CVE-2026-87616

An improper initialization flaw in the Views component of Google Chrome on Windows (versions prior to 153.0.8010.36 ) allows a remote attacker who has already compromised the renderer process and leverages social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. C...

CVE-2026-87620

CVE-2026-87620 affects the SVG rendering component in Google Chrome prior to 153.0.8010.36 . An observable discrepancy in SVG processing allowed a remote attacker to obtain sensitive information by serving a crafted HTML page. The vulnerability requires user interaction (visiting a malicious page...

CVE-2026-87636

A type confusion in the XML component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with required user interaction but no privileg...

CVE-2026-87444

CVE-2026-87444 is a memory corruption vulnerability in the Codecs component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can execute arbitrary code inside the browser sandbox by luring a user into visiting a crafted HTML page. The vulnerability carries a CVSS 3.1 score of 8...

CVE-2026-87447

CVE-2026-87447 is an incorrect authorization flaw in the Network component of Google Chrome prior to 153.0.8010.36 . A remote attacker can leverage social engineering to install a crafted Chrome extension that bypasses the web origin policy , potentially gaining unauthorized access to data or fun...

CVE-2026-87460

A use-after-free vulnerability in the Platform component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to execute arbitrary code inside the sandbox by convincing a user to open a crafted HTML page. The vulnerability is rated High severity by Chromium and scored 8.8 on C...

CVE-2026-87468

CVE-2026-87468 is an incorrect authorization flaw in the Isolated component of Google Chrome (Chromium) prior to 153.0.8010.36 . A remote attacker can bypass site isolation by delivering a crafted HTML page to a user. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N...

CVE-2026-87475

CVE-2026-87475 is a missing authorization flaw in the Omnibox component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering via a crafted HTML page, can bypass system access restrictions and gain access to a privileged page. The flaw carries a Medium Chromiu...

CVE-2026-87481

CVE-2026-87481 is an incorrect authorization flaw in WebView within Google Chrome on Android (versions prior to 153.0.8010.36 ). A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. Chromiu...

CVE-2026-87482

CVE-2026-87482 is a cleartext transmission vulnerability in the HttpsUpgrades component of Google Chrome on iOS , affecting versions prior to 153.0.8010.36 . A remote attacker can leak sensitive information via crafted network traffic, rated CVSS 5.9 (Medium) by Chromium. The fix is to update Goo...

CVE-2026-87483

CVE-2026-87483 is an incorrect authorization flaw in Google Chrome on Android prior to 153.0.8010.36 , rated Medium severity by Chromium. A remote attacker could bypass system access restrictions by serving a crafted HTML page to the user, requiring no special privileges but user interaction to t...

CVE-2026-87496

CVE-2026-87496 is a UI misrepresentation vulnerability in the Browser component of Google Chrome prior to 153.0.8010.36 . A remote attacker, leveraging social engineering, could spoof browser UI elements via a crafted HTML page. The CVSS 3.1 score is 5.4 (Medium) , reflecting a network attack vec...

CVE-2026-87517

A race condition in the Mobile component of Google Chrome on iOS prior to version 153.0.8010.36 allowed a remote attacker, leveraging social engineering, to bypass the web origin policy via a crafted HTML page. The CNA-assigned CVSS 3.1 score is 3.1 (Low) , reflecting high attack complexity and r...

CVE-2026-87525

CVE-2026-87525 is an out-of-bounds read in Chromoting , the remote desktop component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker with a local program can read memory outside the sandbox, resulting in a limited confidentiality impact with no integrity...

CVE-2026-87532

CVE-2026-87532 is an improper state validation flaw in the Safebrowsing component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit the vulnerability by serving a crafted HTML page that causes Chrome to bypass system access restrictions, resulting in a h...

CVE-2026-87534

CVE-2026-87534 is a missing authorization flaw in the WebView component of Google Chrome on Android prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering, can bypass system access restrictions via specially crafted network traffic . The Chromium team rates the severity...

