CVE-2026-7352

CVE-2026-7352 is a use-after-free in the Media component of Google Chrome on Android, prior to version 147.0.7727.138. The vulnerability could be triggered by a crafted HTML page by a remote attacker who had compromised the renderer process, potentially enabling a sandbox escape. Affected product...

CVE-2026-7940

CVE-2026-7940 concerns a use-after-free in V8 within Google Chrome before 148.0.7778.96. The issue allows an attacker who persuades a user to install a crafted Chrome Extension to execute arbitrary code inside a sandbox. Affected software is Google Chrome (V8 component) prior to the fixed version...

CVE-2026-8009

CVE-2026-8009: Google Chrome prior to 148.0.7778.96 has an Inappropriate implementation in Cast that lets a remote attacker who compromised the renderer bypass navigation restrictions via a crafted HTML page. Affected software is Chrome versions before 148.0.7778.96; the root cause is an incorrec...

CVE-2026-0903

CVE-2026-0903 refers to an Inappropriate implementation in Downloads in Google Chrome (Windows) before 144.0.7559.59, allowing a remote attacker to bypass dangerous file-type protections with a malicious file. Publicly documented fixes show Chromium-based updates delivering version 144.0.7559.59 ...

CVE-2026-10895

CVE-2026-10895 is a Use-After-Free in Ozone (Chrome) prior to 149.0.7827.53, allowing a remote attacker to execute arbitrary code via a crafted HTML page. Affected product: Google Chrome (Ozone component). Root cause: use-after-free in Ozone path. Impact: remote code execution with high/critical ...

CVE-2026-10947

Affected software: Google Chrome (WebRTC component). Vulnerability: use-after-free in WebRTC leading to remote arbitrary code execution within the sandbox via a crafted HTML page. Scope: Chrome prior to version 149.0.7827.53 is impacted; patch level implied by the fixed version in the description...

CVE-2026-10965

CVE-2026-10965 is an integer overflow in Google Chrome’s DevTools prior to 149.0.7827.53. The issue allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected software: Chrome (DevTools). Root cause: integer overflow in DevTools as described in multiple ...

CVE-2026-10966

CVE-2026-10966 affects Google Chrome’s Codecs implementation. The vulnerability allows a remote attacker to potentially perform a sandbox escape via a crafted video file on Chrome versions prior to 149.0.7827.53. The issue is described as an inappropriate implementation in Codecs, with a high sev...

CVE-2026-11031

CVE-2026-11031 affects Google Chrome’s Password Manager. The issue is insufficient validation of untrusted input, enabling a remote attacker to trigger UI spoofing via malicious network traffic. Affects Chrome versions prior to 149.0.7827.53 (Chromium security severity: Medium). CVSS v3.1: Base s...

CVE-2026-11207

Summary: CVE-2026-11207 affects Google Chrome Autofill in Chromium-based builds prior to 149.0.7827.53. The root cause is insufficient validation of untrusted input in Autofill, which could allow a remote attacker to potentially perform a sandbox escape via malicious network traffic. What is affe...

CVE-2026-11646

CVE-2026-11646 affects Google Chrome’s ViewTransitions; a use-after-free in that component allows remote code execution in a sandbox via a crafted HTML page. Impact is high (remote, no user interaction required). A fix is available in Chrome 149.0.7827.103 and newer. If exploiting status is unkno...

CVE-2026-11647

CVE-2026-11647 is for Google Chrome on Android, where a use-after-free in the Printing subsystem precedes a sandbox escape via a crafted HTML page when the renderer is compromised. Affected: Chrome on Android prior to version 149.0.7827.103. Impact: remote attacker with renderer access could pote...

CVE-2026-11689

Technical details for CVE-2026-11689 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2026-11691

CVE-2026-11691 involves Google Chrome’s New Tab Page and is caused by insufficient validation of untrusted input. The vulnerability affects Chrome prior to version 149.0.7827.103, enabling a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page...

CVE-2026-12012

CVE-2026-12012 affects Google Chrome’s Network component. It is a Use-After-Free vulnerability that could allow heap corruption via malicious network traffic, with the impact described as High. A fixed build is Chrome 149.0.7827.115 (Windows/macOS; Linux fixed earlier in 149.0.7827.114/114). The ...

CVE-2026-12014

CVE-2026-12014 affects Google Chrome’s Cast component. The issue is a use-after-free in Cast that, on devices on the local network, could enable a sandbox escape via crafted network traffic. Chrome mitigations rely on updating to the patched build (149.0.7827.115; Windows/Mac 149.0.7827.114/115; ...

CVE-2026-12035

CVE-2026-12035 affects Google Chrome on Windows (Views component). Affected: Chrome versions prior to 149.0.7827.115. Root cause: Use-after-free in Views leading to potential heap corruption via a crafted HTML page. Impact: potential remote code execution via heap corruption (per the vulnerabilit...

