-bounds read in ANGLE used by Google Chrome on macOS, exploitable via a crafted HTML page. The issue affects Chrome on Mac prior to version 149.0.7827.53, with the underlying cause being an out-of-bounds memory read in ANGLE. The vulnerability is rated high sever...

CVE-2026-10950

CVE-2026-10950 affects Google Chrome on iOS (Autofill) where insufficient policy enforcement allowed a remote attacker to exfiltrate cross-origin data via a crafted HTML page. The issue is tied to Autofill handling in Chrome for iOS before version 149.0.7827.53. A patch is expected in 149.0.7827....

CVE-2026-11018

CVE-2026-11018 affects Google Chrome (Chromium-based). The issue is described as insufficient policy enforcement in the Actor component, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact is described as allow bypass of navigation restrictions; no other e...

CVE-2026-11044

This CVE (CVE-2026-11044) affects ANGLE in Google Chrome on macOS, where an integer overflow in ANGLE allowed a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Affected software: Google Chrome on macOS with vulnerable ANGLE before version 149.0.7827...

CVE-2026-11072

The CVE-2026-11072 issue affects WebView in Google Chrome on Android (before version 149.0.7827.53). The root cause is a use-after-free in WebView, enabling a local attacker to execute arbitrary code via a malicious file. The provided sources indicate the impact as local code execution with a Med...

CVE-2026-11177

The CVE describes a use-after-free in Chrome’s Omnibox prior to version 149.0.7827.53, where a remote attacker could trigger heap corruption by enticing a user to perform specific UI gestures on a crafted HTML page. Affected software is Google Chrome (Omnibox component); underlying cause is a use...

CVE-2026-11223

CVE-2026-11223 describes insufficient validation of untrusted input in Google Chrome’s Network component prior to 149.0.7827.53. A remote attacker who has compromised the renderer process could bypass the same-origin policy via a crafted HTML page. The root cause is insufficient input validation ...

CVE-2026-11283

The CVE-2026-11283 entry concerns Google Chrome on macOS where Shortcuts mishandles untrusted input due to insufficient validation, allowing a remote attacker to bypass navigation restrictions via a malicious file. Affected product/version: Chrome for macOS, before 149.0.7827.53. Root cause: inad...

CVE-2026-13803

CVE-2026-13803 describes a Type Confusion in Chrome Tabs affecting Google Chrome prior to 150.0.7871.47. The root cause is a type-confusion vulnerability in the Chrome renderer that could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox by pre...

CVE-2026-13816

CVE-2026-13816 affects Google Chrome on Android prior to 150.0.7871.47, due to insufficient validation of untrusted input in the File Input component. This vulnerability can allow a remote attacker to leak cross-origin data via a crafted HTML page. The connected documents confirm the same descrip...

CVE-2026-13834

The CVE-2026-13834 entry documents an issue in ANGLE used by Google Chrome before version 150.0.7871.47, where insufficient validation of untrusted input allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is tied to the ANGLE compo...

CVE-2026-13852

Summary (CVE-2026-13852): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android before 150.0.7871.47 allows a local attacker to bypass discretionary access control via a crafted HTML page. The issue is tracked across multiple sources (NVD, Debian, EUVD, CVE List...

CVE-2026-13921

The set of connected records confirms CVE-2026-13921 affects Google Chrome (Chromium-based) via the DeviceBoundSessionCredentials component where insufficient validation of untrusted input enables a remote bypass of the same-origin policy through a crafted HTML page. The vulnerability is describe...

CVE-2026-13959

The CVE-2026-13959 entry describes an issue in Blink (Chrome) where insufficient validation of untrusted input allows a remote attacker to bypass the Same Origin policy via a crafted HTML page. Affected software is Google Chrome (Blink engine) with versions prior to 150.0.7871.47. The impact is a...

CVE-2026-13988

CVE-2026-13988 describes an Inappropriate implementation in Google Chrome’s Paint component that allows a remote attacker to perform UI spoofing via a crafted HTML page. Affected software: Google Chrome (Chromium-based). Root cause: implementation issue in Paint prior to version 150.0.7871.47. Im...

CVE-2026-14021

Affected software: Google Chrome (StorageAccessAPI in Chromium). Vulnerability: insufficient policy enforcement allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Versions: prior to 150.0.7871.47. Impact: cross-origin data leakage...