CVE-2026-87582

A confused deputy vulnerability in the DataTransfer component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 score is 8.3 (HIGH) with...

CVE-2026-87593

An information leak in the Editing component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The Chromium security severity is rated Low , while the CVSS v3.1 score is 6.5 (Medium) with a network vector requiring u...

CVE-2026-87601

A race condition in the V8 JavaScript engine in Google Chrome prior to 153.0.8010.36 allows a remote attacker to execute arbitrary code inside the sandbox by convincing a user to visit a crafted HTML page. Chromium rates the severity as Low , while the CNA CVSS v3.1 score is 7.5 (High) with high ...

CVE-2026-87623

This Medium -severity vulnerability affects the DOM (Document Object Model) in Google Chrome prior to 153.0.8010.36 . An observable discrepancy in the DOM allows a remote attacker, leveraging social engineering , to obtain sensitive information via a crafted HTML page. The CVSS v3.1 score is 6.5 ...

CVE-2026-87640

CVE-2026-87640 is an out-of-bounds read in WebView in Google Chrome on Android prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to read memory outside the sandbox . Chromium classifies the severity as Medium , and NVD a...

CVE-2026-87657

A use-after-free flaw in the V8 engine of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to read memory inside the sandbox by loading a crafted HTML page. The Chromium security team rated this Medium severity, and NVD assigned a CVS...

CVE-2026-87429

CVE-2026-87429 is a missing authorization flaw in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to bypass system access restrictions . Chromium rates the severity as...

CVE-2026-87453

Google Chrome versions prior to 153.0.8010.36 contained a confused deputy vulnerability in the BackgroundFetch component. A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to leak sensitive information . The CVSS 3.1 score is 5.3 (Medium) , refl...

CVE-2026-87506

Google Chrome contained a privilege elevation vulnerability in the WebUI component prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability ...

CVE-2026-87515

CVE-2026-87515 is an incorrect authorization vulnerability in the FileAPI component of Google Chrome versions prior to 153.0.8010.36 . A remote attacker can leverage social engineering to deliver a crafted HTML page that bypasses system access restrictions, resulting in a high integrity impact wi...

CVE-2026-87522

CVE-2026-87522 is a missing authorization vulnerability in the WebView component of Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can potentially bypass system access restrictions via crafted network traffic. Chromium rates ...

CVE-2026-87530

Google Chrome on Windows is affected by an uncontrolled search path element in the CredentialProvider component, allowing a local attacker to execute arbitrary code outside the sandbox via a local program. The vulnerability affects versions prior to 153.0.8010.36 , where the fix was released. The...

CVE-2026-87570

CVE-2026-87570 is an incorrect authorization flaw in SiteIsolation in Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process and leverages social engineering can bypass site isolation by delivering a crafted file. The NVD assigns a CVSS 3.1 base ...

CVE-2026-87651

CVE-2026-87651 is an incorrect authorization vulnerability in the Paint component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker could obtain cross-origin data by persuading a user to open a crafted HTML page. The CVSS 3.1 score is 4.3 (Medium) with a vector of A...

CVE-2026-87457

CVE-2026-87457 is a race condition in the Updater component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker can leverage the flaw to execute arbitrary code outside the sandbox via a local program, leading to high impact on confidentiality, integrity, and...

CVE-2026-87459

Google Chrome prior to 153.0.8010.36 contains an observable discrepancy in the Select HTML component that allows a remote attacker to obtain sensitive information via a crafted HTML page. The Chromium security team rated this as Low severity, while the NVD CVSS 3.1 score is 6.5 (MEDIUM) with a ve...

CVE-2026-87471

CVE-2026-87471 is an incorrect authorization flaw in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . An attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass site isolation , potentially escalating access to data protected by ...

CVE-2026-87476

Incorrect authorization in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability carries a Medium Chromium security severity with a CVSS v3.1 base score of 6.5 (network vector, user...

CVE-2026-87477

CVE-2026-87477 is an information disclosure vulnerability in Google Chrome's Core component, affecting versions prior to 153.0.8010.36 . A remote attacker can exploit a crafted HTML page (with user interaction) to leak sensitive information. The Chromium project rates the severity as Low , while ...

CVE-2026-87507

CVE-2026-87507 is a UI misrepresentation vulnerability in the Downloads component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof UI elements via a crafted HTML page, potentially tricking users into interacting with malicious content disguis...

CVE-2026-87514

Use after free in the Views component of Google Chrome prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the sandbox via a local program. The vulnerability is rated CVSS 8.1 (High) with a local attack vector, high complexity, and changed scope. CISA's SSVC assessmen...

CVE-2026-87536

CVE-2026-87536 is a use-after-free vulnerability in V8 , the JavaScript engine used by Google Chrome . A remote attacker can achieve arbitrary code execution inside the sandbox by convincing a user to load a crafted HTML page. The fix is included in Chrome 153.0.8010.36 . CVSS v3.1 scores this 8....

CVE-2026-87549

CVE-2026-87549 is an incomplete cleanup vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36 . A remote attacker leveraging social engineering can bypass system access restrictions by serving a crafted HTML page. The NVD scores it CVSS 3.1: 6.5 (Medium) with a ...

CVE-2026-87589

CVE-2026-87589 is an incorrect authorization flaw in SiteIsolation in Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass system access restrictions . The Chromium security team rates the severity a...

CVE-2026-87606

A missing authorization in Google Chrome's SiteIsolation feature prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass site isolation via a crafted HTML page, potentially accessing data or functionality that should be restricted. The vulnerabi...

CVE-2026-87607

CVE-2026-87607 is a use after free vulnerability in the Device component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page to a user. The vulnerability is rated CRI...

