CVE-2026-87602

CVE-2026-87602 is an out-of-bounds read in the ANGLE component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker can read memory outside the sandbox by delivering a crafted HTML page to the user, requiring user interaction but no privileges. Chromium rate...

CVE-2026-87621

CVE-2026-87621 is an out-of-bounds write in the ANGLE component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by luring a user into visiting a crafted HTML page. The flaw was rated High by t...

CVE-2026-87625

CVE-2026-87625 is a use-after-free vulnerability in V8 , the JavaScript engine used by Google Chrome, affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted Chrome extension delivered through social engineering to execute arbitrary code inside the Chrome sandbo...

CVE-2026-87637

CVE-2026-87637 is a use-after-free vulnerability in the Extensions component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . The CNA-assigned CVSS 3.1 score is 9.6 (Cri...

CVE-2026-87642

CVE-2026-87642 is an uninitialized resource vulnerability in the WebGL component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit a crafted HTML page to leak cross-origin data . The Chromium security team rated this as Medium severity, with a CVSS 3.1 s...

CVE-2026-87643

CVE-2026-87643 is an integer overflow in the GPU component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by luring a user to a crafted HTML page. The vulnerability was rated Medium by Chromi...

CVE-2026-87644

CVE-2026-87644 is an incorrect authorization flaw in Views in Google Chrome on Windows prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process and leveraged social engineering could execute arbitrary code outside the sandbox via a crafted HTML page. The fix shi...

CVE-2026-87650

CVE-2026-87650 is an out-of-bounds read in the WebGL component of Google Chrome versions prior to 153.0.8010.36 , rated CVSS 9.6 (Critical) . A remote attacker can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page that requires user interaction to load. CISA...

CVE-2026-87653

UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87437

CVE-2026-87437 is an information leak in the Frames component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to leak sensitive information. Chromium rates the severity as Low , while the assigned CVSS 3.1 score is 6.5 (MEDIUM) with high ...

CVE-2026-87443

Google Chrome prior to 153.0.8010.36 is affected by a missing authorization vulnerability in the Actor component. A remote attacker could obtain sensitive information by luring a user into visiting a crafted HTML page. The Chromium project rates this as Medium severity, with a CVSS 3.1 score of 6...

CVE-2026-87454

CVE-2026-87454 is an information leak in Google Chrome Enterprise on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker can obtain sensitive information by luring a user into visiting a crafted HTML page . The vulnerability is rated Medium severity (CVSS 3.1: 6.5, vector AV:N...

CVE-2026-87462

UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87480

A use after free vulnerability in the Printing component of Google Chrome (prior to 153.0.8010.36 ) allowed a remote attacker who had already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium project rates this as High...

CVE-2026-87495

CVE-2026-87495 is an information leak in the Scroll component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to leak cross-origin data , resulting in a low confidentiality impact . Chromium rates this ...

CVE-2026-87514

Use after free in the Views component of Google Chrome prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the sandbox via a local program. The vulnerability is rated CVSS 8.1 (High) with a local attack vector, high complexity, and changed scope. CISA's SSVC assessmen...

CVE-2026-87523

A race condition in the DataTransfer component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to obtain sensitive information . The CVSS 3.1 score is 6.5 (MEDIUM) with high confidentiality impact , while Chromium rates the...

CVE-2026-87531

Google Chrome prior to 153.0.8010.36 is affected by an information leak in CORS (Cross-Origin Resource Sharing) handling. A remote attacker who had already compromised the renderer process could obtain cross-origin data via a crafted HTML page. The vulnerability was rated Medium by Chromium and c...

CVE-2026-87550

CVE-2026-87550 is an improper encoding or escaping flaw in CSS output in Google Chrome prior to 153.0.8010.36 , allowing a remote attacker to bypass the web origin policy via a crafted HTML page. The Chromium security team rated the severity as Medium (CVSS 4.3), requiring user interaction with n...

CVE-2026-87553

CVE-2026-87553 is an improper input validation flaw in the SiteIsolation component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox by serving a crafted HTML page. The vulnerab...

CVE-2026-87557

Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87558

CVE-2026-87558 is a use-after-free vulnerability in the Payments component of Google Chrome on Mac prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , rated CVSS 9.6 (CRITICAL) . CISA's SSVC assessment indicates no know...

CVE-2026-87560

Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87562

Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87563

CVE-2026-87563 is an origin validation error in the Paint component of Google Chrome (prior to 153.0.8010.36 ). A remote attacker could obtain cross-origin data by serving a crafted HTML page to a victim. The vulnerability is rated Medium severity by Chromium (CVSS 3.1 score 4.3 , requiring user ...

