CVE-2026-4443

CVE-2026-4443 refers to a heap buffer overflow in WebAudio affecting Google Chrome prior to 146.0.7680.153, enabling remote code execution in a sandbox via a crafted HTML page. Multiple connected sources (Astra Linux, Debian, Debian security tracker, CNNVD, EUVD, CIRCL, CVE lists) corroborate the...

CVE-2026-6319

CVE-2026-6319 is a Use-after-Free in Google Chrome's Payments component for Android, prior to version 147.0.7727.101. The issue could allow remote code execution when a user is tricked into performing specific UI gestures and visits a crafted HTML page. Public sources (Debian security advisory DS...

CVE-2026-6362

CVE-2026-6362 involves a memory safety defect in Google Chrome’s Codecs component (Chromium). A use-after-free in Codecs could enable a remote attacker to cause out-of-bounds memory access by parsing a specially crafted video file. The issue affects Chrome/Chromium releases prior to the patched b...

CVE-2026-78956

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allows a remote attacker, leveraging social engineering via a crafted HTML page, to execute arbitrary code inside the sandbox. Chromium rates the severity as Low , while the CVSS 3.1 base score is 8.8 (HIGH) with required user interacti...

CVE-2026-78964

A use-after-free vulnerability in the Sync component of Google Chrome on iOS (versions prior to 152.0.7977.65 ) allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium rates the severity as Low , yet the CVSS 3.1 base score is 9.6 (Cri...

CVE-2026-7901

CVE-2026-7901 relates to a use-after-free in ANGLE within Google Chrome on macOS prior to 148.0.7778.96. The underlying issue is a dangling reference in ANGLE that could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Affected product/version:...

CVE-2026-7912

CVE-2026-7912 refers to an integer overflow in the GPU component of Google Chrome on Android before 148.0.7778.96. The issue allows a remote attacker who has already compromised the renderer process to perform arbitrary read/write via a crafted HTML page, potentially impacting confidentiality and...

CVE-2026-79148

An off-by-one error in the DevTools component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker, leveraging social engineering and a crafted Chrome extension, to read memory inside the sandbox . Chromium rated this Low severity, while the CNA-assigned CVSS 3.1 score is 9.1...

CVE-2026-79178

CVE-2026-79178 is an incorrect authorization flaw in the Web Authentication (Passkeys & Security Keys) component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit it by enticing a user to visit a crafted HTML page , bypassing the web origin policy and potentially enabling un...

CVE-2026-79188

An out-of-bounds write in ANGLE within Google Chrome prior to 152.0.7977.65 allows a remote attacker to potentially execute arbitrary code outside the sandbox by luring a user into visiting a crafted HTML page. The vulnerability is rated High by Chromium and scores 9.6 (Critical) on CVSS 3.1. CIS...

CVE-2026-7921

CVE-2026-7921 corresponds to a use-after-free vulnerability in Google Chrome’s Passwords handling, exploited via a crafted HTML page to achieve remote code execution. Affected product: Google Chrome (Password management code path) prior to version 148.0.7778.96. Root cause: use-after-free in Pass...

CVE-2026-7927

CVE-2026-7927 is a Chrome sandbox Type Confusion in Runtime vulnerability affecting Google Chrome before version 148.0.7778.96. The issue, described in multiple connected sources, stems from a runtime type-handling confusion that could allow a remote attacker to execute arbitrary code within the ...

CVE-2026-7967

CVE-2026-7967 affects Google Chrome versions prior to 148.0.7778.96. The issue is "Insufficient validation of untrusted input in Navigation" in the renderer, allowing a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Impact...

CVE-2026-7985

CVE-2026-7985: A use-after-free in Chrome's GPU component allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affected Software: Google Chrome prior to 148.0.7778.96 (GPU). Root cause: use-after-free in the GPU path. Impact: sandbox escape potential ...

CVE-2026-7987

CVE-2026-7987 describes a use-after-free in WebRTC within Google Chrome prior to version 148.0.7778.96, enabling a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The Debian OSV, EUVD ENISA entry, and the Chrome PTSecurity advisory corroborate the same vulnerab...

CVE-2026-8532

Affected product: Google Chrome (Chromium-based) prior to 148.0.7778.168. Vulnerable component: XML handling/parsing in Chromium. Root cause: integer overflow in XML processing that enables arbitrary code execution inside the sandbox when processing a crafted HTML page. Impact: remote attacker co...

