CVE-2026-79292

CVE-2026-79292 is an integer overflow in the Chromecast component of Google Chrome prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to execute arbitrary code outside the sandbox , rated High severity by Chromium and 8.3...

CVE-2026-78934

A race condition in the ReadAloud component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to execute arbitrary code inside the browser sandbox . The vulnerability was reported by Google on 2026-05-28 and fixed in ...

CVE-2026-78952

CVE-2026-78952 is an out-of-bounds write in Crashpad within Google Chrome for Windows , affecting versions prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to execute arbitrary code outside the sandbox . The vulnerabili...

CVE-2026-78979

CVE-2026-78979 is a race condition in the Core component of Google Chrome on Windows prior to version 152.0.7977.65 . A remote attacker leveraging social engineering can bypass the web origin policy via a crafted HTML page, potentially gaining unauthorized access to sensitive information or actio...

CVE-2026-79005

CVE-2026-79005 is an incorrect authorization flaw in the StorageAccessAPI of Google Chrome prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could bypass the web origin policy using a crafted HTML page. Chromium rates the severity as Low , while the CNA-a...

CVE-2026-79008

CVE-2026-79008 is an improper input validation flaw in the Chromium GPU component of Google Chrome on Android prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to execute arbitrary code outside the sandbox . The CVSS v3.1 ...

CVE-2026-79086

CVE-2026-79086 is a missing authorization flaw in the CustomTabs component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A local attacker, through a co-installed application , can obtain sensitive user information , resulting in unauthorized data disclosure. Chromium r...

CVE-2026-79119

CVE-2026-79119 is a use-after-free vulnerability in the PDF component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can execute arbitrary code inside the sandbox by delivering a crafted PDF file. Chromium rates the severity as Low , while CVSS 3.1 scores it 8.8 ...

CVE-2026-79155

CVE-2026-79155 is a race condition in the FileSystem component of Google Chrome prior to 152.0.7977.65 , affecting the stable channel for Windows, Mac, and Linux. The flaw requires an attacker who has already compromised the renderer process to exploit it via a crafted HTML page , potentially ena...

CVE-2026-79178

CVE-2026-79178 is an incorrect authorization flaw in the Web Authentication (Passkeys & Security Keys) component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit it by enticing a user to visit a crafted HTML page , bypassing the web origin policy and potentially enabling un...

CVE-2026-79236

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to 152.0.7977.65 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The CVSS v3.1 score is 8.8 (High) , with low attack complexity and no privileges required, but user int...

CVE-2026-78893

CVE-2026-78893 is an information disclosure vulnerability in the QUIC (Quick UDP Internet Connections) implementation of Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit the flaw by enticing a user to visit a crafted HTML page , leading to the leakage of sensitive info...

CVE-2026-78947

CVE-2026-78947 is an incomplete cleanup vulnerability in Chromium (Google Chrome) prior to 152.0.7977.65 . A remote attacker, leveraging social engineering , can bypass the web origin policy via a crafted Chrome extension, resulting in a high integrity impact but no confidentiality or availabilit...

CVE-2026-79019

CVE-2026-79019 is an out-of-bounds write in ANGLE , the graphics abstraction layer used in Chromium-based browsers, affecting Google Chrome on Windows prior to 152.0.7977.65 . A remote attacker can exploit this by tricking a user into visiting a specially crafted HTML page , potentially leading t...

CVE-2026-79103

CVE-2026-79103 is a medium-severity flaw in the Speech component of Google Chrome prior to 152.0.7977.65 , caused by incorrect reference resolution . A remote attacker who has already compromised the renderer process can bypass site isolation by getting a user to visit a crafted HTML page, potent...

CVE-2026-79123

CVE-2026-79123 is an improper input validation flaw in the New Tab Page (NTP) Footer of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass the web origin policy by enticing a user to visit a crafted ...

CVE-2026-79127

CVE-2026-79127 is an out-of-bounds write vulnerability in the ANGLE component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit it by enticing a user to visit a crafted HTML page, potentially executing arbitrary code outside the browser's security sandbox and compromising th...