CVE-2026-87564

Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87566

An observable discrepancy in the Layout component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information by convincing a user to open a crafted HTML page . The Chromium security team rated the severity as Medium , with a CVSS 3.1 base score of 5.3 (network...

CVE-2026-87572

CVE-2026-87572 is an injection vulnerability in DevTools within Google Chrome versions prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 base score is 8.3 (Hi...

CVE-2026-87614

CVE-2026-87614 is an incorrect authorization flaw in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could bypass the web origin policy via a crafted HTML page. Chromium rates the severity as Low (CVSS 3.1 ba...

CVE-2026-87617

A use-after-free vulnerability in DevTools within Google Chrome prior to 153.0.8010.36 allows a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium assigns a Low security severity, while the CNA-assigned CVSS 3.1 score is 8....

CVE-2026-87618

CVE-2026-87618 affects Google Chrome on Windows prior to version 153.0.8010.36 . The vulnerability is an incorrect reference resolution in the Storage component, allowing a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox v...

CVE-2026-87623

This Medium -severity vulnerability affects the DOM (Document Object Model) in Google Chrome prior to 153.0.8010.36 . An observable discrepancy in the DOM allows a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted HTML page. The CVSS v3.1 score is 6.5 ...

CVE-2026-87629

Google Chrome prior to version 153.0.8010.36 is affected by an incorrect authorization vulnerability in the Sources component. A remote attacker leveraging social engineering can leak sensitive information via a crafted HTML page. Chromium rates the security severity as Low . The CVSS 3.1 base sc...

CVE-2026-87652

An incorrect authorization vulnerability in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass the web origin policy using a crafted HTML page. The flaw required user interaction and a pre-compromised renderer, limi...

CVE-2026-87432

Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87434

CVE-2026-87434 is a missing-authorization vulnerability in CORS handling in Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could bypass the web origin policy using a crafted HTML page, leading to low confidentiality impact. The CVSS 3.1 s...

CVE-2026-87465

Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87466

CVE-2026-87466 is an incorrect authorization flaw in Service Workers within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can deliver a crafted HTML page that causes a bypass of the web origin policy , potentially allowing unauthorized cross-origin access with low ...

CVE-2026-87478

An observable discrepancy in the Autofill component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information by delivering a crafted HTML page . The vulnerability carries a Medium Chromium security severity and a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR...

CVE-2026-87485

CVE-2026-87485 affects Google Chrome prior to 153.0.8010.36 and stems from incorrect authorization in CORS (Cross-Origin Resource Sharing). A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to bypass the web origin policy , potentially accessing ...

CVE-2026-87508

CVE-2026-87508 is an incorrect authorization flaw in the Loader component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can leverage a crafted HTML page to bypass the web origin policy , resulting in limited confidentiality impact. The vulnerability requires use...

CVE-2026-87509

CVE-2026-87509 is an incorrect authorization flaw in the Updater component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker can leverage this to execute arbitrary code outside the sandbox via a local program. Chromium rates the severity as Low , while the...

CVE-2026-87554

CVE-2026-87554 is a race condition in Chromoting (Chrome's remote desktop component) affecting Google Chrome on Windows prior to 153.0.8010.36 . A local attacker can exploit the flaw via a local program to execute arbitrary code outside the sandbox , rated High severity by Chromium and 8.1 (HIGH)...

CVE-2026-87559

UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87568

Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

CVE-2026-87573

CVE-2026-87573 is an improper input validation vulnerability in the Network component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can bypass the web origin policy by serving a crafted HTML page, leading to a low confidentiality impact (no integrity or availability impact p...

CVE-2026-87598

CVE-2026-87598 affects the ServiceWorker component in Google Chrome prior to 153.0.8010.36 , where an incorrect authorization allows a remote attacker to bypass the web origin policy by serving a crafted HTML page to the victim. Chromium rates the severity as Low ; the CVSS 3.1 score is 4.3 (Medi...

CVE-2026-87607

CVE-2026-87607 is a use after free vulnerability in the Device component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page to a user. The vulnerability is rated CRI...

CVE-2026-87632

Google Chrome prior to 153.0.8010.36 is affected by a cross-site scripting vulnerability in the SanitizerAPI component. A remote attacker can deliver a crafted HTML page that bypasses the web origin policy , enabling unauthorized script execution in the context of another origin. The vulnerabilit...

CVE-2026-87635

UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)