CVE-2026-11136

CVE-2026-11136: Use-after-free in Canvas in Google Chrome before 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product: Google Chrome (Canvas component); root cause: use-after-free condition in Canvas handling. Impact: potent...

CVE-2026-11139

CVE-2026-11139 affects Google Chrome (Paint) with an inappropriate implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is in Chromium-based Chrome prior to version 149.0.7827.53. Impact per available data is cross-origin data leakage (no repo...

CVE-2026-11154

CVE-2026-11154 affects Google Chrome (Dawn component) with a use-after-free in Dawn prior to Chrome 149.0.7827.53. The vulnerability could allow a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. This is a Chromium-based issue...

CVE-2026-11210

CVE-2026-11210 concerns Google Chrome’s Safe Browsing component. The issue is an inappropriate implementation that allows a remote attacker to bypass discretionary access control via a crafted RAR file, affecting Chrome builds prior to 149.0.7827.53 . The vulnerability is remote, requires user in...

CVE-2026-11227

Summary: CVE-2026-11227 affects Google Chrome’s Tab Hover Cards UI. The vulnerability is a mismatch in the security UI that could allow a remote attacker to spoof a domain via a crafted domain name. The issue is associated with Chrome versions before 149.0.7827.53 (Chromium security severity: Low...

CVE-2026-11229

CVE-2026-11229 affects Google Chrome (Enterprise) with versions older than 149.0.7827.53. The issue is caused by an inappropriate implementation in Chrome’s Enterprise handling that enables a local attacker with physical access to escalate privileges. The vulnerability is classified as low severi...

CVE-2026-11258

This CVE (CVE-2026-11258) affects Google Chrome’s File System Access and is due to an inappropriate implementation that allows a remote attacker to bypass discretionary access control when a user is persuaded by a crafted HTML page to perform specific UI gestures. Affected software: Chrome prior ...

CVE-2026-11292

CVE-2026-11292 : A CSP bypass vulnerability in Blink used by Google Chrome prior to 149.0.7827.53 allows remote attackers to bypass content security policy through a crafted HTML page. Affected component is Blink in Chrome/Chromium; exploitation is possible over the network with user interaction ...

CVE-2026-11296

The CVE-2026-11296 entry concerns the Google Chrome ImageCapture component. Affected software: Google Chrome prior to version 149.0.7827.53. Root cause: Inappropriate implementation in ImageCapture enables a remote attacker who has already compromised the renderer process to escalate privileges v...

CVE-2026-11648

CVE-2026-11648 is a use-after-free in FullScreen on Windows Chrome prior to 149.0.7827.103, potentially enabling heap corruption via a crafted HTML page. Affected software: Google Chrome (Windows). Root cause: use-after-free in FullScreen path. Impact: remote code execution risk (as implied by he...

CVE-2026-11657

CVE-2026-11657 covers a use-after-free in Chrome’s Payments component on macOS, allowing remote code execution via a crafted HTML page. Affected product: Google Chrome on Mac (before version 149.0.7827.103). Underlying issue: use-after-free in Payments. Impact: arbitrary code execution with high ...

CVE-2026-11666

Google Chrome CVE-2026-11666: Insufficient validation of untrusted input in Input allows UI spoofing via a crafted HTML page in Chrome versions before 149.0.7827.103. Affected: desktop Chrome; root cause is input validation weakness in Input. Impact: remote attacker can spoof UI with crafted page...

CVE-2026-11682

CVE-2026-11682 : In Chrome on Linux, an inappropriate implementation in Views (Chromium-based) prior to version 149.0.7827.103 could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Impact is sandbox escape potential...

CVE-2026-11685

CVE-2026-11685 involves an inappropriate implementation in MediaCapture in Google Chrome on macOS, where versions prior to 149.0.7827.103 allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is scoped to Chrome on Mac and is triggered by processing a crafted HTML p...

CVE-2026-12438

The CVE-2026-12438 entry corresponds to an issue in WebView for Google Chrome on Android, where an attacker who compromised the renderer process could escape the browser sandbox via a crafted HTML page. Affected product/vector: Android WebView in Chrome; root cause: inappropriate implementation i...

CVE-2026-12461

CVE-2026-12461 affects Google Chrome on Windows, with an out-of-bounds read in WebRTC present in versions prior to 149.0.7827.155. The vulnerability could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Mitigation is to update Chrome to 149....

CVE-2026-13029

CVE-2026-13029: Use-after-free in Web Authentication for Google Chrome, fixed in or after 149.0.7827.197. Affected component: Web Authentication flow; vulnerability arises when a user is convinced to install a malicious Chrome Extension, potentially enabling heap corruption via a crafted extensio...

CVE-2026-13787

The CVE-2026-13787 entry concerns a use-after-free condition in Chromoting within Google Chrome on Windows, prior to version 150.0.7871.47 . This memory corruption issue enables a remote attacker to execute arbitrary code via malicious network traffic, as indicated by the NVD/Chromium advisories ...

CVE-2026-13887

The CVE-2026-13887 entry relates to Google Chrome for Android, where an inappropriate NFC implementation before version 150.0.7871.47 allowed a remote attacker who had already compromised the renderer process to leak cross-origin data via a crafted HTML page. This is triggered by a renderer compr...

CVE-2026-14016

The CVE-2026-14016 entry concerns Google Chrome’s SVG handling. The vulnerability arises from an inappropriate implementation in Chrome’s SVG processing prior to 150.0.7871.47, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome components dealing...