CVE-2026-12462

CVE-2026-12462 is a use-after-free in the Media component of Google Chrome before 149.0.7827.155. An attacker who has compromised the renderer process could trigger a crafted HTML page to execute arbitrary code inside Chrome’s sandbox. The vulnerability is tied to the Chromium-based Media stack a...

CVE-2026-12465

CVE-2026-12465 affects Google Chrome Metrics: an Object lifecycle issue in Chrome prior to 149.0.7827.155 allows a renderer-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. Patch: update to Chrome 149.0.7827.155 or newer. Exploitation details are not describe...

CVE-2026-12467

CVE-2026-12467 corresponds to a use-after-free in Google Chrome Extensions, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software: Google Chrome prior to version 149.0.7827.155 (Extensions component, render...

CVE-2026-13025

CVE-2026-13025 describes a race in DevTools of Google Chrome prior to 149.0.7827.197 that could allow a remote attacker, who already compromised the renderer process, to potentially escape the sandbox via a crafted HTML page. The issue is rated High (CVSS v3.1: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H...

CVE-2026-13965

CVE-2026-13965: Use-after-free in Oilpan within Google Chrome (Chromium) before 150.0.7871.47 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Impact: high (arbitrary code in sandbox); attack vector: network, user interaction required. Affected product:...

CVE-2026-13974

Google Chrome on macOS Safe Browsing contains an integer overflow that lets a remote attacker bypass navigation restrictions via a malicious file. This affects Chrome on Mac prior to 150.0.7871.47. Impact aligns with the description (Chromium security severity: Medium); exploitation details are n...

CVE-2026-14104

CVE-2026-14104 affects WebAppInstalls in Google Chrome prior to 150.0.7871.47. The vulnerability arises from insufficient validation of untrusted input, allowing a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The issue is documented across multiple...

CVE-2026-14392

CVE-2026-14392 describes an out-of-bounds write in the Tint component of Google Chrome, affecting Chrome prior to 150.0.7871.46. The issue could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page, as indicated by the description and cross-referenced Chrome security advis...

CVE-2026-14402

CVE-2026-14402 describes an uninitialized use in ANGLE within Google Chrome on Windows, prior to version 150.0.7871.46. The issue allows a remote attacker to potentially read sensitive data from a process's memory via a crafted HTML page. Affected component is ANGLE in Chrome’s Windows build; und...

CVE-2026-14422

CVE-2026-14422 : Out-of-bounds read/write in Tint component of Google Chrome before version 150.0.7871.46. The issue allowed a remote attacker to potentially trigger memory access errors via a crafted HTML page. The severity is listed as High. Affected product: Google Chrome (Tint within Chromium...

CVE-2026-14427

CVE-2026-14427 : Heap buffer overflow in Skia used by Google Chrome prior to 150.0.7871.46. A remote attacker who already compromised the renderer could potentially escape the sandbox via a crafted HTML page. Affected: Chrome/Skia stack (Chrome 150 pre-release fix applies). Root cause: heap buffe...

CVE-2026-3543

CVE-2026-3543 describes an out-of-bounds memory access in Google Chrome’s V8 engine caused by an inappropriate implementation prior to version 145.0.7632.159. The vulnerability is triggered by a crafted HTML page and is rated High severity (CVSS v3.1). Affected product/version: Google Chrome with...

CVE-2026-4447

Concerning CVE-2026-4447, an issue in V8 for Google Chrome prior to 146.0.7680.153 enables remote code execution in the sandbox via a crafted HTML page. Several connected documents confirm affected Software: Google Chrome (V8) prior to 146.0.7680.153; Chromium-based builds and Debian/Fedora advis...

CVE-2026-4676

CVE-2026-4676 affects Dawn in Google Chrome up to version 146.0.7680.165. The issue is a use-after-free in Dawn that could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The description specifies a high Chromium security severity. There are no explicit ex...

CVE-2026-6306

CVE-2026-6306 is a heap buffer overflow in PDFium used by Google Chrome (pre-147.0.7727.101). A crafted PDF can cause arbitrary code execution inside the sandbox. Remediation: update to Chrome 147.0.7727.101 (or the Debian/Chromium packagings listed in vendor advisories). Exploitation details are...

CVE-2026-7339

CVE-2026-7339 : Heap buffer overflow in WebRTC for Google Chrome (Chrome/Chromium) prior to 147.0.7727.138. Exploitation could enable remote heap corruption via a crafted HTML page. Affected product: Google Chrome (WebRTC component). Underlying cause: heap buffer overflow in WebRTC; impact: poten...

