CVE-2026-9982

Affected software: Google Chrome (ANGLE component). Issue: insufficient validation of untrusted input in ANGLE allows a renderer process user to escalate to sandbox escape via a crafted HTML page. Severity: High (CVSS 3.1 base 8.3). Affected version window: prior to 148.0.7778.216; remediation: u...

CVE-2025-13635

CVE-2025-13635 affects Google Chrome/Chromium: Inappropriate implementation in the Downloads path allows a local attacker to perform UI spoofing via a crafted HTML page. Affected versions are prior to 143.0.7499.41 (Chrome/Chromium). The issue is marked Chromium security severity: Low. Related up...

CVE-2025-14765

CVE-2025-14765 corresponds to a Use after free in WebGPU within Chromium-based WebView/Chrome rendering paths. The primary public details indicate that a crafted HTML page could trigger heap corruption, leading to a potential remote code execution or crash under high-severity conditions. Affected...

CVE-2026-10008

CVE-2026-10008 concerns an uninitialized use flaw in the GPU component of the Chromium-based Google Chrome on Android. The issue allows a remote attacker to potentially read sensitive information from a process’s memory via a crafted HTML page. The public description cites the root cause as an un...

CVE-2026-10019

The CVE-2026-10019 entry documents an integer overflow in ANGLE used by Google Chrome. Affected software: Google Chrome (ANGLE integration). Vulnerable component/file: ANGLE; root cause is an integer overflow leading to potential cross-origin data leakage when parsing/handling a crafted HTML page...

CVE-2026-10910

CVE-2026-10910 refers to a Type Confusion in V8 that affected Google Chrome’s sandboxed JavaScript engine prior to Chrome 149.0.7827.53. The issue could allow a remote attacker to execute arbitrary code through a crafted HTML page, with exploitation possible without user privileges but requiring ...

CVE-2026-10953

CVE-2026-10953 involves a use-after-free in Chrome’s Core on Android, allowing a remote attacker who has already compromised a renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software is Google Chrome on Android, with the vulnerability present prior to ...

CVE-2026-11002

CVE-2026-11002 : Use-after-free in Chrome Autofill (Chromium) prior to 149.0.7827.53 when a renderer process is compromised, potentially enabling a sandbox escape via a crafted HTML page. Affected: Chromium-based Chrome. Impact: remote code execution with sandbox break. Remediation: upgrade to Ch...

CVE-2026-11065

The CVE-2026-11065 issue is a use-after-free in ANGLE used by Google Chrome prior to 149.0.7827.53. If a renderer process is already compromised, an attacker could potentially escape the sandbox via a crafted HTML page. The impact is described as high/critical in overall runtime risk due to sandb...

CVE-2026-11069

CVE-2026-11069 concerns Google Chrome prior to 149.0.7827.53, where cast-related input validation on untrusted data is insufficient. The underlying issue permits a remote attacker to bypass the same-origin policy via a crafted HTML page, with the impact described as Medium. The vulnerability affe...

CVE-2026-11232

CVE-2026-11232 impacts Google Chrome TabGroups. The issue is an inappropriate implementation in TabGroups prior to version 149.0.7827.53, enabling a remote attacker to perform UI spoofing via malicious network traffic. Severity is indicated as Low. No remediation details are provided in the conne...

CVE-2026-11234

CVE-2026-11234 affects Google Chrome prior to 149.0.7827.53. The issue is an incorrect implementation in FoldableAPIs that lets a remote attacker who has compromised the renderer process bypass site isolation via a crafted HTML page. The known impact is limited to bypassing site isolation, as des...

CVE-2026-11238

CVE-2026-11238 concerns the Google Chrome DevTools implementation. The connected documents state that an insecure DevTools path in Chrome prior to version 149.0.7827.53 allows a user-assisted attack: if a user installs a malicious extension, memory contents from affected processes may be exposed....

CVE-2026-11690

Summary: CVE-2026-11690 describes an out-of-bounds read/write in Media component of Google Chrome on macOS, prior to version 149.0.7827.103. A remote attacker who has compromised the renderer process could execute arbitrary code inside the sandbox via a crafted HTML page. The issue is rated High ...

CVE-2026-12015

The CVE-2026-12015 entry describes a use-after-free in Chrome’s Autofill component handled in the renderer process. A remote attacker who can compromise the renderer could leverage a crafted HTML page to read potentially sensitive data from process memory. Affected software is Google Chrome (Auto...

CVE-2026-12020

The CVE-2026-12020 entry concerns Google Chrome on macOS, where an Autofill use-after-free leads to possible heap corruption from a crafted HTML page. Affected product/version: Chrome on Mac prior to 149.0.7827.115. Root cause: use-after-free in Autofill (Chromium component) as described in the c...

