CVE-2026-10886

CVE-2026-10886: In Google Chrome, a use-after-free in the FileSystem component can allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability affects Chrome builds prior to 149.0.7827.53. The Chrome Stable update 149.0.7827.53 (Linux/Windows/macOS) includes fix...

CVE-2026-11660

CVE-2026-11660: Google Chrome’s New Tab Page suffered insufficient validation of untrusted input, enabling a renderer-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. Affected: Chrome before 149.0.7827.103. Impact: sandbox escape risk; attacker could leverage...

CVE-2026-11668

CVE-2026-11668 concerns Google Chrome on Linux and ChromeOS versions before 149.0.7827.103, with an uninitialized use in codecs leading to potential cross-origin data leakage via a crafted video file. The issue is described as high severity; affected: Chrome on Linux/ChromeOS prior to the listed ...

CVE-2026-12029

CVE-2026-12029: Use-after-free in Video on Google Chrome for Windows (pre-149.0.7827.115) allows a remote attacker with renderer access to escape the sandbox via a crafted HTML page. Impact: high. Root cause: use-after-free in Video; Exploitation context requires a compromised renderer. A fix is ...

CVE-2026-14023

Google Chrome (Chromium) SanitizerAPI in affected builds is vulnerable due to insufficient validation of untrusted input, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected version range is prior to 150.0.7871.47; vendor/chromium references indicate the ...

CVE-2026-14044

CVE-2026-14044 affects Google Chrome (ANGLE component) with a use-after-free in ANGLE that can allow a remote attacker who has compromised the renderer to escape the sandbox via a crafted HTML page. Affected versions are before Chrome 150.0.7871.47. Root cause: use-after-free in ANGLE. Impact: sa...

CVE-2026-14156

CVE-2026-14156 : Concrete details across multiple sources show an issue in Google Chrome’s StorageAccessAPI where insufficient policy enforcement enables a remote attacker who compromised a renderer process to bypass same-origin policy via a crafted HTML page. Affected component: StorageAccessAPI...

CVE-2026-14398

In Connected sources, CVE-2026-14398 is described as a Use-after-free in ANGLE affecting Google Chrome prior to 150.0.7871.46, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is confirmed as part of ANGLE in Chrome, with a critical severity....

CVE-2026-14413

Uninitialized use in ANGLE within Google Chrome up to version 150.0.7871.46 allows a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. CVE-2026-14413 (Severity High) indicates a sandbox-escape risk; remediations require updating to 150.0.7871.46 or later. No...

CVE-2026-14426

CVE-2026-14426 is a Use After Free in V8 within Google Chrome before 150.0.7871.46. A remote attacker could lure a user into specific UI gestures to run arbitrary code in Chrome’s sandbox via a crafted HTML page. Severity: High. Affected: V8 in Chrome (pre-150.7871.46). Mitigation: Chrome update ...

CVE-2026-5901

CVE-2026-5901 concerns insufficient policy enforcement in Chrome/Chromium DevTools, enabling a user-assisted attacker who installs a malicious extension to bypass enterprise host restrictions for cookie modification. The issue affects Chrome/Chromium builds prior to version 147.0.7727.55, with ad...

CVE-2026-7357

CVE-2026-7357 is a Use-After-Free in the GPU component of Google Chrome (Chromium) affecting versions prior to 147.0.7727.138. The issue can be exploited by a remote attacker who has already compromised the renderer process via a crafted HTML page, potentially leading to heap corruption and arbit...

CVE-2026-9880

CVE-2026-9880 affects Google Chrome WebGL in the Chromium WebGL stack. The root cause is insufficient validation of untrusted input in WebGL, enabling a remote attacker who has compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software is ...

CVE-2026-9886

CVE-2026-9886 affects Google Chrome on macOS with versions prior to 148.0.7778.216. It is a use‑after‑free in the Chromium Base component that could allow a remote attacker to escape the browser sandbox via a crafted HTML page. The Chrome update 148.0.7778.216 (and related 148.0.7778.215/216 on o...

CVE-2026-9914

CVE-2026-9914 concerns an ANGLE input-validation flaw in Google Chrome prior to 148.0.7778.216. The renderer process, if compromised, could be forced to escape the sandbox via a crafted HTML page. The issue is described as a high-severity, remote threat with impact on confidentiality, integrity, ...

CVE-2026-9917

CVE-2026-9917 involves an uninitialized use flaw in the WebGL component of Google Chrome for Android. The issue, reported as affecting Chrome on Android prior to version 148.0.7778.216, could allow a remote attacker to read potentially sensitive information from a process’s memory via a crafted H...