CVE-2026-8580

CVE-2026-8580 describes a use-after-free in Mojo of Google Chrome before 148.0.7778.168. The underlying flaw is a use-after-free in Mojo that could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue is classified with a Chromium-based severity of Me...

CVE-2025-12428

CVE-2025-12428 describes a Type Confusion in V8 within Google Chrome/Chromium before version 142.0.7444.59, enabling a remote attacker to perform arbitrary read/write through a crafted HTML page. The issue affects Chromium-based browsers (Chrome/Chromium) and is classified with high severity and ...

CVE-2025-12432

This CVE-2025-12432 describes a race in Google's V8 engine within Chrome prior to version 142.0.7444.59 that could lead to heap corruption via a crafted HTML page. Multiple connected sources corroborate the issue and identify the affected component as Chrome/Chromium’s V8 handling of HTML content...

CVE-2025-13634

CVE-2025-13634 affects Google Chrome on Windows, due to an inappropriate implementation in Downloads that allows a local attacker to bypass the web security mark via a crafted HTML page. The issue is tied to Chromium/Chrome versions prior to 143.0.7499.41; Debian/Fedora advisories reference Chrom...

CVE-2025-13637

CVE-2025-13637 concerns an Inappropriate implementation in Downloads in Google Chrome. A remote attacker could bypass download protections by convincing a user to perform specific UI gestures on a crafted HTML page, exploiting Chrome/Chromium prior to the fixed version. Affected component: Chrome...

CVE-2026-0902

CVE-2026-0902 is an issue in V8 used by Google Chrome prior to version 144.0.7559.59, described as an inappropriate implementation that allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Connected feeds show Chromium/Chrome updates delivering a fix (Chromium...

CVE-2026-0907

CVE-2026-0907 affects Google Chrome/Chromium Split View UI, allowing UI spoofing via a crafted HTML page before version 144.0.7559.59. Connected documents confirm related Chromium/CEF updates in the 144.0.7559.x series across Fedora and ChromeOS advisories, indicating a patched release beyond 144...

CVE-2026-10886

CVE-2026-10886: In Google Chrome, a use-after-free in the FileSystem component can allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability affects Chrome builds prior to 149.0.7827.53. The Chrome Stable update 149.0.7827.53 (Linux/Windows/macOS) includes fix...

CVE-2026-10898

CVE-2026-10898 : Stack buffer overflow in the GPU component of Google Chrome before 149.0.7827.53 allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome versions prior to the fixed 149.0.7827.53; Chrome...

CVE-2026-10971

CVE-2026-10971 : In Google Chrome on Windows, printing input is insufficiently validated, enabling a remote attacker who compromised the renderer process to escape the sandbox via a crafted HTML page. Affected: Windows builds before 149.0.7827.53. Remediation: update to 149.0.7827.53 or later. Re...

CVE-2026-11043

CVE-2026-11043: Out-of-bounds write in ANGLE affecting Google Chrome on macOS prior to 149.0.7827.53. Likely allows a remote attacker who compromises the renderer to escape the sandbox via a crafted HTML page. Root cause: ANGLE out-of-bounds write. Remediation: update to Chrome 149.0.7827.53 or n...

CVE-2026-11052

Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allows a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affected: Chrome on Windows; component: GPU/renderer pathway; root cause: type confusion in GPU handling. Impact is sandbox es...

CVE-2026-11080

CVE-2026-11080 affects WebView in Google Chrome on Android (before 149.0.7827.53). The vulnerability is a use-after-free in WebView that can lead to heap corruption via a crafted HTML page. The CVSS v3.1 base score is 8.8 (HIGH) with NETWORK attack vector, HIGH confidentiality/integrity/availabil...

CVE-2026-11251

CVE-2026-11251 affects Google Chrome’s Password Manager. The root cause is insufficient policy enforcement, allowing a renderer-compromised remote attacker to bypass discretionary access control via a crafted HTML page. Affected software is Chrome prior to version 149.0.7827.53. The available sou...

CVE-2026-11257

CVE-2026-11257 affects Google Chrome prior to 149.0.7827.53. The issue is an inappropriate implementation in the browser that can allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The CVSS 3.1 base score is 4.3 (Medium), with attack vector Network, complexity Low,...

CVE-2026-11303

Concisely: Affects Google Chrome (PDFium) with a use-after-free in PDFium when handling crafted PDFs, enabling remote code execution inside the sandbox. Vulnerable in Chrome versions prior to 149.0.7827.53; mitigation is to upgrade to 149.0.7827.53 or later. No exploitation/weaponization details ...

CVE-2026-11631

CVE-2026-11631 is a Use-after-Free in Aura within Google Chrome on Windows, before build 149.0.7827.103. The root cause is a memory management error in Aura that could allow a compromised renderer process to escape the sandbox via a crafted HTML page, enabling a remote attacker to potentially tak...