CVE-2026-79270

CVE-2026-79270 is an uninitialized resource vulnerability in ANGLE (the cross-platform graphics layer) within Google Chrome prior to 152.0.7977.65 . A remote attacker can read memory outside the browser's security sandbox by serving a crafted HTML page , resulting in an information disclosure. Ch...

CVE-2026-78943

CVE-2026-78943 is an improper input validation flaw in the Editing component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can, by leveraging social engineering , trick a user into interacting with a crafted HTML page to bypass the we...

CVE-2026-79003

An incorrect authorization flaw in the Device component of Google Chrome prior to 152.0.7977.65 allows a remote attacker, leveraging social engineering , to bypass system access restrictions via a crafted HTML page. The vulnerability is rated Medium severity (CVSS 3.1: 4.3 , vector AV:N/AC:L/PR:N...

CVE-2026-79016

CVE-2026-79016 is an observable discrepancy in the SVG component of Google Chrome prior to version 152.0.7977.65 , allowing a remote attacker to obtain cross-origin data by persuading a user to visit a crafted HTML page . The CVSS 3.1 score is 4.3 (Medium) , with user interaction required and low...

CVE-2026-79038

An incorrect authorization flaw in the WebProtect component of Google Chrome prior to version 152.0.7977.65 allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page. The attack requires user interaction but no prior access, with a CVS...

CVE-2026-79077

CVE-2026-79077 is an incorrect authorization flaw in WebProtect , a component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can craft a malicious HTML page to bypass system access restrictions , resulting in low integrity impact. Chromium rates the severity as Low ; the CVSS...

CVE-2026-79089

A race condition in the Transactions Platform of Google Chrome on Android (prior to version 152.0.7977.65 ) allows a remote attacker, leveraging social engineering and a crafted HTML page, to bypass system access restrictions and gain unauthorized access to sensitive system functions . The vulner...

CVE-2026-79104

CVE-2026-79104 is a missing authorization flaw in the Sensor component of Google Chrome prior to version 152.0.7977.65 . An attacker who has already compromised the renderer process can exploit this via a crafted HTML page to obtain sensitive information , resulting in high confidentiality impact...

CVE-2026-79108

CVE-2026-79108 is a UI misrepresentation flaw in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering could craft an HTML page to bypass system access restrictions . Chromium rates the severity as Low ; the CNA-ass...

CVE-2026-79124

CVE-2026-79124 is an information leak in the Intents component of Google Chrome on Android (prior to 152.0.7977.65 ). A remote attacker can exploit it via a crafted HTML page to leak sensitive information. Chromium rates the severity as Low , while CVSS 3.1 scores it 6.5 (MEDIUM) with a network v...

CVE-2026-79133

CVE-2026-79133 is an incorrect authorization flaw in the Forms component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can craft a malicious HTML page to obtain sensitive information from a user. The NVD assigns a CVSS 3.1 score of 6.5 (Medium) with vector AV:N/...

CVE-2026-79220

CVE-2026-79220 is an information leak in the Network component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to obtain sensitive information. The vulnerability carries a CVSS 3.1 s...

CVE-2026-79222

An incorrect authorization flaw in CustomTabs within Google Chrome on Android (prior to 152.0.7977.65 ) allows a local attacker, through a co-installed application, to bypass the web origin policy . Red Hat notes this could lead to unauthorized access to sensitive information or actions within th...

CVE-2026-79276

CVE-2026-79276 is an improper privilege management vulnerability in the FileSystem component of Google Chrome prior to 152.0.7977.65 . A remote attacker, leveraging social engineering , can bypass system access restrictions by getting a user to interact with a crafted HTML page . The Chromium sec...

CVE-2026-78898

CVE-2026-78898 is an incorrect authorization vulnerability in the Downloads component of Google Chrome prior to 152.0.7977.65 . A remote attacker, leveraging social engineering , could bypass system access restrictions via a crafted HTML page. The Chromium security severity is Medium , with a CVS...

CVE-2026-78912

CVE-2026-78912 is a UI misrepresentation vulnerability in the Browser component of Google Chrome prior to 152.0.7977.65 . A remote attacker can spoof UI elements via a crafted HTML page, potentially deceiving users. The Chromium security severity is Medium (CVSS 3.1 base score 5.4: network vector...

