CVE-2026-79185

CVE-2026-79185 is an information leak in the DOM (Document Object Model) of Google Chrome prior to 152.0.7977.65 . A remote attacker can bypass the web origin policy by enticing a user to visit a specially crafted HTML page , potentially exposing sensitive data across origins. The CNA rates it Me...

CVE-2026-79213

An incorrect authorization vulnerability in the WebAppInstalls component of Google Chrome on Android (prior to version 152.0.7977.65 ) allowed a remote attacker to bypass system access restrictions by serving a crafted HTML page. The vulnerability was rated Medium by Chromium and scored CVSS 4.3 ...

CVE-2026-79234

CVE-2026-79234 is a CSS injection vulnerability in Google Chrome prior to version 152.0.7977.65 , rated Medium severity (CVSS 6.5). A remote attacker can obtain sensitive information by enticing a user to visit a specially crafted HTML page. The attack requires user interaction (visiting the page...

CVE-2026-79237

An incorrect authorization flaw in the Navigation component of Google Chrome (prior to 152.0.7977.65 ) allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. According to Red Hat, this could lead to unauthorized access to sensitive info...

CVE-2026-79241

CVE-2026-79241 is an out-of-bounds read in the GPU component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit it by tricking a user into visiting a crafted HTML page, enabling memory reads outside the browser's security sandbox and potentiall...

CVE-2026-79248

CVE-2026-79248 is an incorrect authorization flaw in the Input component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass the web origin policy (security boundary evasion) by presenting a specially crafted HTML page. The flaw ...

CVE-2026-79259

CVE-2026-79259 is an improper input validation flaw in the Safebrowsing component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this by providing a crafted file , allowing them to bypass system access restrictions . The CVSS 3.1 score is 4.3 (Medium) , with the attack re...

CVE-2026-79260

An improper input validation flaw in the Cookies component of Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by enticing a user to visit a crafted HTML page. The Chromium security severity is rated Low...

CVE-2026-79261

CVE-2026-79261 is an incorrect authorization flaw in the Controls component of Google Chrome prior to 152.0.7977.65 , allowing a remote attacker to bypass web origin policy via a crafted HTML page. Chromium rates it Low severity; the CVSS 3.1 score is 4.3 (Medium) with a network vector, low compl...

CVE-2026-84348

CVE-2026-84348 is an information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 (Linux) and 152.0.7977.75/.76 (Windows/Mac). A remote attacker can potentially leak sensitive information via a crafted HTML page . Chromium rates this as Medium severity; CVSS 3.1 base score is 6.5 (AV:...

CVE-2026-85044

CVE-2026-85044 is a use of released resource flaw in the Mobile component of Google Chrome on Android (versions prior to 152.0.7977.82 ). A remote attacker, leveraging social engineering and a crafted HTML page, can bypass the web origin policy , allowing unauthorized cross-site interaction with ...

CVE-2026-5892

CVE-2026-5892 affects Google Chrome/Chromium PWAs. The root cause is insufficient policy enforcement for PWAs in the renderer, allowing a remote attacker who had compromised the renderer to install a PWA without user consent via a crafted HTML page. Affected versions are prior to 147.0.7727.55 (C...

CVE-2026-78943

CVE-2026-78943 is an improper input validation flaw in the Editing component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can, by leveraging social engineering , trick a user into interacting with a crafted HTML page to bypass the we...

CVE-2026-79049

An incorrect reference resolution flaw in the Passwords component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a specially crafted file. Per Red Hat, this could lead to unauthorized access to sensitive system resources . The CV...

CVE-2026-79071

A race condition in the GPU component of Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The CISA SSVC assessment ind...

CVE-2026-79093

CVE-2026-79093 is an incorrect authorization flaw in the Paint component of Google Chrome prior to version 152.0.7977.65 (Windows/Mac) / 152.0.7977.64 (Linux). A remote attacker can potentially bypass the web origin policy via a crafted HTML page, which could lead to unauthorized access to sensit...

