CVE-2026-11136

CVE-2026-11136: Use-after-free in Canvas in Google Chrome before 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product: Google Chrome (Canvas component); root cause: use-after-free condition in Canvas handling. Impact: potent...

CVE-2012-2854

Google Chrome before 21.0.1180.57 on macOS/Linux and before 21.0.1180.60 on Windows/Chrome Frame is affected by CVE-2012-2854, which allows a remote attacker with access to a WebUI renderer process to obtain potentially sensitive pointer values. The issue is documented in multiple advisories and ...

CVE-2012-2859

CVE-2012-2859 affects Google Chrome on Linux (Chromium lineage in the OSS Chromium project). The issue arises in tab handling, leading to a crash and potential remote arbitrary code execution. Public references indicate this is part of a broader set of Chromium vulnerabilities disclosed in 2012. ...

CVE-2012-5122

Technical details for CVE-2012-5122 are not publicly available in the provided documents. Monitor for updates from primary advisories; current sources list the CVE among Chrome/Chromium vulnerabilities but do not specify affected versions, vectors, or fixes in this bundle.

CVE-2012-5138

CVE-2012-5138 affects Chromium; the issue is incorrect file path handling . Public references in openSUSE/SUSE advisories show this CVE is included in the Chromium updates. The connected documents indicate a remediation path via upgrading Chromium to newer releases (e.g., openSUSE/SU-2012:1637-1,...

CVE-2013-0828

The vulnerability CVE-2013-0828 affects Google Chrome’s built-in PDF processing. In Chrome versions before 24.0.1312.52, a faulty cast of an unspecified variable during processing of the root of the structure tree in PDFs can be abused by a crafted document to cause a denial of service (and possi...

CVE-2014-1681

CVE-2014-1681 affects Google Chrome prior to 32.0.1700.102. The provided documents describe multiple vulnerabilities with unknown impact/vectors and list a high base score (CVSS 2.0 10.0) on NVD; OpenVAS entries corroborate “Google Chrome Multiple Vulnerabilities” with platform coverage (Mac, Lin...

CVE-2014-7902

CVE-2014-7902 is a use-after-free in PDFium used by Google Chrome prior to 39.0.2171.65, exploitable via a crafted PDF to cause a denial of service (and possibly unspecified other impact). OpenSUSE/SUSE advisories indicate upgrading Chrome to 39.0.2171.65 fixes this along with other CVEs (e.g., 7...

CVE-2015-6582

CVE-2015-6582 concerns the Blink decompose function in TransformationMatrix.cpp used by Google Chrome prior to 45.0.2454.85, which does not verify whether matrix inversion succeeded. This can allow remote attackers to cause an uninitialized memory access and crash (denial of service) or potential...

CVE-2015-8479

CVE-2015-8479 affects Google Chrome prior to 47.0.2526.73, where a use-after-free in AudioOutputDevice::OnDeviceAuthorized (media/audio/audio_output_device.cc) can cause a denial of service via heap memory corruption or potentially other unspecified impact when accessing an unauthorized audio out...

CVE-2025-8579

CVE-2025-8579 affects Google Chrome/Chromium’s Picture-in-Picture implementation. The connected documents confirm an inappropriate implementation in Picture-in-Picture prior to version 139.0.7258.66 that allows a remote attacker, tricking a user into specific UI gestures, to perform UI spoofing v...

CVE-2026-10901

CVE-2026-10901 is a use-after-free vulnerability in Passwords for Google Chrome on macOS, exploitable when a user is lured into specific UI gestures and visits a crafted HTML page. Affected: Chrome on macOS prior to 149.0.7827.53. Impact: remote code execution via a crafted page; Chromium indicat...

CVE-2026-10929

Summary (CVE-2026-10929) : A heap buffer overflow in ANGLE used by Google Chrome on Android is exploitable prior to Chrome 149.0.7827.53. If a renderer process is compromised, a remote attacker could potentially escape the sandbox via a crafted HTML page, as described with Chromium severity: High...

CVE-2026-11024

CVE-2026-11024: A stack buffer overflow in Skia used by Google Chrome/Chromium prior to 149.0.7827.53 allows remote exploitation via a crafted HTML page, potentially causing stack corruption. Multiple connected sources confirm affected components and versions (Chromium/Skia, Chrome upstream), wit...

CVE-2026-11071

CVE-2026-11071 describes a use-after-free in Base within Google Chrome on Linux prior to version 149.0.7827.53. The issue allows a remote attacker who has compromised the renderer process to read potentially sensitive information from process memory via a crafted HTML page. Affected product: Goog...