CVE-2026-9924

CVE-2026-9924 is a heap buffer overflow in the ANGLE component of Google Chrome on Windows, fixed by updating to version 148.0.7778.216 or newer. The vulnerability affects the ANGLE path and could allow a remote attacker who has compromised a renderer process to escape the sandbox via a crafted H...

CVE-2026-9928

CVE-2026-9928 describes an out-of-bounds read in ANGLE used by Google Chrome on Windows, allowing a remote attacker to execute arbitrary code via a crafted HTML page. Affected component: ANGLE in Chromium-based Chrome. Root cause: out-of-bounds read in ANGLE leading to code execution. Impact: rem...

CVE-2026-9930

CVE-2026-9930 affects the Dawn component of Google Chrome on macOS. A crafted HTML page can trigger an out-of-bounds write in Dawn, allowing a remote attacker to perform an out-of-bounds memory write. The issue is tied to Chrome versions before 148.0.7778.216. No exploitation details are provided...

CVE-2026-9937

CVE-2026-9937 concerns a use-after-free in the UI of Google Chrome on Windows, prior to build 148.0.7778.216. The issue arises when a compromised renderer process can trigger a sandbox escape via a crafted HTML page. Affected: Chromium-based Chrome UI components; root cause described as a UI use-...

CVE-2026-9969

CVE-2026-9969 affects the ANGLE component in Google Chrome (Chromium-based). Description: Insufficient validation of untrusted input in ANGLE allows remote code execution via a crafted HTML page, with Chromium severity high. The public records indicate the issue exists in Chrome builds prior to 1...

CVE-2026-9971

CVE-2026-9971 affects Google Chrome on iOS prior to version 148.0.7778.216 due to an inappropriate implementation in iOS. This allows a remote attacker to exploit UXSS by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability impacts UX and script/HTML injecti...

CVE-2025-13639

Summary: CVE-2025-13639 is an issue in the WebRTC implementation of Google Chrome/Chromium. Affected component: WebRTC in Chrome/Chromium prior to version 143.0.7499.41. Impact: Remote attacker could cause arbitrary read/write via a crafted HTML page (confidentiality and integrity impact; availab...

CVE-2026-10012

CVE-2026-10012: Use-after-free in Skia within Google Chrome before 148.0.7778.216 allows a compromised renderer to potentially escape the Chromium sandbox via a crafted HTML page. Affected: Skia component in Chrome (Chromium-based). Root cause: use-after-free bug in Skia identified upstream. Impa...

CVE-2026-10892

CVE-2026-10892 is an out-of-bounds write in the GPU component of Google Chrome on Android, before version 149.0.7827.53, allowing a remote attacker to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome for Android and is categorized as Critical. Public references sho...

CVE-2026-10901

CVE-2026-10901 is a use-after-free vulnerability in Passwords for Google Chrome on macOS, exploitable when a user is lured into specific UI gestures and visits a crafted HTML page. Affected: Chrome on macOS prior to 149.0.7827.53. Impact: remote code execution via a crafted page; Chromium indicat...

CVE-2026-10902

CVE-2026-10902 describes a Use-after-Free in Ozone for Google Chrome, affecting Chrome builds prior to 149.0.7827.53. The vulnerability could allow a remote attacker to execute arbitrary code via a crafted HTML page, with a Chromium/Chrome security severity marked as Critical. The public referenc...

CVE-2026-10961

The CVE-2026-10961 issue affects Chrome for iOS (Google Chrome on iOS), where a use-after-free in the renderer allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Impact is a sandbox escape with high severity; exploitation s...

CVE-2026-11028

Google Chrome on Linux and ChromeOS is affected by CVE-2026-11028 due to a use-after-free in the Media component, allowing a remote attacker who compromises the renderer to run arbitrary code in the sandbox via a crafted HTML page. The issue is instead mitigated in versions newer than 149.0.7827....

CVE-2026-11064

Technical details (affected product/component, root cause, impact, fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-11234

CVE-2026-11234 affects Google Chrome prior to 149.0.7827.53. The issue is an incorrect implementation in FoldableAPIs that lets a remote attacker who has compromised the renderer process bypass site isolation via a crafted HTML page. The known impact is limited to bypassing site isolation, as des...

CVE-2026-11240

CVE-2026-11240 affects Google Chrome (Loader) with insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. The issue is described for Chrome versions prior to 149.0.7827.53; exploitation deta...

CVE-2026-11250

CVE-2026-11250 concerns Google Chrome DevTools prior to version 149.0.7827.53. The issue is an inappropriate implementation in DevTools that allowed a remote attacker who had already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. P...

