CVE-2026-87508

CVE-2026-87508 is an incorrect authorization flaw in the Loader component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage a crafted HTML page to bypass the web origin policy , resulting in limited confidentiality impact. The vulnerability requires use...

CVE-2026-87512

A use after free vulnerability in ANGLE (the Android Native Graphics Library for EGL) in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The Chromium security team rated the ...

CVE-2026-87621

CVE-2026-87621 is an out-of-bounds write in the ANGLE component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by luring a user into visiting a crafted HTML page. The flaw was rated High by t...

CVE-2026-87628

A use-after-free vulnerability in the Cast component of Google Chrome prior to version 153.0.8010.36 allows an adjacent-network attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. The Chromium project rates the severity as Critical , and the CVSS 3.1 ba...

CVE-2026-93386

CVE-2026-93386 is a UI misrepresentation vulnerability in Google Chrome 's WebAppInstalls component, affecting versions prior to 153.0.8010.52 . A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page, rated Low by Chromium and CVSS 5.4 (Medium) by NVD. The...

CVE-2026-78898

CVE-2026-78898 is an incorrect authorization vulnerability in the Downloads component of Google Chrome prior to 152.0.7977.65 . A remote attacker, leveraging social engineering , could bypass system access restrictions via a crafted HTML page. The Chromium security severity is Medium , with a CVS...

CVE-2026-79017

A race condition in the Extensions component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system access restrictions via a crafted Chrome extension. The Chromium security team rates it Low severity; CVSS 3.1 scores it 6.5 (Medium) with high integrity impact but no co...

CVE-2026-79051

CVE-2026-79051 is an incorrect authorization vulnerability in the Loader component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit it by enticing a user to visit a crafted HTML page , resulting in a web origin policy bypass . The CVSS 3.1 base score is 4.3 (Medium) , with ...

CVE-2026-79089

A race condition in the Transactions Platform of Google Chrome on Android (prior to version 152.0.7977.65 ) allows a remote attacker, leveraging social engineering and a crafted HTML page, to bypass system access restrictions and gain unauthorized access to sensitive system functions . The vulner...

CVE-2026-7919

CVE-2026-7919 affects Google Chrome/Aura. Use-after-free in Aura prior to 148.0.7778.96 could allow a renderer‑process‑compromised attacker to escape the sandbox via a crafted HTML page. The Chrome 148 stable release (148.0.7778.96 and later) includes fixes for this issue. Mitigation is to update...

CVE-2026-79198

CVE-2026-79198 is a use-after-free vulnerability in the Platform component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can execute arbitrary code inside the browser sandbox by luring a user into visiting a crafted HTML page. The CNA-assigned CVSS v3.1 score is...

CVE-2026-79206

CVE-2026-79206 is an out-of-bounds read in the FileSystem component of Google Chrome prior to 152.0.7977.65 , allowing a remote attacker to read memory outside the sandbox via a crafted HTML page delivered through social engineering. Chromium rates the severity as Low ; CVSS 3.1 scores it 6.5 (Me...

CVE-2026-79270

CVE-2026-79270 is an uninitialized resource vulnerability in ANGLE (the cross-platform graphics layer) within Google Chrome prior to 152.0.7977.65 . A remote attacker can read memory outside the browser's security sandbox by serving a crafted HTML page , resulting in an information disclosure. Ch...

CVE-2024-7017

CVE-2024-7017: In Google Chrome DevTools an inappropriate implementation allows sandbox escape via a crafted HTML page. Affected product is Google Chrome (DevTools). Root cause: DevTools mal-implementation described as an inappropriate implementation. Impact: potential sandbox escape with high se...

CVE-2025-11212

CVE-2025-11212 concerns an inappropriate Media module implementation in Google Chrome on Windows, enabling domain spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. The connected Fedora advisories indicate Chromium-based updates addressing this vulnerability: ...

CVE-2025-12435

CVE-2025-12435 describes an incorrect security UI in the Omnibox that enables UI spoofing in Chromium-based browsers (Chrome on Android pre-142.0.7444.59). Connected advisories show Chromium/CEF updates shipping versions 142.0.7444.162 and corresponding Chromium-based Edge patches, indicating the...

CVE-2026-5875

CVE-2026-5875 is a policy bypass in Blink used by Google Chrome before version 147.0.7727.55, allowing a remote attacker to spoof UI via a crafted HTML page. The CVSS 3.1 base score is 4.3 (Medium), with network attack vector, no privileges required, user interaction required, and partial integri...

