CVE-2026-11270

CVE-2026-11270 affects Google Chrome on Android, where an inappropriate UI implementation allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chrome/Chromium UI handling prior to version 149.0.7827.53. Impact is confined to cross-origin data leakage; n...

CVE-2026-12016

Affected software: Google Chrome (DevTools component). The CVE-2026-12016 entry describes an inappropriate implementation in DevTools that could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Root cause: insufficient inp...

CVE-2026-10883

CVE-2026-10883 refers to a type confusion in ANGLE used by Google Chrome up to version 149.0.7827.53, which could allow a remote attacker to cause heap corruption via a crafted HTML page. Connected sources confirm the affected component is ANGLE within Chrome, and that the issue manifests as an o...

CVE-2026-10885

Use after free in Chrome for iOS: Google Chrome on iOS prior to 149.0.7827.53 allows remote code execution via a crafted HTML page. The issue in Chrome for iOS is confirmed in multiple sources (CVE-2026-10885). The Chrome 149 stability release includes this fix (149.0.7827.53) across desktop and ...

CVE-2026-10921

This CVE affects Google Chrome (Dawn component) prior to version 149.0.7827.53. An integer overflow in the Dawn renderer could allow a remote attacker who already gained renderer access to escape the sandbox via a crafted HTML page. The documented impact is a high-severity sandbox escape with lik...

CVE-2026-10925

CVE-2026-10925 : Affected product is Google Chrome on macOS using Skia. The vulnerability is an out-of-bounds write in Skia prior to version 149.0.7827.53, which could let a remote attacker who has already compromised the renderer process perform a sandbox escape via a crafted HTML page. The issu...

CVE-2026-10934

The CVE-2026-10934 entry concerns a use-after-free in Autofill for Google Chrome on Android, prior to version 149.0.7827.53. The underlying issue in the Autofill component could allow a remote attacker who already compromised the renderer process to trigger a sandbox escape via a crafted HTML pag...

CVE-2026-10975

CVE-2026-10975 describes a use-after-free in Chrome's WebRTC prior to build 149.0.7827.53, enabling a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. The vulnerability is labeled High severity with a network attack vector, requiring user interaction. Aff...

CVE-2026-10996

CVE-2026-10996 describes an inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability affects Google Chrome (Chromium-based) and is addressed by updating to Chrome 149....

CVE-2026-11000

Summary : CVE-2026-11000 affects Google Chrome on Linux. The vulnerable component is the Fonts code in Chromium, with the underlying issue described as a use-after-free. This leads to the possibility of remote code execution inside the browser sandbox via a crafted HTML page. Public references in...

CVE-2026-11017

CVE-2026-11017 affects Google Chrome/Chromium: Inappropriate implementation in Link Preview allows a renderer-compromised remote attacker to bypass navigation restrictions with a crafted HTML page. Debian/Chromium advisories fix the issue in Chromium/Chrome to 149.0.7827.53 (e.g., Debian: 149.0.7...

CVE-2026-11038

CVE-2026-11038 affects Google Chrome’s Subresource Integrity policy enforcement. The vulnerability allows a remote attacker to bypass content security policy via malicious network traffic in Chrome versions prior to 149.0.7827.53. Affected component is Subresource Integrity enforcement within Chr...

CVE-2026-11048

CVE-2026-11048 affects Google Chrome extensions; root cause is an inappropriate implementation in Chrome’s Extensions that allows bypassing the same-origin policy via a crafted extension. Impact is partial (I) as per CVSS, with no confidentiality loss and high integrity impact. Affected component...

CVE-2026-11071

CVE-2026-11071 describes a use-after-free in Base within Google Chrome on Linux prior to version 149.0.7827.53. The issue allows a remote attacker who has compromised the renderer process to read potentially sensitive information from process memory via a crafted HTML page. Affected product: Goog...

CVE-2026-11093

CVE-2026-11093 concerns Google Chrome: a flaw in the Printing implementation allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (Printing subsystem under the renderer process). Root cause: Inappropri...

CVE-2026-11104

CVE-2026-11104 affects Google Chrome (and Chromium-based Edge) via an uninitialized use in ANGLE. The vulnerability permits a remote attacker who has already compromised the renderer process to potentially read sensitive data from process memory through a crafted HTML page. Affected version famil...

CVE-2026-11136

CVE-2026-11136: Use-after-free in Canvas in Google Chrome before 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product: Google Chrome (Canvas component); root cause: use-after-free condition in Canvas handling. Impact: potent...