CVE-2026-78941

CVE-2026-78941 is an information leak in the Core component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could bypass site isolation using a crafted HTML page, leaking sensitive information. The CVSS 3.1 score is 3.1 (Low) wi...

CVE-2026-78958

CVE-2026-78958 is an uninitialized resource vulnerability in Skia , the 2D graphics library used by Google Chrome (prior to 152.0.7977.65 ) and Microsoft Edge (prior to 152.0.4191.53 ). A remote attacker who had already compromised the renderer process could use a crafted HTML page to obtain cros...

CVE-2026-78969

CVE-2026-78969 is an uninitialized resource vulnerability in the Video component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can read memory inside the browser sandbox by luring a user to a crafted HTML page, resulting in high confidentiality impact (CVSS 6.5, Medium; CISA...

CVE-2026-78981

CVE-2026-78981 is an information leak in the Mobile component of Google Chrome on iOS , affecting versions prior to 152.0.7977.65 . A local attacker can potentially obtain sensitive information via a local program. Chromium rates the severity as Low , while NVD assigns a CVSS 3.1 score of 6.5 (ME...

CVE-2026-79023

CVE-2026-79023 is an incorrect authorization flaw in the Editing component of Google Chrome prior to 152.0.7977.65 (also affecting chromium-browser ). A remote attacker can obtain sensitive information by persuading a user to open a crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 (Med...

CVE-2026-79046

A race condition in the Permissions component of Google Chrome on Android (prior to 152.0.7977.65 ) allows a remote attacker, leveraging social engineering with a crafted HTML page, to bypass the web origin policy , potentially leading to unauthorized access. The vulnerability carries a CVSS 4.3 ...

CVE-2026-79084

CVE-2026-79084 is an inadequate encryption strength flaw in the Notifications component of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering can bypass the web origin policy via a crafted HTML page. The CVSS 3.1 score is 4.3 (Me...

CVE-2026-79085

CVE-2026-79085 is a missing authorization flaw in the Network component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass the web origin policy via a crafted HTML page, potentially gaining unauthorized access to sensitive infor...

CVE-2026-79095

CVE-2026-79095 is an information leak in the Payments component of Google Chrome prior to version 152.0.7977.65 , allowing a remote attacker to obtain cross-origin data by luring a user into visiting a crafted HTML page . The CVSS 3.1 score is 4.3 (Medium) with required user interaction. The fix ...

CVE-2026-79116

CVE-2026-79116 is a missing authorization flaw in the Viz component of Google Chrome prior to 152.0.7977.65 . The vulnerability requires an attacker to have already compromised the renderer process , after which a crafted HTML page can be used to bypass the web origin policy , potentially enablin...

CVE-2026-79249

A code injection vulnerability in the Bisection component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to obtain sensitive information by tricking a user into processing a specially crafted file. The vulnerability requires user interaction and has no integrity or availability ...

CVE-2026-78967

CVE-2026-78967 is a missing authorization flaw in the Back-Forward Cache (BFCache) component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this via a crafted HTML page to bypass system access restrictions . The Chromium se...

CVE-2026-78974

CVE-2026-78974 is a UI misrepresentation vulnerability in the Linux Toolkit Theming component of Google Chrome prior to 152.0.7977.65 . A remote attacker leveraging social engineering could use a crafted HTML page to bypass system access restrictions . Chromium rates the severity as Low ; the CVS...

CVE-2026-79004

CVE-2026-79004 is an out-of-bounds read in the Media component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to read memory outside the sandbox, resulting in low confidentiality impact with c...

CVE-2026-79050

CVE-2026-79050 is an incorrect authorization flaw in the Network component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can bypass system access restrictions by luring a user into opening a crafted HTML page . The Chromium security severity is Medium (CVSS 4.3, network vect...

CVE-2026-79106

Google Chrome prior to 152.0.7977.65 contains an improper input validation flaw in the Input component. A remote attacker who has already compromised the renderer process and leverages social engineering can bypass the web origin policy via a crafted HTML page. Red Hat notes this could lead to un...

CVE-2026-79154

CVE-2026-79154 is a missing authorization flaw in DevTools in Google Chrome prior to version 152.0.7977.65 . A remote attacker, by leveraging social engineering and user interface interaction , can obtain sensitive information. The CVSS 3.1 score is 6.5 (Medium) with a network attack vector and h...