CVE-2026-79180

CVE-2026-79180 is a UI misrepresentation vulnerability in the CustomTabs feature of Google Chrome on Android prior to version 152.0.7977.65 . A remote attacker can leverage social engineering by serving a crafted HTML page to spoof UI elements, potentially deceiving users into interacting with ma...

CVE-2026-79205

CVE-2026-79205 is an incorrect authorization flaw in the Network component of Google Chrome prior to 152.0.7977.65 . A remote attacker can bypass the web origin policy by enticing a user to open a crafted HTML page , potentially gaining unauthorized access to sensitive information or performing a...

CVE-2026-79252

CVE-2026-79252 is an information leak in the ServiceWorker component of Google Chrome prior to 152.0.7977.65 . A remote attacker can obtain cross-origin data by enticing a user to visit a crafted HTML page . The underlying flaw allows data from other origins to be leaked through the ServiceWorker...

CVE-2026-78901

A race condition in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.65 allows a remote attacker to execute arbitrary code inside the sandbox by enticing a user to visit a crafted HTML page. The Chromium project rates the vulnerability as Medium severity, while the CVSS 3.1 score is ...

CVE-2026-78906

CVE-2026-78906 is a race condition in the ANGLE component of Google Chrome prior to 152.0.7977.65 , which can be triggered by a specially crafted HTML page. A remote attacker with no privileges but requiring user interaction may execute arbitrary code outside the browser sandbox , potentially lea...

CVE-2026-78980

CVE-2026-78980 is an improper input validation flaw in ReaderMode in Google Chrome prior to 152.0.7977.65 . A remote attacker, leveraging social engineering, can bypass the web origin policy to access a privileged page via a crafted HTML document. Red Hat notes this may lead to unauthorized actio...

CVE-2026-79045

CVE-2026-79045 is a type confusion flaw in the V8 JavaScript engine within Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit it by luring a user (via social engineering) into visiting a crafted HTML page, allowing memory reads inside the browser sandbox and potential informatio...

CVE-2026-79064

CVE-2026-79064 is a use after free in the Network component of Google Chrome on Mac (versions prior to 152.0.7977.65 ). A remote attacker leveraging social engineering can achieve arbitrary code execution outside the sandbox via a crafted Chrome extension . Chromium rates the severity as Medium ,...

CVE-2026-79069

CVE-2026-79069 is a memory corruption in the Tint component (WebGL shader translator) of Google Chrome on macOS , affecting versions prior to 152.0.7977.65 . A remote attacker can trigger the flaw by enticing a user to visit a crafted HTML page , potentially leading to arbitrary code execution ou...

CVE-2026-79071

A race condition in the GPU component of Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The CISA SSVC assessment ind...

CVE-2026-79105

CVE-2026-79105 is an improper input validation flaw in Google Chrome Mobile on iOS , fixed in version 152.0.7977.65 . A remote attacker can bypass system access restrictions by serving a crafted HTML page to a victim. The CVSS 3.1 score is 4.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/...

CVE-2026-79140

A use-after-free vulnerability in Views in Google Chrome on Mac (versions prior to 152.0.7977.65 ) allows a remote attacker to execute arbitrary code outside the sandbox by enticing a user to visit a crafted HTML page. The Chromium project rates the severity as Medium , while the CNA-assigned CVS...

CVE-2026-79173

A UI misrepresentation vulnerability in the WebAppInstalls component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. Rated Medium by Chromium (CVSS 5.4, with network vector, low complexity, no privileges, user interaction required, a...

CVE-2026-79179

CVE-2026-79179 is an incorrect authorization flaw in the DOM component of Google Chrome prior to version 152.0.7977.65 . A remote attacker could potentially leak sensitive information by serving a crafted HTML page that requires user interaction (visiting a malicious page). Chromium rates this as...

CVE-2026-79182

CVE-2026-79182 is an improper input validation flaw in the Media component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can deliver a crafted HTML page that, when visited by a user, may allow execution of arbitrary code outside the sandbox . The Chromium security severity i...

CVE-2026-79188

An out-of-bounds write in ANGLE within Google Chrome prior to 152.0.7977.65 allows a remote attacker to potentially execute arbitrary code outside the sandbox by luring a user into visiting a crafted HTML page. The vulnerability is rated High by Chromium and scores 9.6 (Critical) on CVSS 3.1. CIS...

