CVE-2026-14091

The CVE-2026-14091 entry documents a use-after-free in Chrome’s DevTools before version 150.0.7871.47. The underlying issue is in DevTools handling, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected software is Google Chrome (DevTools componen...

CVE-2026-11648

CVE-2026-11648 is a use-after-free in FullScreen on Windows Chrome prior to 149.0.7827.103, potentially enabling heap corruption via a crafted HTML page. Affected software: Google Chrome (Windows). Root cause: use-after-free in FullScreen path. Impact: remote code execution risk (as implied by he...

CVE-2026-11657

CVE-2026-11657 covers a use-after-free in Chrome’s Payments component on macOS, allowing remote code execution via a crafted HTML page. Affected product: Google Chrome on Mac (before version 149.0.7827.103). Underlying issue: use-after-free in Payments. Impact: arbitrary code execution with high ...

CVE-2026-11666

Google Chrome CVE-2026-11666: Insufficient validation of untrusted input in Input allows UI spoofing via a crafted HTML page in Chrome versions before 149.0.7827.103. Affected: desktop Chrome; root cause is input validation weakness in Input. Impact: remote attacker can spoof UI with crafted page...

CVE-2026-11682

CVE-2026-11682 : In Chrome on Linux, an inappropriate implementation in Views (Chromium-based) prior to version 149.0.7827.103 could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Impact is sandbox escape potential...

CVE-2026-11685

CVE-2026-11685 involves an inappropriate implementation in MediaCapture in Google Chrome on macOS, where versions prior to 149.0.7827.103 allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is scoped to Chrome on Mac and is triggered by processing a crafted HTML p...

CVE-2026-12438

The CVE-2026-12438 entry corresponds to an issue in WebView for Google Chrome on Android, where an attacker who compromised the renderer process could escape the browser sandbox via a crafted HTML page. Affected product/vector: Android WebView in Chrome; root cause: inappropriate implementation i...

CVE-2026-12461

CVE-2026-12461 affects Google Chrome on Windows, with an out-of-bounds read in WebRTC present in versions prior to 149.0.7827.155. The vulnerability could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Mitigation is to update Chrome to 149....

CVE-2026-13029

CVE-2026-13029: Use-after-free in Web Authentication for Google Chrome, fixed in or after 149.0.7827.197. Affected component: Web Authentication flow; vulnerability arises when a user is convinced to install a malicious Chrome Extension, potentially enabling heap corruption via a crafted extensio...

CVE-2026-13037

CVE-2026-13037 is a use-after-free vulnerability in WebView for Android within Google Chrome, before version 149.0.7827.197. The flaw allows a local attacker to run arbitrary code inside the sandbox via a crafted HTML page. Affected component: WebView in Chrome on Android; root cause: use-after-f...

CVE-2026-13787

The CVE-2026-13787 entry concerns a use-after-free condition in Chromoting within Google Chrome on Windows, prior to version 150.0.7871.47 . This memory corruption issue enables a remote attacker to execute arbitrary code via malicious network traffic, as indicated by the NVD/Chromium advisories ...

CVE-2026-13887

The CVE-2026-13887 entry relates to Google Chrome for Android, where an inappropriate NFC implementation before version 150.0.7871.47 allowed a remote attacker who had already compromised the renderer process to leak cross-origin data via a crafted HTML page. This is triggered by a renderer compr...

CVE-2026-14016

The CVE-2026-14016 entry concerns Google Chrome’s SVG handling. The vulnerability arises from an inappropriate implementation in Chrome’s SVG processing prior to 150.0.7871.47, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome components dealing...

CVE-2026-14017

CVE-2026-14017 concerns Google Chrome’s Navigation logic. Affected component: Chrome prior to build 150.0.7871.47; root cause: inappropriate navigation implementation allowed a remote attacker who had already compromised the renderer process to potentially escape the Chrome sandbox via a crafted ...

CVE-2026-14027

CVE-2026-14027 describes a use-after-free in Google Chrome's SignIn path prior to version 150.0.7871.47. A remote attacker could lure a user into specific UI gestures to trigger heap corruption via a crafted HTML page. The vulnerability affects Chrome and is mitigated by updating to 150.0.7871.47...

CVE-2026-14032

This CVE affects Google Chrome on macOS, describing a Use-After-Free in Bluetooth that allows code execution when a user is tricked into installing a crafted Chrome Extension. The vulnerable condition is Chrome versions prior to 150.0.7871.47. Impact is arbitrary code execution with high severity...