CVE-2026-79211

CVE-2026-79211 is an incorrect authorization vulnerability in the USB component of Google Chrome, affecting versions prior to 152.0.7977.65 . A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page, bypassing system access restrictions . The vulnerabili...

CVE-2026-79243

CVE-2026-79243 is an improper input validation flaw in the ReadingList component of Google Chrome on Windows , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can bypass the web origin policy via a crafted HTML page, potentially gaini...

CVE-2026-79253

An improper input validation flaw in the Network component of Google Chrome for Windows (versions prior to 152.0.7977.65 ) allows a remote attacker, leveraging social engineering , to leak sensitive information via a crafted HTML page. The CVSS 3.1 score is 6.5 (Medium) with a Chromium internal s...

CVE-2026-78936

CVE-2026-78936 is an information disclosure flaw in CustomTabs within Google Chrome on Android prior to version 152.0.7977.65 . An observable discrepancy allows a local attacker , through a co-installed application , to obtain sensitive cross-origin data . The CVSS 3.1 score is 2.9 (Low) with an ...

CVE-2026-79099

CVE-2026-79099 is a missing authorization vulnerability in the Network component of Google Chrome prior to 152.0.7977.65 , allowing a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium rates it Medium severity; the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U...

CVE-2026-79112

CVE-2026-79112 is an out-of-bounds read in Skia , a 2D graphics library used by Google Chrome, affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read memory inside the browser's security sandbox. Chro...

CVE-2026-79176

Google Chrome prior to 152.0.7977.65 is affected by a UI misrepresentation in the Extensions feature. A remote attacker can leverage social engineering to trick a user into installing a specially crafted Chrome extension , allowing them to obtain sensitive information from the user's browser. The...

CVE-2026-79199

CVE-2026-79199 is an incorrect authorization vulnerability in the Network component of Google Chrome prior to 152.0.7977.65 , allowing a remote attacker to bypass system access restrictions via a crafted HTML page. The Chromium security team rated it Medium severity (CVSS 3.1: 4.3, AV:N/AC:L/PR:N...

CVE-2026-79214

CVE-2026-79214 is an improper input validation flaw in the Preload component of Google Chrome prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can craft a malicious HTML page to bypass the web origin policy , potentially gaining unauthorized access to da...

CVE-2026-79251

CVE-2026-79251 is an improper input validation vulnerability in the Network component of Google Chrome prior to 152.0.7977.65 . A remote attacker can potentially bypass web origin policy via a crafted HTML page, with a CVSS v3.1 score of 4.3 (Medium) requiring user interaction. The fix is include...

CVE-2026-79075

CVE-2026-79075 is an information leak in the Geolocation feature of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this by tricking a user into visiting a crafted HTML page via social engineering, resulting in disclosure of sensitive user information. The CVSS v3.1 score is ...

CVE-2026-78897

A missing authorization flaw in the BrowserTag component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted Chrome extension. Chromium rates the severity as Low , while the CVSS 3.1 base score is 6.5 (ME...

CVE-2026-79014

A race condition in Chrome's Autofill component (prior to 152.0.7977.65 ) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page. According to Red Hat, this bypass could enable access to or manipulation of data across diff...

CVE-2026-79229

CVE-2026-79229 is an uninitialized resource vulnerability in ANGLE , a graphics translation library within Chromium (Google Chrome and Microsoft Edge). Prior to Chrome 152.0.7977.65 , a remote attacker who had already compromised the renderer process could leverage this flaw via a crafted HTML pa...

CVE-2026-79285

CVE-2026-79285 is an uninitialized resource vulnerability in ANGLE , a graphics library component used by Google Chrome on Windows prior to version 152.0.7977.65 . A remote attacker can exploit it by luring a user to visit a crafted HTML page , enabling cross-origin data disclosure (information d...

CVE-2026-79018

CVE-2026-79018 is an information leak in the FoldableAPIs component of Google Chrome (desktop), affecting versions prior to 152.0.7977.65 . A remote attacker can exploit the vulnerability by serving a crafted HTML page that, when opened by a victim, leaks sensitive information. The attack require...

CVE-2026-78957

CVE-2026-78957 is an information leak in Google Chrome Mobile on iOS affecting versions prior to 152.0.7977.65 . A local attacker can obtain sensitive information by supplying a crafted file to the browser. Chromium classifies the severity as Low , with a CVSS 3.1 score of 5.5 (Medium) reflecting...