CVE-2026-79209

CVE-2026-79209 is a type confusion vulnerability in the Animation component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker could potentially execute arbitrary code inside the browser's sandbox by serving a crafted HTML page to a user. The CNA (chrome-cve-admin) a...

CVE-2026-79291

CVE-2026-79291 is an information leak in the CSS engine of Google Chrome prior to 152.0.7977.65 . A remote attacker can obtain sensitive information by enticing a user to visit a crafted HTML page , with no privileges required but user interaction necessary. The flaw is rated Medium (CVSS 3.1 bas...

CVE-2026-78914

CVE-2026-78914 is an uninitialized resource vulnerability in the Skia rendering library within Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit it by serving a crafted HTML page, potentially allowing memory reads inside the Chrome sandbox (information disclosure). Th...

CVE-2026-78915

A race condition in the Enterprise component of Google Chrome on Windows (prior to 152.0.7977.65 ) allows an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. The vulnerability is rated CVSS 7.5 (High) under CVSS 3.1, though Chromium's intern...

CVE-2026-78938

CVE-2026-78938 is a type confusion vulnerability in the V8 JavaScript engine shipped with Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit it by delivering a crafted HTML page , requiring only user interaction (visiting the page) to execute arbitrary code inside the br...

CVE-2026-78977

An uninitialized resource in the GPU component of Google Chrome on Android (prior to 152.0.7977.65 ) allows a remote attacker to read memory inside the sandbox via a crafted HTML page, resulting in information disclosure . The Chromium team rates the severity as Low , while NVD assigns a CVSS 3.1...

CVE-2026-78978

CVE-2026-78978 is an out-of-bounds read in ANGLE , a rendering component within Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit this by enticing a user to visit a specially crafted HTML page , potentially leading to arbitrary code execution out...

CVE-2026-79021

CVE-2026-79021 is a missing authorization flaw in the InterestGroups component of Google Chrome prior to 152.0.7977.65 . An attacker who has already compromised the renderer process can use a crafted PDF file to bypass system access restrictions . The flaw carries a Low Chromium severity and a CV...

CVE-2026-79033

CVE-2026-79033 affects Google Chrome DevTools prior to version 152.0.7977.65 , caused by insufficient control flow management . A remote attacker leveraging social engineering can potentially execute arbitrary code inside the sandbox via a crafted HTML page. The Chromium security severity is rate...

CVE-2026-79117

CVE-2026-79117 is a race condition in the WebAppInstalls component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering and a co-installed app can bypass the web origin policy , potentially enabling unauthorized access to sensit...

CVE-2026-79128

CVE-2026-79128 is a use-after-free vulnerability in the Views component of Google Chrome for macOS , affecting versions prior to 152.0.7977.65 . A remote attacker can execute arbitrary code outside the browser sandbox by luring a user to visit a crafted HTML page. The Chromium project rates the s...

CVE-2026-79184

CVE-2026-79184 is a missing authorization flaw in the Preload feature of Google Chrome prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to bypass the web origin policy , leading to unauthorized access or actions a...

CVE-2026-79195

CVE-2026-79195 is a use after free in the Script component of Google Chrome , reported by Google on 2026-04-12. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability affects Chrome prior to 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux...

CVE-2026-79246

CVE-2026-79246 is an information leak in the DataTransfer component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can craft an HTML page that, when visited by a user, discloses sensitive information. The vulnerability requires user interaction (visiting the craf...

CVE-2026-79288

CVE-2026-79288 is an improper input validation flaw in the Autofill component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker can obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability was reported by Google...

CVE-2026-78975

CVE-2026-78975 is an incorrect authorization flaw in the DOM (Document Object Model) of Google Chrome prior to version 152.0.7977.65 . A remote attacker can obtain sensitive information by enticing a user to visit a crafted HTML page , resulting in a high confidentiality impact with no integrity ...

CVE-2026-79002

An incorrect authorization flaw in the SiteIsolation component of Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to bypass site isolation using a crafted HTML page. The Red Hat advisory notes this bypass could lead to further comprom...