CVE-2026-13033

CVE-2026-13033 affects Google Chrome’s Blink component, specifically Blink>InterestGroups. The vulnerability is described as an out-of-bounds read and write that could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected versions are Chrome prior to 149.0.7827.19...

CVE-2026-13810

CVE-2026-13810 affects Google Chrome on Linux. The issue is an inappropriate implementation in Input that allowed a remote attacker to extract potentially sensitive data from process memory via a crafted HTML page. The vulnerability is tied to Chrome/Chromium in Linux builds prior to version 150....

CVE-2026-14003

Affected software/scope: Google Chrome extensions mechanism. Vulnerability: Insufficient policy enforcement in Chrome Extensions prior to 150.0.7871.47 allows a user-assisted attacker to leak cross-origin data when a malicious extension is installed. Underlying issue: policy enforcement weakness ...

CVE-2026-14155

Technical details are not publicly available in the provided documents for CVE-2026-14155; monitor for updates from the connected sources.

CVE-2026-14421

CVE-2026-14421 concerns an uninitialized-use issue in Dawn for Google Chrome on ChromeOS, prior to version 150.0.7871.46. The issue could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Documents consistently describe the vulnerability as Un...

CVE-2026-16413

CVE-2026-16413 is an out-of-bounds write in ANGLE used by Google Chrome (Chromium-based) prior to 150.0.7871.182, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. Connected sources confirm the issue in ANGLE and identify affected Chrome/Chromiu...

CVE-2026-2313

CVE-2026-2313 describes a use-after-free in CSS handling within Google Chrome prior to version 145.0.7632.45, enabling a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability’s impact is described as high severity with a network attack vector and user i...

CVE-2026-2316

CVE-2026-2316 affects Google Chrome/Chromium: insufficient policy enforcement in Frames enables UI spoofing via a crafted HTML page when Chrome is before 145.0.7632.45. Remediation is to update to Chrome 145.0.7632.45 or newer (Chromium fix). Debian advisories also indicate later Chromium fixes f...

CVE-2026-3542

CVE-2026-3542 corresponds to an out-of-bounds memory access flaw in WebAssembly within Google Chrome's Chromium stack, caused by an inappropriate WebAssembly implementation. Multiple sources (Astra Linux bulletin, CNVD/CNNVD, Debian security notices, CVE listings, and the Chrome stable update) co...

CVE-2026-3545

CVE-2026-3545 affects Google Chrome/Chromium prior to 145.0.7632.159. Description across connected sources notes insufficient data validation in Navigation can allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page, with high/critical impact per Chromium. The Debi...

CVE-2026-4679

CVE-2026-4679 describes an integer overflow in Chrome’s Fonts code, allowing a remote attacker to trigger an out-of-bounds memory write via a crafted HTML page. Affected software: Google Chrome (Chromium-based) prior to version 146.0.7680.165. Root cause: integer overflow in the Fonts component. ...

CVE-2026-5282

CVE-2026-5282 is an out-of-bounds read in Chrome’s WebCodecs before 146.0.7680.178 that could be triggered by a crafted HTML page, enabling a remote attacker to read memory. Affected: Google Chrome/WebCodecs. Root cause: memory read boundary violation in WebCodecs. Impact: confidentiality and ava...

CVE-2026-7999

CVE-2026-7999 affects Google Chrome's V8 engine: an inappropriate implementation allows a remote attacker to read potentially sensitive data from a process's memory via a crafted HTML page. A fix is available in Chrome 148.0.7778.96 and later; update to the patched version. The vulnerability deta...

CVE-2026-8000

CVE-2026-8000 concerns ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96. The root cause is insufficient validation of untrusted input on crafted HTML pages, enabling a remote attacker to execute arbitrary code. Affected component is ChromeDriver (Chromium-based), with the vulnerabi...

CVE-2026-8013

CVE-2026-8013 affects Google Chrome FedCM (Federated Credential Management) prior to 148.0.7778.96. The vulnerability is due to insufficient validation of untrusted input, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Impact is described as cross-origin data leakag...

CVE-2026-8514

CVE-2026-8514 describes a use-after-free in Chrome’s Aura component affecting the renderer process, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page on Chrome versions prior to 148.0.7778.168. The vulnerability is labeled Critical. Affected software is the Chro...

CVE-2026-8553

Affected product: Google Chrome (GPU/renderer path). Issue: Use-after-free in GPU code leading to an out-of-bounds memory write when a crafted HTML page is processed after compromise of the renderer. Impact: remote attacker could exploit via the compromised renderer process; severity is indicated...

CVE-2026-9126

CVE-2026-9126 describes a use-after-free in DOM in Google Chrome prior to version 148.0.7778.179 . The vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox via a crafted HTML page. The associated metrics indicate a high-impact, (CVSS 3.1) base score of 8.8 w...