CVE-2026-11142

CVE-2026-11142 affects Google Chrome (Chromium-based) via insufficient policy enforcement in Paint, allowing a remote attacker to bypass the same-origin policy through a crafted HTML page. The issue originates in Chromium/Paint handling and is associated with a fix in Chrome’s 149.0.7827.53 timef...

CVE-2026-11147

The CVE-2026-11147 vulnerability is a use-after-free in WebML within Google Chrome for Windows, located in the Chromium-based WebML implementation. The issue allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected software/version: Google Chrome on ...

CVE-2026-11149

The CVE-2026-11149 entry concerns Google Chrome Extensions with insufficient validation of untrusted input, enabling privilege escalation when a renderer process is compromised. Affected software: Google Chrome prior to version 149.0.7827.53. Root cause: untrusted input validation in Extensions. ...

CVE-2026-11163

CVE-2026-11163 describes a use-after-free in Messages for Google Chrome on Android, prior to version 149.0.7827.53, enabling a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. The underlying issue is a memory safety flaw in the Android Messages interaction, leadin...

CVE-2026-11200

CVE-2026-11200 concerns Google Chrome’s WebRTC implementation. A faulty WebRTC handling introduced in Chrome versions before 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The CVSS metrics indicateNETWORK attack vector, low to moderate access complexity...

CVE-2026-11204

CVE-2026-11204 describes an inappropriate implementation in the Signin flow of Google Chrome on iOS before 149.0.7827.53 that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is in the Chromium-based iOS Signin function, with a Network attack v...

CVE-2026-11642

CVE-2026-11642 describes a use-after-free in Google Chrome’s Web Apps renderer that could allow a remote attacker who already compromised the renderer to potentially perform a sandbox escape via a crafted HTML page. Affected product: Chrome (Web Apps) prior to version 149.0.7827.103. Impact : san...

CVE-2026-11676

CVE-2026-11676 affects Google Chrome on Linux/ChromeOS (Dawn component) and is due to insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is observed prior to Chr...

CVE-2026-11698

CVE-2026-11698 affects Google Chrome on macOS. The connected documents confirm a use-after-free in the Bluetooth subsystem of Chrome/Chromium, leading to a potential heap corruption condition when processing a crafted HTML page. The vulnerability is triggered in Chrome builds prior to version 149...

CVE-2026-13035

Chromium-based Google Chrome on macOS is affected by a Bluetooth use-after-free vulnerability that could allow a remote attacker to execute arbitrary code via a malicious peripheral; the fix is in Chrome 149.0.7827.197 and later.

CVE-2026-13799

CVE-2026-13799 is a heap-corruption risk caused by a Use-After-Free in QUIC within Google Chrome prior to 150.0.7871.47. Public sources consistently describe the vulnerability as a QUIC-related use-after-free issue that could be triggered by malicious network traffic, leading to potential heap co...

CVE-2026-13814

CVE-2026-13814 affects Google Chrome (Views) with use-after-free in the rendering/Views UI path, prior to 150.0.7871.47. Root cause: use-after-free leading to potential heap corruption. Attack flow requires user interaction (specific UI gestures) and a crafted HTML page; impact is high confidenti...

CVE-2026-13849

Chromoting component in Google Chrome on Windows is affected by CVE-2026-13849 due to insufficient validation of untrusted input, allowing a local attacker to potentially perform a sandbox escape via a malicious file. The issue affects Chrome’s Windows builds prior to version 150.0.7871.47 and is...

CVE-2026-13850

Affected product: Chrome for iOS (Google Chrome on iOS). Vulnerability: insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47, allowing a local attacker to execute arbitrary code inside the browser sandbox via a malicious file. Root cause is input validation ...

CVE-2026-13854

This CVE concerns a Use-After-Free in Ozone within Google Chrome on Linux, before version 150.0.7871.47. The underlying issue is a memory safety flaw that could allow a remote attacker, who already compromised the renderer process, to escape the Chrome sandbox via a crafted HTML page. Affected co...

CVE-2026-13869

CVE-2026-13869 describes a use-after-free in Device in Google Chrome on Windows, before version 150.0.7871.47. A remote attacker who had already compromised the renderer process could potentially escape the sandbox via a crafted HTML page. The issue is tied to Chromium components and is classifie...

CVE-2026-13889

Consolidated analysis for CVE-2026-13889: A side-channel information leakage in WebAuthentication on Google Chrome for iOS (Chromium-based) affects the WebAuthentication component. The vulnerability allows a remote attacker to leak cross-origin data through a crafted HTML page. Affected product/a...

CVE-2026-13894

Affected software: Google Chrome (Chromium-based). The issue is described as insufficient policy enforcement in the Network component prior to version 150.0.7871.47, allowing an attacker with a privileged network position to bypass navigation restrictions via a crafted HTML page. Severity is rate...

