CVE-2026-13816

CVE-2026-13816 affects Google Chrome on Android prior to 150.0.7871.47, due to insufficient validation of untrusted input in the File Input component. This vulnerability can allow a remote attacker to leak cross-origin data via a crafted HTML page. The connected documents confirm the same descrip...

CVE-2026-13834

The CVE-2026-13834 entry documents an issue in ANGLE used by Google Chrome before version 150.0.7871.47, where insufficient validation of untrusted input allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is tied to the ANGLE compo...

CVE-2026-13852

Summary (CVE-2026-13852): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android before 150.0.7871.47 allows a local attacker to bypass discretionary access control via a crafted HTML page. The issue is tracked across multiple sources (NVD, Debian, EUVD, CVE List...

CVE-2026-13913

CVE-2026-13913 affects Autofill in Google Chrome on iOS. The root cause is insufficient policy enforcement, allowing a remote attacker who entices a user to perform specific UI gestures to leak cross-origin data via a crafted HTML page. The vulnerability concerns Chrome/iOS versions prior to 150....

CVE-2026-13921

The set of connected records confirms CVE-2026-13921 affects Google Chrome (Chromium-based) via the DeviceBoundSessionCredentials component where insufficient validation of untrusted input enables a remote bypass of the same-origin policy through a crafted HTML page. The vulnerability is describe...

CVE-2026-13988

CVE-2026-13988 describes an Inappropriate implementation in Google Chrome’s Paint component that allows a remote attacker to perform UI spoofing via a crafted HTML page. Affected software: Google Chrome (Chromium-based). Root cause: implementation issue in Paint prior to version 150.0.7871.47. Im...

CVE-2026-14021

Affected software: Google Chrome (StorageAccessAPI in Chromium). Vulnerability: insufficient policy enforcement allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Versions: prior to 150.0.7871.47. Impact: cross-origin data leakage...

CVE-2026-14061

The CVE-2026-14061 issue affects Dawn in Google Chrome, prior to version 150.0.7871.47. It is described as an insecure implementation that could allow a remote attacker to obtain potentially sensitive data from process memory via a crafted HTML page. Affected component: Dawn within Chrome. Root c...

CVE-2026-14064

CVE-2026-14064 is a use-after-free in PageInfo affecting Google Chrome on Android prior to version 150.0.7871.47. The vulnerability allows a remote attacker to trigger arbitrary code execution by convincing a user to perform specific UI gestures on a crafted HTML page. Root cause: use-after-free ...

CVE-2026-14119

CVE-2026-14119 describes a type confusion in Bluetooth handling within Google Chrome on Windows, prior to version 150.0.7871.47. An attacker on the same local network could potentially read sensitive information from a victim process’s memory by presenting a malicious peripheral. The connected so...

CVE-2026-17838

The vulnerability CVE-2026-17838 affects Chrome on iOS prior to 151.0.7922.72, where an incorrect security UI could allow a remote attacker to spoof domains via a crafted HTML page. The issue is documented with a Medium severity (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) and an affected com...

CVE-2026-17846

CVE-2026-17846 stems from an inappropriate implementation in the Chromium-based Chrome Media component on Windows, allowing a remote attacker who already compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected software is Google Chrome on Windows, with ...

CVE-2026-3931

CVE-2026-3931 concerns a heap buffer overflow in Skia used by Google Chrome (Chromium/Skia stack) prior to version 146.0.7680.71. The vulnerability allows a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Connected advisories confirm this vulnerability affects Chro...

CVE-2026-3937

CVE-2026-3937 affects Google Chrome on Android (via Chromium) with the vulnerability in the Downloads security UI, allowing UI spoofing through a crafted HTML page. The root cause is an incorrect security UI flow in Downloads, enabling a remote attacker to spoof UI. Affected component is Chromium...

CVE-2026-4454

CVE-2026-4454 is a use-after-free vulnerability in the Network component of Google Chrome, allowing remote exploitation that could lead to heap corruption. Affected product: Google Chrome prior to version 146.0.7680.153. Root cause described as use-after-free in the Network component with crafted...

CVE-2026-4675

CVE-2026-4675 details (concrete): Heap buffer overflow in WebGL within Google Chrome before version 146.0.7680.165. The issue allows a remote attacker to trigger an out-of-bounds memory read by processing a crafted HTML page. Affected component: WebGL in Chrome (browser rendering stack); underlyi...

CVE-2026-5874

CVE-2026-5874 is a use-after-free in PrivateAI within Google Chrome, affecting Chrome/Chromium before version 147.0.7727.55. The underlying issue could allow a remote attacker who convinces a user to perform specific UI gestures to escape the browser sandbox via a crafted HTML page. Connected adv...