CVE-2026-9903

CVE-2026-9903 : Insufficient validation of untrusted input in the Site Isolation component of Google Chrome (Chromium) prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to bypass site isolation via a crafted MHTML page. The impact is to weaken the b...

CVE-2026-9952

Summary: CVE-2026-9952 is a use-after-free in WebAudio within Google Chrome. The issue affects Chromium-based WebAudio code and enables a remote attacker to execute arbitrary code inside a sandbox when a crafted HTML page is processed. The public description specifies “prior to 148.0.7778.216,” i...

CVE-2026-9958

CVE-2026-9958: Use-after-free in PDFium within Google Chrome (pre-148.0.7778.216) allows a remote attacker to potentially exploit heap corruption via a crafted PDF file. Affected: Google Chrome/Chromium PDFium component. Root cause: use-after-free. Impact: high (per CVSS), with potential for impa...

CVE-2026-9987

CVE-2026-9987 : In Chrome for Android, WebAppInstalls suffers insufficient validation of untrusted input, enabling a local attacker to execute arbitrary code via a malicious file. The issue is described across multiple sources as a Chromium/WebAppInstalls flaw with a High severity. The available ...

CVE-2026-9995

The CVE-2026-9995 entry describes a use-after-free in Chrome’s WebXR component prior to version 148.0.7778.216. A crafted HTML page could allow a remote attacker to execute arbitrary code inside the browser sandbox. Affected product: Google Chrome (WebXR). Root cause: use-after-free in WebXR. Imp...

CVE-2025-13639

Summary: CVE-2025-13639 is an issue in the WebRTC implementation of Google Chrome/Chromium. Affected component: WebRTC in Chrome/Chromium prior to version 143.0.7499.41. Impact: Remote attacker could cause arbitrary read/write via a crafted HTML page (confidentiality and integrity impact; availab...

CVE-2026-10022

Summary: A type confusion in the V8 JavaScript engine within Google Chrome before version 148.0.7778.216 may allow an attacker who convinces a user to install a malicious extension to execute arbitrary code inside a browser sandbox. Affected components: V8 in Google Chrome (Chromium-based). Root ...

CVE-2026-10887

CVE-2026-10887 is a use-after-free in Chromoting within Google Chrome on macOS, leading to remote arbitrary code execution via malicious network traffic. The connected Chrome release note confirms a fix in Chrome 149.0.7827.53 (and related stability updates) for macOS, addressing the vulnerabilit...

CVE-2026-10916

This CVE affects Google Chrome DevTools: insufficient validation of untrusted input in DevTools allowed UXSS via a crafted HTML page on renderer-compromised contexts, prior to Chrome 149.0.7827.53. The vulnerability, caused by inadequate input validation in DevTools, could enable a remote attacke...

CVE-2026-10927

The vulnerability CVE-2026-10927 affects Google Chrome’s Dawn component in the renderer process, with an out-of-bounds read that could enable a sandbox escape via a crafted HTML page. The issue is tied to Chrome versions prior to 149.0.7827.53. An attacker who already has renderer access could po...

CVE-2026-10928

CVE-2026-10928 affects Google Chrome in headless mode prior to 149.0.7827.53. The issue is described as a script injection via a crafted HTML page that could allow remote code execution. Affected component is the headless browser environment within Chrome/Chromium; root cause is a script-injectio...

CVE-2026-10967

CVE-2026-10967 affects Google Chrome on Android and is due to a use-after-free in SurfaceCapture. A remote attacker who has compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page. The issue is triggered in Chrome versions prior to 149.0.7827.53; the fi...

CVE-2026-10973

CVE-2026-10973 describes an uninitialized use in Dawn within Google Chrome, affecting Chrome builds prior to 149.0.7827.53. This vulnerability could allow a remote attacker to leak cross-origin data via a crafted HTML page. The description attributes impact to data leakage with network-exposed at...

CVE-2026-10989

CVE-2026-10989 affects Google Chrome’s V8 engine prior to version 149.0.7827.53 . The weakness stems from an inappropriate implementation in V8 , allowing a remote attacker to potentially exploit a heap corruption vulnerability via a crafted HTML page after convincing a user to perform specific U...

CVE-2026-11024

CVE-2026-11024: A stack buffer overflow in Skia used by Google Chrome/Chromium prior to 149.0.7827.53 allows remote exploitation via a crafted HTML page, potentially causing stack corruption. Multiple connected sources confirm affected components and versions (Chromium/Skia, Chrome upstream), wit...

CVE-2026-11075

CVE-2026-11075 describes an out-of-bounds read in V8 within Google Chrome prior to 149.0.7827.53, enabling a remote attacker to potentially reading sensitive data from a process’s memory through a crafted HTML page. Affected component is V8 (JavaScript engine) in Chrome; impact is information dis...