CVE-2014-3161

The CVE-2014-3161 entry corresponds to a vulnerability in Google Chrome for Android prior to 36.0.1985.122, where WebMediaPlayerAndroid::load did not properly handle redirects, allowing remote attackers to bypass the Same Origin Policy via a crafted site hosting a video stream. This is supported ...

CVE-2025-11460

CVE-2025-11460 is a use-after-free vulnerability in Google Chrome's Storage, allowing remote code execution via a crafted video file. The issue is tied to Chromium and affects Chrome prior to version 141.0.7390.65, with impact described as arbitrary code execution in the browser process. Public d...

CVE-2025-12908

CVE-2025-12908 concerns Google Chrome for Android prior to 140.0.7339.80, where insufficient validation of untrusted input in the Downloads component could allow a remote attacker to perform domain spoofing via a crafted HTML page. The issue is documented with Chromium-based details and is graded...

CVE-2025-13992

CVE-2025-13992 affects Google Chrome (Chrome/Chromium) prior to version 139.0.7258.66, involving a side-channel information leakage during Navigation and Loading that could allow a remote attacker to bypass site isolation via a crafted HTML page. Affected component/behavior is described in public...

CVE-2026-11055

CVE-2026-11055 concerns Google Chrome on Windows, where a use-after-free in ANGLE can be triggered by a crafted HTML page. The vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox. Affected versions are Chrome prior to 149.0.7827.53 . There is no explicit ex...

CVE-2026-11220

CVE-2026-11220 : The provided documents indicate a vulnerability in Google Chrome related to the Navigation component, caused by insufficient validation of untrusted input. This weakness exists in Chrome versions prior to 149.0.7827.53 and could let a remote attacker who has already compromised t...

CVE-2026-11633

Summary (CVE-2026-11633) : A use-after-free in Bluetooth handling in Google Chrome on macOS allows a remote attacker to execute arbitrary code via a malicious Bluetooth peripheral. The flaw’s impact is described as critical; affected software is “Google Chrome on Mac” with the vulnerable componen...

CVE-2026-11669

Affects Google Chrome on ChromeOS : an out-of-bounds read in Media prior to version 149.0.7827.103 . A remote attacker who has compromised the renderer process could craft an HTML page to read potentially sensitive data from process memory. No exploitation details are provided. Remediation: upgra...

CVE-2026-13795

CVE-2026-13795 affects Chrome for iOS (Google Chrome on iOS). The provided documents indicate insufficient policy enforcement in Chrome for iOS prior to version 150.0.7871.47, which could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is descr...

CVE-2026-13817

CVE-2026-13817 affects Google Chrome (Chromium-based) due to insufficient validation of untrusted input in the Glic component, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected range is Chrome versions prior to 150.0.7871.47; the vulnerability is...

CVE-2026-13886

Affected software: Google Chrome Isolated Web Apps. Vulnerability: insufficient policy enforcement that allows a remote attacker to bypass Content Security Policy via a crafted HTML page. Root cause (as described across connected sources): policy enforcement gaps in Isolated Web Apps prior to ver...

CVE-2026-13948

CVE-2026-13948 : Concrete details in connected records show an insufficient policy enforcement in Google Chrome extensions prior to 150.0.7871.47, enabling a user-assisted UI spoofing attack if a user is convinced to install a malicious Chrome Extension. Root cause: policy enforcement weakness in...

CVE-2026-14074

Google Chrome on iOS prior to 150.0.7871.47 is affected by a side-channel information leakage in WebAuthentication that can leak cross-origin data via a crafted HTML page. The issue affects Chrome’s WebAuthentication component; the public references place a Low severity (CVSS 3.1: 6.5, MEDIUM) an...

CVE-2026-4444

CVE-2026-4444 is a stack buffer overflow in WebRTC within Google Chrome’s rendering of WebRTC, exploited via a crafted HTML page. Connected sources confirm the affected component is WebRTC in Chrome prior to version 146.0.7680.153. The underlying issue is a stack buffer overflow that could enable...

CVE-2026-5867

CVE-2026-5867 is a heap buffer overflow in WebML within Google Chrome/Chromium prior to 147.0.7727.55, enabling a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Connected advisories confirm fixes in chromium updates: Debian DSA-6205-1 ships version...

CVE-2026-5883

CVE-2026-5883: Use-after-free in Media within Google Chrome prior to 147.0.7727.55 allows remote code execution inside the sandbox via a crafted HTML page. Affected product is Google Chrome (Chromium-based); root cause is use-after-free in Media handling. The Chrome 147 release notes list this fi...