CVE-2026-87626

CVE-2026-87626 is an incorrect authorization flaw in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 . A remote attacker can bypass the web origin policy via crafted network traffic, resulting in a high integrity impact with no confidentiality or availability i...

CVE-2026-87631

CVE-2026-87631 is a missing authorization vulnerability in the DOM component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can potentially leak sensitive information by serving a crafted HTML page to a victim who interacts with it (user interaction required). Ch...

CVE-2026-87433

A race condition in the FileAPI component of Google Chrome (prior to 153.0.8010.36 ) allows a remote attacker who has already compromised the renderer process to bypass site isolation by serving a crafted HTML page. Chromium assigns a severity of Medium , while the NVD scores it CVSS 3.1: 8.8 (HI...

CVE-2026-87486

CVE-2026-87486 is a clickjacking vulnerability in TrustedWebActivities in Google Chrome on Android , affecting versions prior to 153.0.8010.36 . A local attacker can exploit a co-installed app to spoof the address bar , potentially tricking users into interacting with a malicious page while belie...

CVE-2026-87490

An information disclosure vulnerability in the Transactions Platform component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information by convincing a user to visit a crafted HTML page . The underlying root-cause mechanism beyond the crafted-page ...

CVE-2026-87497

CVE-2026-87497 is an uninitialized resource vulnerability in the Codecs component of Google Chrome prior to version 153.0.8010.36 , allowing a remote attacker to read memory inside the sandbox via a crafted HTML page. The Chromium security team rates this as Medium severity with a CVSS v3.1 score...

CVE-2026-87505

CVE-2026-87505 is an incorrect authorization flaw in the FileSystem component of Google Chrome prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can bypass site isolation using a crafted PDF file , leading to high confidentiality and integrity impact (CVS...

CVE-2026-87525

CVE-2026-87525 is an out-of-bounds read in Chromoting , the remote desktop component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker with a local program can read memory outside the sandbox, resulting in a limited confidentiality impact with no integrity...

CVE-2026-87535

CVE-2026-87535 is an information loss or omission vulnerability in the Safebrowsing component of Google Chrome on Mac , affecting versions prior to 153.0.8010.36 . A remote attacker could exploit this via a crafted HTML page to bypass system access restrictions . The vulnerability carries a CVSS ...

CVE-2026-87539

Google Chrome (prior to 153.0.8010.36 ) is affected by an observable discrepancy in the Network component that allows a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability is rated Medium by Chromium and scored 3.1 (Low) on CVSS v3.1, reflecting high attack comp...

CVE-2026-87545

CVE-2026-87545 is an information leak vulnerability in Google Chrome Mobile on iOS prior to version 153.0.8010.36 . A remote attacker can leverage social engineering to exfiltrate sensitive information via a crafted HTML page. The underlying flaw is an information leak in the Mobile component. Ch...

CVE-2026-87581

Use after free vulnerability in the Payments component of Google Chrome prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering, can deliver a crafted HTML page that triggers the flaw, potentially allowing arbitrary code execution outside the browser sandbox . The flaw i...

CVE-2026-87604

CVE-2026-87604 is an out-of-bounds read in ANGLE , the graphics library used by Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to potentially execute arbitrary code outside the sandbox , escalating from ...

CVE-2026-87609

A use-after-free vulnerability in the Sharing component of Google Chrome on iOS prior to version 153.0.8010.36 allows a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. The flaw requires user interaction and no prior privileges. The CNA-assigned CVSS 3.1 ...

CVE-2026-87610

CVE-2026-87610 is an incorrect authorization flaw in the Omnibox component of Google Chrome prior to 153.0.8010.36 . A remote attacker can deliver a crafted HTML page that bypasses system access restrictions, granting access to a privileged page . The Chromium security severity is Medium (CVSS 3....

CVE-2026-87612

CVE-2026-87612 is a type confusion vulnerability in the V8 JavaScript engine within Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the Chrome sandbox , requiring user interaction (visiting a malicious page)....

CVE-2026-87636

A type confusion in the XML component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with required user interaction but no privileg...

CVE-2026-87645

CVE-2026-87645 is an improper state validation flaw in the Safebrowsing component of Google Chrome prior to 153.0.8010.36 . A remote attacker could leverage a crafted HTML page to bypass system access restrictions. The Chromium project rates the severity as Medium , with NVD assigning a CVSS 3.1 ...

CVE-2026-87658

CVE-2026-87658 is an information leak in the Extensions component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could leverage social engineering to deliver a crafted Chrome extension, thereby obtaining cross-origin data that should have been isolated. The vulnerability is r...

CVE-2026-87436

CVE-2026-87436 is an incomplete cleanup flaw in the Browser component of Google Chrome prior to 153.0.8010.36 , allowing a remote attacker leveraging social engineering to bypass the web origin policy via a crafted Chrome extension. The CVSS 3.1 score is 6.5 (Medium) with an attack vector of netw...

CVE-2026-87445

CVE-2026-87445 is a UI misrepresentation vulnerability in the Session component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can spoof UI elements by serving a crafted HTML page, requiring user interaction but no prior privileges. The vulnerability is rated Med...

CVE-2026-87467

A race condition in the Updater component of Google Chrome on Windows prior to version 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox via a local program. The vulnerability is rated High severity by Chromium (CVSS 3.1: 8.1, with Changed scope and High ...

CVE-2026-87468

CVE-2026-87468 is an incorrect authorization flaw in the Isolated component of Google Chrome (Chromium) prior to 153.0.8010.36 . A remote attacker can bypass site isolation by delivering a crafted HTML page to a user. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N...

CVE-2026-87479

CVE-2026-87479 is an insufficient policy enforcement vulnerability in the Extensions component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could leverage social engineering and a crafted HTML page to execute arb...