CVE-2026-78960

CVE-2026-78960 is an information leak in the Extensions component of Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering can obtain cross-origin data by installing a specially crafted Chrome extension. The vulnerability requires user interaction (installing the ...

CVE-2026-78967

CVE-2026-78967 is a missing authorization flaw in the Back-Forward Cache (BFCache) component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this via a crafted HTML page to bypass system access restrictions . The Chromium se...

CVE-2026-78969

CVE-2026-78969 is an uninitialized resource vulnerability in the Video component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can read memory inside the browser sandbox by luring a user to a crafted HTML page, resulting in high confidentiality impact (CVSS 6.5, Medium; CISA...

CVE-2026-79007

CVE-2026-79007 is an uninitialized resource vulnerability in the GPU component of Google Chrome (and Chromium-based browsers such as Microsoft Edge ), affecting versions prior to 152.0.7977.65 . A remote attacker who had already compromised the renderer process could potentially read memory outsi...

CVE-2026-79059

CVE-2026-79059 is an information leak in the Back-Forward Cache (BFCache) component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can craft a malicious HTML page to obtain cross-origin data , resulting in a limited confidentiality imp...

CVE-2026-7913

Summary: CVE-2026-7913 describes an "Insufficient policy enforcement in DevTools" in Google Chrome on Android . The issue allows a local attacker to escalate privileges through a malicious file, with a Chromium security severity listed as High. The vulnerability is defined as affecting the DevToo...

CVE-2026-87484

CVE-2026-87484 is a UI misrepresentation vulnerability in the Geometry component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage social engineering to spoof UI elements via a crafted HTML page, requiring user interaction. The Chromium security team ra...

CVE-2026-93381

CVE-2026-93381 is a buffer overflow in PDFium , Chrome's PDF rendering engine, affecting Google Chrome on Windows prior to version 153.0.8010.52 . A remote attacker can deliver a crafted PDF file via social engineering to achieve arbitrary code execution inside the sandbox . The vulnerability was...

CVE-2026-4452

CVE-2026-4452 details an integer overflow in ANGLE used by Google Chrome on Windows, allowing remote heap corruption via a crafted HTML page. Connected documents confirm vulnerable ANGLE/Chromium components and reference patches in Chromium-based packages (e.g., Chromium around 146.0.7680.153 and...

CVE-2026-6313

CVE-2026-6313 : Google Chrome had insufficient policy enforcement in CORS before version 147.0.7727.101 , allowing a remote attacker who already compromised a renderer process to leak cross-origin data via a crafted HTML page. The vulnerability is ranked High impact. Affected product: Google Chro...

CVE-2026-78974

CVE-2026-78974 is a UI misrepresentation vulnerability in the Linux Toolkit Theming component of Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering could use a crafted HTML page to bypass system access restrictions . Chromium rates the severity as Low ; the CVS...

CVE-2026-79014

A race condition in Chrome's Autofill component (prior to 152.0.7977.65 ) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page. According to Red Hat, this bypass could enable access to or manipulation of data across diff...

CVE-2026-79084

CVE-2026-79084 is an inadequate encryption strength flaw in the Notifications component of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering can bypass the web origin policy via a crafted HTML page. The CVSS 3.1 score is 4.3 (Me...

CVE-2026-79095

CVE-2026-79095 is an information leak in the Payments component of Google Chrome prior to version 152.0.7977.65 , allowing a remote attacker to obtain cross-origin data by luring a user into visiting a crafted HTML page . The CVSS 3.1 score is 4.3 (Medium) with required user interaction. The fix ...

CVE-2026-79154

CVE-2026-79154 is a missing authorization flaw in DevTools in Google Chrome prior to version 152.0.7977.65 . A remote attacker, by leveraging social engineering and user interface interaction , can obtain sensitive information. The CVSS 3.1 score is 6.5 (Medium) with a network attack vector and h...

CVE-2026-79214

CVE-2026-79214 is an improper input validation flaw in the Preload component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can craft a malicious HTML page to bypass the web origin policy , potentially gaining unauthorized access to da...

CVE-2026-79249

A code injection vulnerability in the Bisection component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to obtain sensitive information by tricking a user into processing a specially crafted file. The vulnerability requires user interaction and has no integrity or availability ...