CVE-2026-79098

This vulnerability affects the PermissionElement component in Google Chrome prior to version 152.0.7977.65 . A remote attacker, leveraging social engineering, can craft an HTML page to misrepresent UI elements, potentially deceiving users. The Chromium security severity is Low , with a CVSS 3.1 b...

CVE-2026-79107

CVE-2026-79107 is an incorrect authorization flaw in the TabGroups feature of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit it by sending crafted network traffic that requires user interaction, potentially leaking sensitive information from the user's browser. The CVSS 3.1 ...

CVE-2026-79134

An incorrect authorization flaw in the GetUserMedia component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability is rated Medium (CVSS 3.1 score 6.5 ) with high confidentiality im...

CVE-2026-79137

CVE-2026-79137 is an incorrect authorization flaw in the Extensions component of Google Chrome prior to 152.0.7977.65 . A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension , thereby bypassing system access restrictions . The CVSS v3.1 score...

CVE-2026-79147

CVE-2026-79147 is an information leak in the Skia graphics library within Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can potentially obtain sensitive information by serving a crafted HTML page. Chromium rates this...

CVE-2026-79174

CVE-2026-79174 is an incorrect authorization vulnerability in the Extensions component of Google Chrome prior to 152.0.7977.65 . The flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy and gain unauthorized access to a privileged page via...

CVE-2026-79228

CVE-2026-79228 is an incorrect authorization flaw in the SiteIsolation component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to bypass site isolation and gain unauthorized access to a privileged page...

CVE-2026-79246

CVE-2026-79246 is an information leak in the DataTransfer component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can craft an HTML page that, when visited by a user, discloses sensitive information. The vulnerability requires user interaction (visiting the craf...

CVE-2026-79256

CVE-2026-79256 is a WebView vulnerability in Google Chrome on Android prior to 152.0.7977.65 . The root cause is an externally controlled reference that allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafte...

CVE-2026-79258

An incorrect authorization flaw in WebXR within Google Chrome prior to 152.0.7977.65 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to obtain cross-origin data . The CVSS 3.1 score is 6.5 (Medium) , with a high confidentiality impact but no integrity or availabi...

CVE-2026-84327

CVE-2026-84327 is an incorrect authorization flaw in the Autofill component of Google Chrome on Android , affecting versions prior to 152.0.7977.75 . A remote attacker can leverage social engineering to obtain sensitive information via a crafted HTML page. Chromium rates the severity as Low , whi...

CVE-2026-6308

CVE-2026-6308 is a Google Chrome/Chromium vulnerability: an out-of-bounds read in the Media component that can be triggered by a user who is persuaded to perform specific UI gestures on a crafted HTML page. The issue affects Chrome/Chromium prior to version 147.0.7727.101; patches are included in...

CVE-2026-78954

CVE-2026-78954 is an incorrect authorization flaw in Google Chrome Extensions (versions prior to 152.0.7977.65 ). A remote attacker who has already compromised the renderer process can use a crafted HTML page to bypass the web origin policy , potentially leading to unauthorized access or actions....

CVE-2026-78975

CVE-2026-78975 is an incorrect authorization flaw in the DOM (Document Object Model) of Google Chrome prior to version 152.0.7977.65 . A remote attacker can obtain sensitive information by enticing a user to visit a crafted HTML page , resulting in a high confidentiality impact with no integrity ...

CVE-2026-78981

CVE-2026-78981 is an information leak in the Mobile component of Google Chrome on iOS , affecting versions prior to 152.0.7977.65 . A local attacker can potentially obtain sensitive information via a local program. Chromium rates the severity as Low , while NVD assigns a CVSS 3.1 score of 6.5 (ME...

CVE-2026-79011

CVE-2026-79011 is a UI misrepresentation vulnerability in the Browser component of Google Chrome prior to 152.0.7977.65 , rated High (CVSS 8.1). A remote attacker leveraging social engineering could bypass system access restrictions via a crafted HTML page, with impacts to confidentiality and int...

CVE-2026-79066

CVE-2026-79066 is an improper input validation vulnerability in the Navigation component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass site isolation via a crafted HTML page, potentially enabling unauthorized access to data...