CVE-2026-5877

CVE-2026-5877 is a Use-after-free in Navigation in Google Chrome (Chromium) prior to 147.0.7727.55, allowing a remote attacker to execute arbitrary code in a sandbox via a crafted HTML page. The Chrome release notes confirm a security fix in Chrome 147.0.7727.55, with multiple CVEs addressed in t...

CVE-2026-5885

CVE-2026-5885 affects Google Chrome on Windows prior to 147.0.7727.55, attributed to insufficient validation of untrusted input in WebML. The issue could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The Chrome 147 release notes c...

CVE-2026-5890

CVE-2026-5890 describes a race condition in Chrome’s WebCodecs, allowing a remote attacker to potentially read sensitive data from process memory via a crafted HTML page. Affected software: Google Chrome (WebCodecs path). Root cause: race in WebCodecs leading to information disclosure. Impact: po...

CVE-2026-5893

CVE-2026-5893 is a race in V8 affecting Google Chrome prior to 147.0.7727.55 that could allow remote attackers to trigger heap corruption via a crafted HTML page. The initial entry lists a Chromium-based web engine race as the root cause with a Medium severity and heap corruption impact, and mult...

CVE-2026-5899

CVE-2026-5899 affects Chromium/Google Chrome History Navigation; root cause is insufficient policy enforcement allowing UXSS via crafted HTML and specific UI gestures. Impact: remote attacker could inject scripts/HTML. Remediation: update to patched Chromium/Chrome versions (examples seen in Fedo...

CVE-2026-5905

CVE-2026-5905 affects Chromium/Chrome components on Windows via an incorrect security UI in Permissions that allowed domain spoofing with a crafted HTML page. Connected advisories confirm Chromium-based Chromium versions around 147.0.7727.x, with Fedora/Debian updates targeting Chromium to fixed ...

CVE-2026-7335

CVE-2026-7335 is a use-after-free in Google Chrome’s media handling prior to 147.0.7727.138 that could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product: Google Chrome. Root cause: use-after-free in media. Impact: arbitrary code executi...

CVE-2026-7902

CVE-2026-7902 is an out-of-bounds memory access in V8 affecting Google Chrome prior to 148.0.7778.96, enabling remote code execution via a crafted HTML page. Affected component: V8 within Chrome; root cause described as an out-of-bounds memory access. Impact is high (remote code execution in sand...

CVE-2026-79020

CVE-2026-79020 is an out-of-bounds read vulnerability in Skia , the 2D graphics library used in Google Chrome and other Chromium-based browsers (including Microsoft Edge ). A remote attacker can exploit it by luring a user into processing a crafted media file , potentially allowing memory read wi...

CVE-2026-79111

CVE-2026-79111 is an improper input validation flaw in Dawn , the GPU abstraction layer of Google Chrome , affecting versions prior to 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux). A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the browser's se...

CVE-2026-79130

CVE-2026-79130 is a buffer overflow in ANGLE , the OpenGL ES translation layer used by Google Chrome, prior to version 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux). A remote attacker can trigger the flaw via a crafted HTML page , leading to arbitrary code execution outside the browser sa...

CVE-2026-79232

CVE-2026-79232 is a use-after-free vulnerability in the Aura component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit memory corruption by delivering a crafted HTML page, potentially achieving arbitrary code execution outside the browser's security sa...

CVE-2026-7929

Summary: CVE-2026-7929 is a use-after-free in Chrome’s MediaRecording path, fixed in Chrome 148.0.7778.96. Affected component: MediaRecording in Chrome/Chromium. Root cause: use-after-free vulnerability that could be triggered through crafted HTML and user UI gestures. Impact: remote code executi...

CVE-2026-8007

CVE-2026-8007 describes insufficient validation of untrusted input in the Cast component of Google Chrome, allowing a remote attacker who has compromised the renderer process to escalate privileges via a crafted HTML page. Affected product: Google Chrome (Cast, prior to version 148.0.7778.96). Ro...

CVE-2026-84347

CVE-2026-84347 is a use after free vulnerability in the WebRTC component of Google Chrome prior to 152.0.7977.75 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the Chrome sandbox . The vulnerability carries a CVSS 3.1 score of 8.8 (High) with user inte...

CVE-2026-8564

CVE-2026-8564 describes an issue in Google Chrome’s Downloads UI on Android and macOS, where an incorrect security UI could allow a remote attacker to perform UI spoofing via a crafted HTML page. Affected versions are prior to 148.0.7778.168; remediation is to update to 148.0.7778.168 or later. T...

CVE-2026-87594

CVE-2026-87594 is an incorrect authorization flaw in the DataTransfer component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain sensitive information by delivering a crafted HTML page. The vulnerability is rated Medium seve...