CVE-2026-5895

CVE-2026-5895 describes an incorrect security UI in the Omnibox of Google Chrome on iOS before 147.0.7727.55, allowing a remote attacker to spoof the Omnibox (URL bar) via a crafted domain name. The CVE is listed with Chromium security severity: Low. Public connected sources confirm that Chrome/C...

CVE-2026-5903

CVE-2026-5903 affects Google Chrome/Chromium prior to 147.0.7727.55, where a flaw in IFrameSandbox allowed a remote attacker to bypass navigation restrictions after convincing a user to perform specific UI gestures via a crafted HTML page. Connected advisories indicate Chromium-based patches exis...

CVE-2026-5914

CVE-2026-5914 is a Type Confusion in CSS in Chromium-based Chrome prior to 147.0.7727.55. The vulnerability could allow heap corruption when a user installs a crafted malicious Chrome extension, with exploitation requiring user interaction. Affected software is Google Chrome/Chromium engine; root...

CVE-2026-6302

Chromium-based Google Chrome is affected by CVE-2026-6302 due to a use-after-free in the Video component. Versions before 147.0.7727.101 allow a remote attacker to execute arbitrary code in the sandbox via a crafted HTML page. Mitigation: update Chrome to 147.0.7727.101 or newer. Exploitation sta...

CVE-2026-6304

CVE-2026-6304 covers a use-after-free in Graphite within Google Chrome prior to version 147.0.7727.101 . The issue allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape via a crafted HTML page . The vulnerability affects Chrome’s Graphit...

CVE-2026-78911

CVE-2026-78911 is an incorrect authorization flaw in the USB component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a crafted H...

CVE-2026-78913

A use-after-free vulnerability in the Chromoting component of Google Chrome (prior to 152.0.7977.65 ) allows a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium rates the severity as Medium , while NVD assigns a CVSS 3.1 base score of ...

CVE-2026-78951

A use-after-free vulnerability in the ServiceWorker component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. Chromium classifies the severity as Medium , while the NVD/CNA-assigned C...

CVE-2026-79073

CVE-2026-79073 affects the Parser component of Google Chrome prior to 152.0.7977.65 . The root cause is an improper state validation flaw, which allows a remote attacker to execute arbitrary code inside the browser's security sandbox by convincing a user to visit a crafted HTML page. The Chromium...

CVE-2026-7910

CVE-2026-7910 affects Google Chrome

CVE-2026-7916

CVE-2026-7916 affects Google Chrome up to version 148.0.7778.96. Description:Insufficient data validation in the InterestGroups component can allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page (Chromium security severity: High). Connected sources (Chrome stable re...

CVE-2026-7950

CVE-2026-7950 describes an out-of-bounds read and write in Chrome’s GFX component. Affected software is Google Chrome prior to version 148.0.7778.96, where an attacker could trigger arbitrary read/write by sending malicious network traffic. The vulnerability is categorized as Chromium/Chrome-rela...

CVE-2026-84334

CVE-2026-84334 is an incorrect authorization vulnerability in the Chromoting component of Google Chrome on Windows , prior to version 152.0.7977.75 . A local attacker can exploit it to execute arbitrary code outside the Chrome sandbox via a local program. The flaw was reported by Google on 2026-0...

CVE-2026-84351

CVE-2026-84351 is a buffer overflow in the GPU component of Google Chrome on Windows prior to 152.0.7977.75 . A remote attacker who had compromised the renderer process could exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . The vulnerability was rated High by Chr...

CVE-2026-84357

CVE-2026-84357 is an improper input validation vulnerability in the Omnibox component of Google Chrome prior to version 152.0.7977.75 . A remote attacker leveraging social engineering can bypass the web origin policy via crafted network traffic. The Chromium security severity is rated High , with...

CVE-2026-8520

CVE-2026-8520 : A race in the Payments component of Google Chrome before version 148.0.7778.168 could allow a remote attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is described as critical in Chromium, with a network attack vector and high impact on confiden...

CVE-2026-9901

The CVE-2026-9901 issue affects the ANGLE component in Google Chrome (Chromium-based). Description confirms a use-after-free in ANGLE that could be triggered by a crafted HTML page, allowing remote code execution if a renderer process is compromised. The vulnerability is associated with Chrome ve...

CVE-2025-12443

CVE-2025-12443 corresponds to an out-of-bounds read in WebXR in Google Chrome/Chromium. The issue allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affected component: WebXR in Chromium-based Chrome; root cause: out-of-bounds read in WebXR implementation. I...