CVE-2026-11139

CVE-2026-11139 affects Google Chrome (Paint) with an inappropriate implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is in Chromium-based Chrome prior to version 149.0.7827.53. Impact per available data is cross-origin data leakage (no repo...

CVE-2026-11154

CVE-2026-11154 affects Google Chrome (Dawn component) with a use-after-free in Dawn prior to Chrome 149.0.7827.53. The vulnerability could allow a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. This is a Chromium-based issue...

CVE-2026-11210

CVE-2026-11210 concerns Google Chrome’s Safe Browsing component. The issue is an inappropriate implementation that allows a remote attacker to bypass discretionary access control via a crafted RAR file, affecting Chrome builds prior to 149.0.7827.53 . The vulnerability is remote, requires user in...

CVE-2026-11227

Summary: CVE-2026-11227 affects Google Chrome’s Tab Hover Cards UI. The vulnerability is a mismatch in the security UI that could allow a remote attacker to spoof a domain via a crafted domain name. The issue is associated with Chrome versions before 149.0.7827.53 (Chromium security severity: Low...

CVE-2026-11229

CVE-2026-11229 affects Google Chrome (Enterprise) with versions older than 149.0.7827.53. The issue is caused by an inappropriate implementation in Chrome’s Enterprise handling that enables a local attacker with physical access to escalate privileges. The vulnerability is classified as low severi...

CVE-2026-11296

The CVE-2026-11296 entry concerns the Google Chrome ImageCapture component. Affected software: Google Chrome prior to version 149.0.7827.53. Root cause: Inappropriate implementation in ImageCapture enables a remote attacker who has already compromised the renderer process to escalate privileges v...

CVE-2026-11648

CVE-2026-11648 is a use-after-free in FullScreen on Windows Chrome prior to 149.0.7827.103, potentially enabling heap corruption via a crafted HTML page. Affected software: Google Chrome (Windows). Root cause: use-after-free in FullScreen path. Impact: remote code execution risk (as implied by he...

CVE-2026-11649

CVE-2026-11649: Use-after-free in V8 affects Google Chrome before version 149.0.7827.103. Exploitation could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. Root cause is a use-after-free in V8 handling of certain objects (as described). Impact i...

CVE-2026-11656

CVE-2026-11656 affects Google Chrome via a Use-after-Free in the ServiceWorker component, enabling a sandbox escape when a user installs a crafted malicious extension. Public descriptions consistently state the vulnerability occurs in Chrome versions prior to 149.0.7827.103. The available sources...

CVE-2026-11657

CVE-2026-11657 covers a use-after-free in Chrome’s Payments component on macOS, allowing remote code execution via a crafted HTML page. Affected product: Google Chrome on Mac (before version 149.0.7827.103). Underlying issue: use-after-free in Payments. Impact: arbitrary code execution with high ...

CVE-2026-11666

Google Chrome CVE-2026-11666: Insufficient validation of untrusted input in Input allows UI spoofing via a crafted HTML page in Chrome versions before 149.0.7827.103. Affected: desktop Chrome; root cause is input validation weakness in Input. Impact: remote attacker can spoof UI with crafted page...

CVE-2026-11675

CVE-2026-11675 : Out-of-bounds read in Skia used by Google Chrome before 149.0.7827.103. A remote attacker who compromises the renderer process could leak cross-origin data via a crafted HTML page. The issue arises from Skia, with impact limited to confidentiality (LOW in CVSS 3.1 per the documen...

CVE-2026-11682

CVE-2026-11682 : In Chrome on Linux, an inappropriate implementation in Views (Chromium-based) prior to version 149.0.7827.103 could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Impact is sandbox escape potential...

CVE-2026-11685

CVE-2026-11685 involves an inappropriate implementation in MediaCapture in Google Chrome on macOS, where versions prior to 149.0.7827.103 allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is scoped to Chrome on Mac and is triggered by processing a crafted HTML p...

CVE-2026-12438

The CVE-2026-12438 entry corresponds to an issue in WebView for Google Chrome on Android, where an attacker who compromised the renderer process could escape the browser sandbox via a crafted HTML page. Affected product/vector: Android WebView in Chrome; root cause: inappropriate implementation i...

CVE-2026-12461

CVE-2026-12461 affects Google Chrome on Windows, with an out-of-bounds read in WebRTC present in versions prior to 149.0.7827.155. The vulnerability could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Mitigation is to update Chrome to 149....

CVE-2026-13037

CVE-2026-13037 is a use-after-free vulnerability in WebView for Android within Google Chrome, before version 149.0.7827.197. The flaw allows a local attacker to run arbitrary code inside the sandbox via a crafted HTML page. Affected component: WebView in Chrome on Android; root cause: use-after-f...