CVE-2026-13920

CVE-2026-13920 describes insufficient validation of untrusted input in Chrome’s media handling on Windows before 150.0.7871.47, allowing a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affected software: Google Chrome on Windows (renderer process). Root ...

CVE-2026-13937

CVE-2026-13937 concerns Google Chrome where insufficient policy enforcement in passwords handling within the Chromium-based renderer allowed a remote attacker who had already compromised the renderer to leak cross-origin data via a crafted HTML page. The vulnerability is described in multiple sou...

CVE-2026-13964

CVE-2026-13964 affects WebView in Google Chrome on Android. The vulnerability is due to insufficient policy enforcement that allowed bypassing navigation restrictions via a crafted HTML page. Impact is a medium severity remote issue. The documented fix is Chrome version 150.0.7871.47 or later; up...

CVE-2026-13972

CVE-2026-13972 affects Google Chrome (Paint) prior to version 150.0.7871.47. Root cause: Inappropriate implementation in Paint allowing a remote attacker to trigger UI spoofing through a crafted HTML page. Impact is UI spoofing with no data disclosure or other impacts stated; impact categories in...

CVE-2026-14018

CVE-2026-14018 describes a use-after-free in Chrome’s Updater on Windows prior to 150.0.7871.47, enabling a local attacker to escalate privileges via a malicious file. Affected software: Google Chrome (Windows). Root cause: use-after-free in the Updater component. Impact: OS-level privilege escal...

CVE-2026-14022

Affected software/area: Google Chrome (Chromium-based rendering pipeline), with the issue in the Network component due to insufficient validation of untrusted input. Vulnerability details: A remote attacker who has compromised the renderer process can cause leakage of cross-origin data via a craf...

CVE-2026-15768

CVE-2026-15768 affects Google Chrome’s HTML-in-Canvas: insufficient policy enforcement could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is tied to Chrome prior to version 150.0.7871.125. A Chromium security advisory confirms this CVE among 15 fixes...

CVE-2026-17781

CVE-2026-17781 describes an inappropriate implementation in Chrome’s Extensions component (Chromium) that could allow a user-interaction-required attacker who tricks a user into installing a malicious extension to leak cross-origin data via the extension. Upstream details reference Chromium issue...

CVE-2026-17854

The CVE-2026-17854 entry concerns Google Chrome/Chromium WebMCP with insufficient policy enforcement, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected product is Chromium-based; the vulnerability is tied to WebMCP in Chrome prior to version 151.0.7922....

CVE-2026-17856

CVE-2026-17856 affects Google Chrome on macOS before version 151.0.7922.72. An inappropriate implementation in the Network component of Chromium allows a remote attacker who has already compromised a renderer process to potentially perform a sandbox escape via a crafted HTML page. Upstream and Re...

CVE-2026-17965

CVE-2026-17965 involves incorrect security UI in Google Chrome on iOS. Chrome for iOS versions prior to 151.0.7922.72 are affected, enabling a remote attacker to trigger UI spoofing via a crafted HTML page. The issue is tied to Chrome’s iOS UI security, with impact described as UI spoofing and a ...

CVE-2026-17968

CVE-2026-17968 affects Google Chrome on Android and is caused by an uninitialized use in WebXR, enabling a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The issue is tied to Chrome versions preceding 151.0.7922.72; remediation is to update ...

CVE-2026-17985

CVE-2026-17985 (Google Chrome) : The Chrome vulnerability is described as insufficient policy enforcement in the Speech component that could allow a remote attacker to bypass site isolation using a crafted HTML page, with affected versions prior to 151.0.7922.72. The issue impacts Chrome’s handli...

CVE-2026-5292

CVE-2026-5292 affects Google Chrome WebCodecs: an out-of-bounds memory read is possible via a crafted HTML page in Chrome versions before 146.0.7680.178. Multiple connected sources (Chromium/Chrome security notes and vendor advisories) corroborate that the WebCodecs component is the vulnerable su...

CVE-2026-7345

CVE-2026-7345 affects Google Chrome (earlier than 147.0.7727.138). The root cause is insufficient validation of untrusted input in the Feedback component. This could allow a remote attacker with access to a compromised renderer process to escape the sandbox via a crafted HTML page, leading to pot...

CVE-2026-7350

CVE-2026-7350 is corroborated across multiple sources (NVD, Debian, CVE lists) as a use-after-free in WebMIDI in Google Chrome prior to 147.0.7727.138. A remote attacker who has compromised the renderer could trigger a sandbox escape via a crafted HTML page. The advisory notes the high severity a...

CVE-2026-78985

Google Chrome prior to 152.0.7977.65 is affected by an incorrect reference resolution flaw in its FileSystem component. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page , potentially executing arbitrary code outside the browser's security sandbox...