CVE-2026-79253

An improper input validation flaw in the Network component of Google Chrome for Windows (versions prior to 152.0.7977.65 ) allows a remote attacker, leveraging social engineering , to leak sensitive information via a crafted HTML page. The CVSS 3.1 score is 6.5 (Medium) with a Chromium internal s...

CVE-2026-93384

CVE-2026-93384 is a Medium -severity server-side request forgery (SSRF) vulnerability in the Omnibox component of Google Chrome on Android . A remote attacker leveraging social engineering could send crafted network traffic to bypass system access restrictions. The flaw was reported by Google on ...

CVE-2025-11213

CVE-2025-11213 describes an Omnibox implementation issue in Google Chrome on Android that allows domain spoofing via a crafted HTML page when a user is persuaded to perform specific UI gestures. The available connected documents confirm a Chromium/Chrome family fix in the 141.0.7390.54+ range, wi...

CVE-2025-12446

The CVE-2025-12446 issue affects Google Chrome (Chromium-based) before version 142.0.7444.59, where an Incorrect security UI in SplitView could be exploited by a user who engaged in specific UI gestures to trigger UI spoofing via a crafted domain name. The connected Astra/Fedora/DEBIAN/EUVD entri...

CVE-2026-6308

CVE-2026-6308 is a Google Chrome/Chromium vulnerability: an out-of-bounds read in the Media component that can be triggered by a user who is persuaded to perform specific UI gestures on a crafted HTML page. The issue affects Chrome/Chromium prior to version 147.0.7727.101; patches are included in...

CVE-2026-79038

An incorrect authorization flaw in the WebProtect component of Google Chrome prior to version 152.0.7977.65 allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page. The attack requires user interaction but no prior access, with a CVS...

CVE-2026-79108

CVE-2026-79108 is a UI misrepresentation flaw in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering could craft an HTML page to bypass system access restrictions . Chromium rates the severity as Low ; the CNA-ass...

CVE-2026-79116

CVE-2026-79116 is a missing authorization flaw in the Viz component of Google Chrome prior to 152.0.7977.65 . The vulnerability requires an attacker to have already compromised the renderer process , after which a crafted HTML page can be used to bypass the web origin policy , potentially enablin...

CVE-2026-79220

CVE-2026-79220 is an information leak in the Network component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to obtain sensitive information. The vulnerability carries a CVSS 3.1 s...

CVE-2026-79243

CVE-2026-79243 is an improper input validation flaw in the ReadingList component of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass the web origin policy via a crafted HTML page, potentially gaini...

CVE-2026-79251

CVE-2026-79251 is an improper input validation vulnerability in the Network component of Google Chrome prior to 152.0.7977.65 . A remote attacker can potentially bypass web origin policy via a crafted HTML page, with a CVSS v3.1 score of 4.3 (Medium) requiring user interaction. The fix is include...

CVE-2026-87558

CVE-2026-87558 is a use-after-free vulnerability in the Payments component of Google Chrome on Mac prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , rated CVSS 9.6 (CRITICAL) . CISA's SSVC assessment indicates no know...

CVE-2026-91729

CVE-2026-91729 is a use-after-free vulnerability in DigitalCredentials in Google Chrome prior to 153.0.8010.47 , reported by researcher sean geofrey on 2026-09-04 (bug 557206809 ). A remote attacker leveraging social engineering can execute arbitrary code outside the sandbox via a crafted HTML pa...

CVE-2026-91738

CVE-2026-91738 is an improper input validation vulnerability in ANGLE (the cross-platform graphics translation library) within Google Chrome , fixed in version 153.0.8010.47 for Windows, Mac, and Linux. A remote attacker could potentially execute arbitrary code outside the sandbox by luring a use...

CVE-2024-9126

CVE-2024-9126 affects Google Chrome on iOS (Internals component). A use-after-free in Internals could allow heap corruption when a user is guided to perform specific UI gestures. The issue is mitigated by updating Chrome to version 127.6533.88 or later (per Chrome release notes). Exploitation is ...

CVE-2026-5892

CVE-2026-5892 affects Google Chrome/Chromium PWAs. The root cause is insufficient policy enforcement for PWAs in the renderer, allowing a remote attacker who had compromised the renderer to install a PWA without user consent via a crafted HTML page. Affected versions are prior to 147.0.7727.55 (C...