CVE-2026-14038

CVE-2026-14038 affects Google Chrome’s New Tab Page. The root cause is insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer to potentially escape the sandbox via a crafted HTML page. The vulnerability is addressed in Chrome version 150.0.7871.47 ...

CVE-2026-14040

Summary (concrete details from provided sources): CVE-2026-14040 is a use-after-free in Chrome’s BrowserTag (prior to version 150.0.7871.47). A device exploited by convincing a user to install a malicious extension could trigger heap corruption via the crafted Chrome Extension. This affects Googl...

CVE-2026-14081

CVE-2026-14081 affects Google Chrome DevTools prior to version 150.0.7871.47. The issue is insufficient policy enforcement, enabling an attacker who persuades a user to install a malicious Chrome extension to access potentially sensitive information from process memory via the crafted extension. ...

CVE-2026-14086

The CVE-2026-14086 entry describes a vulnerability in Google Chrome's HID policy enforcement. Affected component: Chrome/Chromium browser handling of HID policy checks. Root cause: insufficient policy enforcement in HID logic allows a remote attacker to run arbitrary code via a crafted HTML page....

CVE-2026-14102

CVE-2026-14102: Use-after-free in Passwords in Google Chrome before 150.0.7871.47 may allow remote heap corruption via a crafted HTML page. Affected: Google Chrome/Chromium Passwords component. Root cause: use-after-free leading to heap corruption. Impact, per CVSS: HIGH for confidentiality, inte...

CVE-2026-14122

The CVE-2026-14122 entry describes an issue in Google Chrome on Windows affecting the WebAppInstalls component of Chromium. The root cause is insufficient validation of untrusted input, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. The vulnerability impacts C...

CVE-2026-14394

Summary of CVE-2026-14394 (Google Chrome / V8) : A use-after-free in V8 leads to potential heap corruption when processing crafted HTML pages. Affected software is Google Chrome, with vulnerable versions prior to 150.0.7871.46. The issue is caused by a use-after-free in the JavaScript engine (V8)...

CVE-2026-15118

CVE-2026-15118 describes a Use-After-Free in Chrome’s Input component affecting Google Chrome versions prior to 150.0.7871.115. A remote attacker could exploit this via a crafted HTML page to execute arbitrary code within the browser sandbox. The Chrome advisories and related sources confirm the ...

CVE-2026-3536

The CVE-2026-3536 issue is an integer overflow in ANGLE within Google Chrome prior to 145.0.7632.159, allowing a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The vulnerability is rated Critical (NVD/Chrome CVSS 3.1: 8.8) with network attack vector an...

CVE-2026-3538

CVE-2026-3538 : Integer overflow in Skia used by Google Chrome/Chromium prior to 145.0.7632.159 can enable a remote attacker to cause out-of-bounds memory access via a crafted HTML page. Affected software includes Google Chrome (Chromium-based) with Skia. The issue’s root cause is an overflow in ...

CVE-2026-3544

CVE-2026-3544 is a heap buffer overflow in WebCodecs of Google Chrome/Chromium, allowing a remote, unauthenticated attacker to induce an out-of-bounds write via a crafted HTML page. Affected product: Chrome/Chromium’s WebCodecs component; root cause: heap memory overflow. Impact stated as high se...

CVE-2026-5889

CVE-2026-5889 involves a cryptographic flaw in PDFium used by Google Chrome prior to version 147.0.7727.55 that could allow an attacker to read potentially sensitive data from encrypted PDFs via brute-force. The issue is addressed in the Chrome 147 stable update (147.0.7727.55) for Windows, macOS...

CVE-2026-7356

CVE-2026-7356 involves a use-after-free in the Navigation component of Google Chrome, upstream in Chrome’s Chromium code. Affected product: Google Chrome; vulnerable under pre-147.0.7727.138 builds. Root cause: use-after-free in Navigation allegedly allows remote attackers to execute arbitrary co...

CVE-2026-7989

CVE-2026-7989 affects Google Chrome versions prior to 148.0.7778.96 due to insufficient data validation in DataTransfer within the renderer. A remote attacker who has compromised the renderer process could trigger arbitrary read/write via a crafted HTML page. The issue is documented across multip...

CVE-2026-8004

CVE-2026-8004 describes an issue in Google Chrome where insufficient policy enforcement in DevTools could allow a user-assisted cross-origin data leak via a crafted malicious extension. Affected product: Google Chrome (DevTools component). Root cause: policy enforcement gaps in DevTools prior to ...

CVE-2026-8524

Technical details (affected products, vulnerable components, root cause, or exploitation specifics) are not provided in the supplied documents. Please monitor official advisories for updates.