CVE-2026-13813

Summary: CVE-2026-13813 concerns Chrome for iOS where insufficient policy enforcement in the renderer allowed a sandbox escape via a crafted HTML page after renderer compromise. The issue affects Google Chrome on iOS before version 150.0.7871.47 (Chromium security severity: High). Root cause / vu...

CVE-2026-13835

CVE-2026-13835 : Google Chrome before 150.0.7871.47 is affected by an inappropriate implementation in XML that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Impact is described as high severity; no exploit details are provided in the documents. Remediation: upd...

CVE-2026-13887

The CVE-2026-13887 entry relates to Google Chrome for Android, where an inappropriate NFC implementation before version 150.0.7871.47 allowed a remote attacker who had already compromised the renderer process to leak cross-origin data via a crafted HTML page. This is triggered by a renderer compr...

CVE-2026-14016

The CVE-2026-14016 entry concerns Google Chrome’s SVG handling. The vulnerability arises from an inappropriate implementation in Chrome’s SVG processing prior to 150.0.7871.47, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome components dealing...

CVE-2026-14017

CVE-2026-14017 concerns Google Chrome’s Navigation logic. Affected component: Chrome prior to build 150.0.7871.47; root cause: inappropriate navigation implementation allowed a remote attacker who had already compromised the renderer process to potentially escape the Chrome sandbox via a crafted ...

CVE-2026-14026

CVE-2026-14026 affects Google Chrome (SplitView) prior to 150.0.7871.47. A crafted HTML page can lure a user to perform specific UI gestures, causing UI spoofing due to an incorrect security UI in SplitView. The issue is reported with Chromium security severity: Low. Remediation: update to Chrome...

CVE-2026-14027

CVE-2026-14027 describes a use-after-free in Google Chrome's SignIn path prior to version 150.0.7871.47. A remote attacker could lure a user into specific UI gestures to trigger heap corruption via a crafted HTML page. The vulnerability affects Chrome and is mitigated by updating to 150.0.7871.47...

CVE-2026-14038

CVE-2026-14038 affects Google Chrome’s New Tab Page. The root cause is insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer to potentially escape the sandbox via a crafted HTML page. The vulnerability is addressed in Chrome version 150.0.7871.47 ...

CVE-2026-14047

CVE-2026-14047 affects Google Chrome before version 150.0.7871.47 due to insufficient policy enforcement in Extensions, enabling an attacker who persuades a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. The vulnerability’s impact is descri...

CVE-2026-14081

CVE-2026-14081 affects Google Chrome DevTools prior to version 150.0.7871.47. The issue is insufficient policy enforcement, enabling an attacker who persuades a user to install a malicious Chrome extension to access potentially sensitive information from process memory via the crafted extension. ...

CVE-2026-14086

The CVE-2026-14086 entry describes a vulnerability in Google Chrome's HID policy enforcement. Affected component: Chrome/Chromium browser handling of HID policy checks. Root cause: insufficient policy enforcement in HID logic allows a remote attacker to run arbitrary code via a crafted HTML page....

CVE-2026-14102

CVE-2026-14102: Use-after-free in Passwords in Google Chrome before 150.0.7871.47 may allow remote heap corruption via a crafted HTML page. Affected: Google Chrome/Chromium Passwords component. Root cause: use-after-free leading to heap corruption. Impact, per CVSS: HIGH for confidentiality, inte...

CVE-2026-14385

CVE-2026-14385 : Heap buffer overflow in ANGLE within Google Chrome on macOS prior to 150.0.7871.46 allows a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. The issue affects ANGLE in Chrome and is tied to the macOS build; CVSS v3.1 base score: 8.8 (High). Remediat...

CVE-2026-3536

The CVE-2026-3536 issue is an integer overflow in ANGLE within Google Chrome prior to 145.0.7632.159, allowing a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The vulnerability is rated Critical (NVD/Chrome CVSS 3.1: 8.8) with network attack vector an...

CVE-2026-3538

CVE-2026-3538 : Integer overflow in Skia used by Google Chrome/Chromium prior to 145.0.7632.159 can enable a remote attacker to cause out-of-bounds memory access via a crafted HTML page. Affected software includes Google Chrome (Chromium-based) with Skia. The issue’s root cause is an overflow in ...

CVE-2026-3544

CVE-2026-3544 is a heap buffer overflow in WebCodecs of Google Chrome/Chromium, allowing a remote, unauthenticated attacker to induce an out-of-bounds write via a crafted HTML page. Affected product: Chrome/Chromium’s WebCodecs component; root cause: heap memory overflow. Impact stated as high se...