CVE-2026-11265

CVE-2026-11265 concerns Google Chrome’s Autofill. The issue is described as an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (Chromium-based), with the fixed/patch version cited as 149.0.7827.5...

CVE-2026-11638

Concrete details found: CVE-2026-11638 affects Google Chrome (Printing) before 149.0.7827.103. The vulnerability is a use-after-free in the Printing component that could allow a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page (severity: Critical). Impact is sandbo...

CVE-2026-11662

CVE-2026-11662 affects Google Chrome bindings: Type Confusion in Bindings could allow remote code execution in a sandbox via a crafted HTML page, before version 149.0.7827.103. The issue is rated High (CVSS 3.1 base 8.8), with network attack vector and user interaction required. Affected componen...

CVE-2026-11665

CVE-2026-11665: Out-of-bounds read in Dawn within Google Chrome on Windows allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected: Chrome on Windows (Dawn component); root cause is an out-of-bounds read. Impact is data leakage of cross-origin data. Remediation: patch...

CVE-2026-11676

CVE-2026-11676 affects Google Chrome on Linux/ChromeOS (Dawn component) and is due to insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is observed prior to Chr...

CVE-2026-11678

Summary: CVE-2026-11678 is an integer overflow in libyuv used by Google Chrome, fixed in version 149.0.7827.103. The issue could allow a remote attacker who has compromised the renderer process to extract potentially sensitive data from process memory via a crafted HTML page. Affected component: ...

CVE-2026-11681

CVE-2026-11681 : Use-after-free in Chrome’s Ozone component on Linux prior to 149.0.7827.103 allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Impact is described as high; the vulnerability is within the Chromium-based Chrome stack and affects the Ozone laye...

CVE-2026-11687

Summary: CVE-2026-11687 is a use-after-free in Dawn within Google Chrome for Mac, leading to potential heap corruption via a crafted HTML page. The underlying issue is a use-after-free in Dawn, with impact described as a remote attacker able to cause high-severity outcomes (confidentiality, integ...

CVE-2026-13026

CVE-2026-13026 is a use-after-free in Digital Credentials in Google Chrome for Mac, triggered by heap corruption via a crafted HTML page. Affected: Chrome on macOS before version 149.0.7827.197. Impact: remote code execution due to severe memory corruption; exploit would require user interaction ...

CVE-2026-14386

CVE-2026-14386 describes an Out-of-bounds read in ANGLE used by Google Chrome before version 150.0.7871.46. The issue could allow a remote attacker to obtain potentially sensitive information from a process’s memory via a crafted HTML page. The connected documents confirm Chrome/ANGLE involvement...

CVE-2026-14421

CVE-2026-14421 concerns an uninitialized-use issue in Dawn for Google Chrome on ChromeOS, prior to version 150.0.7871.46. The issue could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Documents consistently describe the vulnerability as Un...

CVE-2026-2316

CVE-2026-2316 affects Google Chrome/Chromium: insufficient policy enforcement in Frames enables UI spoofing via a crafted HTML page when Chrome is before 145.0.7632.45. Remediation is to update to Chrome 145.0.7632.45 or newer (Chromium fix). Debian advisories also indicate later Chromium fixes f...

CVE-2026-3926

CVE-2026-3926 refers to an out-of-bounds read in V8 used by Google Chrome, exploitable via a crafted HTML page. Affected: Chrome/Chromium prior to 146.0.7680.71. Impact described as remote memory access with potential for arbitrary behavior; CVSS indicates high impact to confidentiality, integrit...

CVE-2026-3930

CVE-2026-3930 matches a Google Chrome iOS navigation-bypass issue: unsafe navigation in Chrome on iOS before 146.0.7680.71 allows a remote attacker to bypass navigation restrictions with a crafted HTML page. Connected feeds confirm Chromium/Chromium-based updates (Chromium 146.0.7680.71+ in Debia...

CVE-2026-6300

Google Chrome (Chromium CSS engine) contains a use-after-free in CSS that allows remote code execution inside the sandbox via a crafted HTML page. Affected versions are prior to 147.0.7727.101; remediation is to upgrade to Chrome 147.0.7727.101 or newer as indicated by the referenced Chromium upd...

CVE-2026-6921

CVE-2026-6921 describes a race condition in the GPU component of Google Chrome on Windows, prior to version 147.0.7727.117, that could allow a remote attacker to potentially escape the browser sandbox via a crafted video file. The vulnerability is exposed via a network vector and requires user in...

CVE-2026-7986

CVE-2026-7986 affects Google Chrome Autofill. Description: Insufficient policy enforcement in Autofill allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product/version: Chrome prior to 148.0.7778.96 (desktop). Root cause: insufficient policy enforcement in Auto...