CVE-2026-87557

CVE-2026-87557 affects Google Chrome prior to 153.0.8010.36 , where a missing authorization in the LocalNetworkAccess component allowed a remote attacker who had already compromised the renderer process to bypass system access restrictions via a crafted HTML page. The vulnerability is rated Mediu...

CVE-2026-87579

A buffer overflow in WebRTC within Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the browser's sandbox by luring a user into visiting a crafted HTML page. The vulnerability is classified as Medium severity by Chromium, while the CVSS 3.1 s...

CVE-2026-87587

A use-after-free flaw in the V8 JavaScript engine of Google Chrome (versions prior to 153.0.8010.36 ) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by luring a user into visiting a crafted HTML page. The vulnerability was rated High by Chromium and assigned a CVSS 3...

CVE-2026-87600

Google Chrome for Android prior to version 153.0.8010.36 is affected by an improper input validation vulnerability in the Safebrowsing component. A remote attacker can leverage social engineering to get a user to open a crafted HTML page, enabling a bypass of system access restrictions . The vuln...

CVE-2026-87618

CVE-2026-87618 affects Google Chrome on Windows prior to version 153.0.8010.36 . The vulnerability is an incorrect reference resolution in the Storage component, allowing a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox v...

CVE-2026-87625

CVE-2026-87625 is a use-after-free vulnerability in V8 , the JavaScript engine used by Google Chrome, affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted Chrome extension delivered through social engineering to execute arbitrary code inside the Chrome sandbo...

CVE-2026-87630

CVE-2026-87630 is an integer overflow in WebRTC within Google Chrome prior to version 153.0.8010.36 , allowing a remote attacker to read memory inside the sandbox via a crafted HTML page. The Chromium team classified the severity as Medium , with a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C...

CVE-2026-87638

CVE-2026-87638 is an out of bounds write in the Media component of Google Chrome prior to 153.0.8010.36 . A remote attacker can potentially execute arbitrary code outside the sandbox by persuading a user to open a crafted HTML page. The CNA (chrome-cve-admin) assigns CVSS 3.1: 9.6 (CRITICAL) with...

CVE-2026-87644

CVE-2026-87644 is an incorrect authorization flaw in Views in Google Chrome on Windows prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process and leveraged social engineering could execute arbitrary code outside the sandbox via a crafted HTML page. The fix shi...

CVE-2026-87647

CVE-2026-87647 is an uninitialized resource vulnerability in the GPU component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could read memory outside the sandbox by serving a crafted HTML page. Chromium assigned a security severity o...

CVE-2026-87658

CVE-2026-87658 is an information leak in the Extensions component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could leverage social engineering to deliver a crafted Chrome extension, thereby obtaining cross-origin data that should have been isolated. The vulnerability is r...

CVE-2026-87454

CVE-2026-87454 is an information leak in Google Chrome Enterprise on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker can obtain sensitive information by luring a user into visiting a crafted HTML page . The vulnerability is rated Medium severity (CVSS 3.1: 6.5, vector AV:N...

CVE-2026-87480

A use after free vulnerability in the Printing component of Google Chrome (prior to 153.0.8010.36 ) allowed a remote attacker who had already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium project rates this as High...

CVE-2026-87485

CVE-2026-87485 affects Google Chrome prior to 153.0.8010.36 and stems from incorrect authorization in CORS (Cross-Origin Resource Sharing). A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to bypass the web origin policy , potentially accessing ...

CVE-2026-87501

CVE-2026-87501 is a UI misrepresentation vulnerability in the Passwords component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could exploit it by serving a crafted HTML page to spoof UI elements , potentially misleading users interacting with the browser's password managem...

CVE-2026-87503

CVE-2026-87503 is an inappropriate implementation in the Downloads component of Google Chrome on Android (prior to 153.0.8010.36). A remote attacker can leverage social engineering with a crafted HTML page to bypass system access restrictions, potentially gaining unauthorized access to parts of t...

CVE-2026-87519

CVE-2026-87519 is an incorrect authorization vulnerability in the Safebrowsing component of Google Chrome prior to version 153.0.8010.36 . A remote attacker, leveraging social engineering , can trick a user into interacting with a crafted HTML page that bypasses system access restrictions. The CV...