CVE-2026-79087

An injection vulnerability in Chrome Tabs affected Google Chrome prior to 152.0.7977.65 and Microsoft Edge (Chromium-based) . A remote attacker could potentially bypass system access restrictions by serving a crafted HTML page that a user must interact with. The vulnerability is rated Medium (CVS...

CVE-2026-79105

CVE-2026-79105 is an improper input validation flaw in Google Chrome Mobile on iOS , fixed in version 152.0.7977.65 . A remote attacker can bypass system access restrictions by serving a crafted HTML page to a victim. The CVSS 3.1 score is 4.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/...

CVE-2026-79124

CVE-2026-79124 is an information leak in the Intents component of Google Chrome on Android (prior to 152.0.7977.65 ). A remote attacker can exploit it via a crafted HTML page to leak sensitive information. Chromium rates the severity as Low , while CVSS 3.1 scores it 6.5 (MEDIUM) with a network v...

CVE-2026-79177

CVE-2026-79177 is an incorrect authorization flaw in the Media component of Google Chrome on Windows prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass system access restrictions via a crafted HTML page. The CVSS 3.1 score is 6.5 (Medium) (AV:N/...

CVE-2026-79202

CVE-2026-79202 is a use-after-free vulnerability in the Chromecast component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit it by enticing a user to visit a crafted HTML page , allowing execution of arbitrary code inside the browser sandbox . The vuln...

CVE-2026-85048

A use-after-free vulnerability in the Compositing component of Google Chrome prior to 152.0.7977.82 allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium team rates this High severity. The CVSS...

CVE-2026-78908

An information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass the web origin policy by tricking a user into opening a crafted HTML page. This can lead to exposure of sensitive data across origins. The NVD-assigned CVSS v3.1 score is 4.3 (Me...

CVE-2026-78914

CVE-2026-78914 is an uninitialized resource vulnerability in the Skia rendering library within Google Chrome prior to version 152.0.7977.65 . A remote attacker could exploit it by serving a crafted HTML page, potentially allowing memory reads inside the Chrome sandbox (information disclosure). Th...

CVE-2026-78955

CVE-2026-78955 affects Google Chrome prior to 152.0.7977.65 and Chromium-based browsers such as Microsoft Edge . The root cause is an observable discrepancy in the PerformanceAPIs , which allows a remote attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. The CVS...

CVE-2026-78967

CVE-2026-78967 is a missing authorization flaw in the Back-Forward Cache (BFCache) component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this via a crafted HTML page to bypass system access restrictions . The Chromium se...

CVE-2026-79007

CVE-2026-79007 is an uninitialized resource vulnerability in the GPU component of Google Chrome (and Chromium-based browsers such as Microsoft Edge ), affecting versions prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially read memory outsi...

CVE-2026-79039

A use-after-free vulnerability in the Mobile component of Google Chrome on iOS , affecting versions prior to 152.0.7977.65 , allows a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. The Chromium security severity is High , with a CVSS 3.1 base score of 8...

CVE-2026-79085

CVE-2026-79085 is a missing authorization flaw in the Network component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass the web origin policy via a crafted HTML page, potentially gaining unauthorized access to sensitive infor...

CVE-2026-79117

CVE-2026-79117 is a race condition in the WebAppInstalls component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering and a co-installed app can bypass the web origin policy , potentially enabling unauthorized access to sensit...

CVE-2026-79133

CVE-2026-79133 is an incorrect authorization flaw in the Forms component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can craft a malicious HTML page to obtain sensitive information from a user. The NVD assigns a CVSS 3.1 score of 6.5 (Medium) with vector AV:N/...

CVE-2026-79198

CVE-2026-79198 is a use-after-free vulnerability in the Platform component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can execute arbitrary code inside the browser sandbox by luring a user into visiting a crafted HTML page. The CNA-assigned CVSS v3.1 score is...

CVE-2026-79207

CVE-2026-79207 is an information leak in the Passwords component of Google Chrome on iOS , affecting versions prior to 152.0.7977.65 . A local attacker can obtain sensitive information by supplying a crafted file . Chromium rates the severity as Low , while NVD assigns a CVSS 3.1 score of 6.5 (ME...