CVE-2026-87635

Google Chrome 's Payments component is vulnerable to UI misrepresentation , where a remote attacker can spoof UI elements via a crafted HTML page. The flaw is classified as Medium severity by Chromium (CVSS v3.1 base score 5.4 , requiring user interaction with low impacts on confidentiality and a...

CVE-2026-9121

Affected software: Google Chrome (GPU component). Vulnerable since: pre-148.0.7778.179.Root cause: out-of-bounds read in the GPU pathway that can lead to heap corruption via a crafted HTML page.Impact (per provided metrics): confidentiality, integrity, and availability impacts labeled as HIGH; CV...

CVE-2026-9912

CVE-2026-9912 affects Google Chrome on Android, due to an inappropriate implementation in the GPU component of Chromium. Versions prior to 148.0.7778.216 are susceptible; a remote attacker could read potentially sensitive information from a process’s memory via a crafted HTML page. The issue is a...

CVE-2011-1794

CVE-2011-1794 is an integer overflow vulnerability in WebKit’s WebCore SVG filter, specifically FilterEffect::copyImageBytes, that affects Google Chrome up to version 11.0.696.65. The overflow could enable a remote attacker to crash the browser (denial of service) and potentially cause other unsp...

CVE-2025-12909

CVE-2025-12909 affects Google Chrome via Devtools: Insufficient policy enforcement in Devtools allows a remote attacker to leak cross-origin data. The vulnerability is tied to Chrome versions before 140.0.7339.80. Affected component: Devtools policy enforcement in Chrome/Chromium. Impact per sour...

CVE-2026-10884

The connected sources confirm a use-after-free in Chromecast within Google Chrome before version 149.0.7827.53. If a renderer process is compromised, an attacker could potentially escape the sandbox via a crafted HTML page. The issue is labeled as Critical in Chromium’s security notes, and the Ch...

CVE-2026-10920

CVE-2026-10920 affects Google Chrome on macOS. Insufficient validation of untrusted input in the WebShare component could allow a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. According to the connected sources, this is a Chromium/We...

CVE-2026-10937

The CVE-2026-10937 entry describes an issue in Google Chrome related to the Passwords component. Root cause: an inappropriate implementation in Passwords in Chrome prior to 149.0.7827.53 that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact: enables SOP b...

CVE-2026-10969

CVE-2026-10969 describes insufficient input validation in Google Chrome extensions, allowing a remote attacker who has compromised the renderer process to escalate privileges via a crafted HTML page. Affected software: Google Chrome extensions (pre-149.0.7827.53). Root cause: untrusted input not ...

CVE-2026-10993

CVE-2026-10993 is a heap buffer overflow in Skia used by Google Chrome (Chromium-based). Affects Chrome before 149.0.7827.53; a crafted HTML page can allow a remote attacker to read potentially sensitive information from the process memory. Microsoft Edge (Chromium-based) ingests Chromium, which ...

CVE-2026-11045

CVE-2026-11045 describes an vulnerability in Google Chrome's GPU pathway where there is insufficient validation of untrusted input in the GPU stack. A remote attacker who already compromised the renderer process could read potentially sensitive data from process memory by presenting a crafted HTM...

CVE-2026-11176

CVE-2026-11176 describes an inappropriate media implementation in Google Chrome before 149.0.7827.53 that could allow a remote attacker to leak cross-origin data through a crafted HTML page. The vulnerability affects Chrome’s media handling and is rated Medium severity by Chromium, with network a...

CVE-2026-11202

Summary: CVE-2026-11202 concerns Chrome for iOS (Google Chrome on iOS) prior to 149.0.7827.53, where an inappropriate implementation allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The vulnerability is tied to Chromium-based behavior on iOS, with a mediu...

CVE-2026-11209

CVE-2026-11209 applies to Google Chrome, affecting the Passwords implementation prior to version 149.0.7827.53. The issue arises from an inappropriate implementation that allows a remote attacker who has compromised the renderer process to read potentially sensitive information from process memor...

CVE-2026-11260

CVE-2026-11260 : In Google Chrome (Chromium-based) prior to 149.0.7827.53, an inappropriate Permissions implementation allows a remote attacker to bypass the Content Security Policy via a crafted HTML page. Impact is a CSP bypass; no exploit details are provided in the source documents. A patch t...

CVE-2026-13879

CVE-2026-13879 : Use-after-free in Bluetooth handling in Google Chrome (Chromium) prior to 150.0.7871.47. The issue allows an attacker on the local network segment to potentially read sensitive data from a process’s memory via a malicious Bluetooth peripheral. Affected component is Bluetooth code...