CVE-2026-87523

A race condition in the DataTransfer component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to obtain sensitive information . The CVSS 3.1 score is 6.5 (MEDIUM) with high confidentiality impact , while Chromium rates the...

CVE-2026-87524

CVE-2026-87524 is a use-after-free in the Core component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can exploit this via a crafted HTML page to execute arbitrary code outside the sandbox . The vulner...

CVE-2026-87548

CVE-2026-87548 affects the Installer component of Google Chrome prior to version 153.0.8010.36 . The root cause is an improper state validation flaw, which allows a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability requires user interaction (the attac...

CVE-2026-87553

CVE-2026-87553 is an improper input validation flaw in the SiteIsolation component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could potentially execute arbitrary code outside the sandbox by serving a crafted HTML page. The vulnerab...

CVE-2026-87554

CVE-2026-87554 is a race condition in Chromoting (Chrome's remote desktop component) affecting Google Chrome on Windows prior to 153.0.8010.36 . A local attacker can exploit the flaw via a local program to execute arbitrary code outside the sandbox , rated High severity by Chromium and 8.1 (HIGH)...

CVE-2026-87565

CVE-2026-87565 is an information disclosure vulnerability in Google Chrome for Android prior to 153.0.8010.36 , affecting the Passwords component. A remote attacker can exploit it by serving a crafted HTML page to leak sensitive information, with no privileges required but user interaction necess...

CVE-2026-87577

Google Chrome versions prior to 153.0.8010.36 are affected by an incorrect authorization flaw in the Isolated component. A remote attacker can leverage a crafted HTML page to bypass the web origin policy and reach a privileged page, resulting in a limited confidentiality impact. The vulnerability...

CVE-2026-87584

An incorrect authorization flaw in the WebUI component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to a privileged page within the browser's WebUI by serving a crafted HTML page . The vulnerability requires use...

CVE-2026-87590

CVE-2026-87590 is an improper input validation vulnerability in the Passwords component of Google Chrome (also affecting chromium-browser packages on Linux distributions). Versions prior to 153.0.8010.36 allow a remote attacker to potentially leak sensitive information by sending crafted network ...

CVE-2026-87437

CVE-2026-87437 is an information leak in the Frames component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to leak sensitive information. Chromium rates the severity as Low , while the assigned CVSS 3.1 score is 6.5 (MEDIUM) with high ...

CVE-2026-87443

Google Chrome prior to 153.0.8010.36 is affected by a missing authorization vulnerability in the Actor component. A remote attacker could obtain sensitive information by luring a user into visiting a crafted HTML page. The Chromium project rates this as Medium severity, with a CVSS 3.1 score of 6...

CVE-2026-87446

CVE-2026-87446 is an incomplete cleanup vulnerability in Google Chrome Extensions affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering can install a crafted Chrome extension that bypasses system access restrictions. The Chromium security severity is Medium ,...

CVE-2026-87465

CVE-2026-87465 is an incorrect authorization flaw in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to spoof UI elements . The CVSS 3.1 score is 4.2 (Medium...

CVE-2026-87472

CVE-2026-87472 is an improper input validation vulnerability in the FedCM (Federated Credential Management) component of Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could exploit it via a crafted HTML page to spoof UI elements ...

CVE-2026-87478

An observable discrepancy in the Autofill component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to obtain sensitive information by delivering a crafted HTML page . The vulnerability carries a Medium Chromium security severity and a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR...

CVE-2026-87509

CVE-2026-87509 is an incorrect authorization flaw in the Updater component of Google Chrome on Windows , affecting versions prior to 153.0.8010.36 . A local attacker can leverage this to execute arbitrary code outside the sandbox via a local program. Chromium rates the severity as Low , while the...

CVE-2026-87572

CVE-2026-87572 is an injection vulnerability in DevTools within Google Chrome versions prior to 153.0.8010.36 . A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS 3.1 base score is 8.3 (Hi...