CVE-2026-8545

CVE-2026-8545 is an object-corruption in the Chromium-based Composite rendering path affecting Google Chrome. Public sources describe that an attacker who already compromised the renderer process could leak cross-origin data via a crafted HTML page. Affected product lineage is Google Chrome/Chrom...

CVE-2026-8559

Technical details (affected product/component, root cause, impact, or fixes) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2026-8571

CVE-2026-8571 describes an issue in the GPU policy enforcement of Google Chrome on Android, where insufficient enforcement could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability affects Chrome versions pr...

CVE-2026-8585

The CVE-2026-8585 entry describes an out-of-bounds memory read in Chrome on iOS caused by an inappropriate implementation in Media code, exploitable by a remote attacker who already compromises the renderer process. Affected software is Google Chrome for iOS, before version 148.0.7778.168. The de...

CVE-2026-9124

CVE-2026-9124 : In Google Chrome (Chromium-based), there is insufficient validation of untrusted input in Input before version 148.0.7778.179. A remote attacker who compromised the renderer process could leak cross-origin data via a crafted HTML page. The issue is described as Medium severity; co...

CVE-2026-9890

CVE-2026-9890 is a use-after-free in Chrome’s XR component on Windows, prior to version 148.0.7778.216. A renderer process–compromised attacker could potentially escape the Chrome sandbox via a crafted HTML page, as described in multiple sources (EUVD-2026-33185, Red Hat, Debian, NVD). The Chrome...

CVE-2026-9899

Summary of CVE-2026-9899 : A use-after-free in ANGLE within Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is in the ANGLE component of Chromium/Chrome, with an ex...

CVE-2026-9902

CVE-2026-9902 is a use-after-free in the Accessibility component of Google Chrome (Chromium) reported as affecting pre-148.0.7778.216. The issue could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The associated connect...

CVE-2026-9911

CVE-2026-9911 corresponds to an integer overflow in ANGLE used by Google Chrome/Chromium before 148.0.7778.216, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. The issue affects ANGLE within Chromium-based Chrome; impact is described as an out-of-bounds...

CVE-2026-9913

This CVE (CVE-2026-9913) concerns an inappropriate implementation in ANGLE used by Google Chrome. The issue allows a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page in Chrome builds affected by ANGLE, prior to version 148.0.7778.216. Root cause: ANGLE im...

CVE-2026-9944

CVE-2026-9944 : Uninitialized use in ANGLE within Google Chrome/Chromium allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected: ANGLE in Chrome/Chromium prior to 148.0.7778.216. Impact: data leakage; no other impacts confirme...

CVE-2026-9949

CVE-2026-9949 affects Google Chrome on Windows, caused by a use-after-free in the Core component that could allow a remote attacker who compromised the renderer process to escape the sandbox via a crafted HTML page. Affected versions are prior to 148.0.7778.216; remediation is to upgrade to 148.0...

CVE-2025-12440

CVE-2025-12440 affects Google Chrome/Chromium Autofill prior to 142.0.7444.59. A crafted HTML page can leverage an inappropriate Autofill implementation to exfiltrate potentially sensitive data from process memory after convincing a user to perform specific UI gestures. The published data indicat...

CVE-2025-13721

CVE-2025-13721 describes a race in V8 within Google Chrome prior to 143.0.7499.41 that could enable a remote attacker to trigger heap corruption via a specially crafted HTML page. Affected software is Google Chrome (V8 engine); the vulnerability stems from a race condition in V8. Reported impact ...

CVE-2025-13992

CVE-2025-13992 affects Google Chrome (Chrome/Chromium) prior to version 139.0.7258.66, involving a side-channel information leakage during Navigation and Loading that could allow a remote attacker to bypass site isolation via a crafted HTML page. Affected component/behavior is described in public...

CVE-2025-14766

CVE-2025-14766 refers to an out-of-bounds read/write in the V8 engine of Google Chrome/Chromium prior to version 143.0.7499.147, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public reports and security advisories confirm broader impact on Chromium-bas...

CVE-2026-10909

The connected sources confirm CVE-2026-10909 is a use-after-free vulnerability in Dawn within Google Chrome, fixed by Chrome 149.0.7827.53. A remote attacker who has compromised the renderer could potentially perform a sandbox escape via a crafted HTML page. Affected component/file: Dawn in Chrom...

CVE-2026-10915

CVE-2026-10915 – Use-after-free in Core of Google Chrome for iOS (pre-149.0.7827.53) allows a remote attacker who has compromised the renderer to potentially perform a sandbox escape via a crafted HTML page. This is confirmed by multiple sources (NVD entry and ENISA EUVD-2026-34364) and is catego...