CVE-2026-14027

CVE-2026-14027 describes a use-after-free in Google Chrome's SignIn path prior to version 150.0.7871.47. A remote attacker could lure a user into specific UI gestures to trigger heap corruption via a crafted HTML page. The vulnerability affects Chrome and is mitigated by updating to 150.0.7871.47...

CVE-2026-14032

This CVE affects Google Chrome on macOS, describing a Use-After-Free in Bluetooth that allows code execution when a user is tricked into installing a crafted Chrome Extension. The vulnerable condition is Chrome versions prior to 150.0.7871.47. Impact is arbitrary code execution with high severity...

CVE-2026-14038

CVE-2026-14038 affects Google Chrome’s New Tab Page. The root cause is insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer to potentially escape the sandbox via a crafted HTML page. The vulnerability is addressed in Chrome version 150.0.7871.47 ...

CVE-2026-14040

Summary (concrete details from provided sources): CVE-2026-14040 is a use-after-free in Chrome’s BrowserTag (prior to version 150.0.7871.47). A device exploited by convincing a user to install a malicious extension could trigger heap corruption via the crafted Chrome Extension. This affects Googl...

CVE-2026-14081

CVE-2026-14081 affects Google Chrome DevTools prior to version 150.0.7871.47. The issue is insufficient policy enforcement, enabling an attacker who persuades a user to install a malicious Chrome extension to access potentially sensitive information from process memory via the crafted extension. ...

CVE-2026-14086

The CVE-2026-14086 entry describes a vulnerability in Google Chrome's HID policy enforcement. Affected component: Chrome/Chromium browser handling of HID policy checks. Root cause: insufficient policy enforcement in HID logic allows a remote attacker to run arbitrary code via a crafted HTML page....

CVE-2026-14102

CVE-2026-14102: Use-after-free in Passwords in Google Chrome before 150.0.7871.47 may allow remote heap corruption via a crafted HTML page. Affected: Google Chrome/Chromium Passwords component. Root cause: use-after-free leading to heap corruption. Impact, per CVSS: HIGH for confidentiality, inte...

CVE-2026-14122

The CVE-2026-14122 entry describes an issue in Google Chrome on Windows affecting the WebAppInstalls component of Chromium. The root cause is insufficient validation of untrusted input, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. The vulnerability impacts C...

CVE-2026-14381

CVE-2026-14381 affects Google Chrome’s WebAppInstalls UI. A crafted HTML page can trigger UI spoofing due to an incorrect security UI in WebAppInstalls prior to Chrome 150.0.7871.46. Impact: remote attacker could spoof UI. Mitigation: update to Chrome 150.0.7871.46 or later (Chromium-based). Refe...

CVE-2026-15118

CVE-2026-15118 describes a Use-After-Free in Chrome’s Input component affecting Google Chrome versions prior to 150.0.7871.115. A remote attacker could exploit this via a crafted HTML page to execute arbitrary code within the browser sandbox. The Chrome advisories and related sources confirm the ...

CVE-2026-3536

The CVE-2026-3536 issue is an integer overflow in ANGLE within Google Chrome prior to 145.0.7632.159, allowing a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The vulnerability is rated Critical (NVD/Chrome CVSS 3.1: 8.8) with network attack vector an...

CVE-2026-3538

CVE-2026-3538 : Integer overflow in Skia used by Google Chrome/Chromium prior to 145.0.7632.159 can enable a remote attacker to cause out-of-bounds memory access via a crafted HTML page. Affected software includes Google Chrome (Chromium-based) with Skia. The issue’s root cause is an overflow in ...

CVE-2026-3544

CVE-2026-3544 is a heap buffer overflow in WebCodecs of Google Chrome/Chromium, allowing a remote, unauthenticated attacker to induce an out-of-bounds write via a crafted HTML page. Affected product: Chrome/Chromium’s WebCodecs component; root cause: heap memory overflow. Impact stated as high se...

CVE-2026-5889

CVE-2026-5889 involves a cryptographic flaw in PDFium used by Google Chrome prior to version 147.0.7727.55 that could allow an attacker to read potentially sensitive data from encrypted PDFs via brute-force. The issue is addressed in the Chrome 147 stable update (147.0.7727.55) for Windows, macOS...

CVE-2026-7356

CVE-2026-7356 involves a use-after-free in the Navigation component of Google Chrome, upstream in Chrome’s Chromium code. Affected product: Google Chrome; vulnerable under pre-147.0.7727.138 builds. Root cause: use-after-free in Navigation allegedly allows remote attackers to execute arbitrary co...

CVE-2026-7896

CVE-2026-7896 is a Chrome/Blink vulnerability due to an integer overflow that can lead to heap corruption on a crafted HTML page. The vulnerability affects Blink in Google Chrome versions before 148.0.7778.96. The Chrome 148 stable update lists “Critical CVE-2026-7896: Integer overflow in Blink” ...

CVE-2026-7989

CVE-2026-7989 affects Google Chrome versions prior to 148.0.7778.96 due to insufficient data validation in DataTransfer within the renderer. A remote attacker who has compromised the renderer process could trigger arbitrary read/write via a crafted HTML page. The issue is documented across multip...

CVE-2026-8524

Technical details (affected products, vulnerable components, root cause, or exploitation specifics) are not provided in the supplied documents. Please monitor official advisories for updates.

CVE-2026-8559

Technical details (affected product/component, root cause, impact, or fixes) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2026-8571

CVE-2026-8571 describes an issue in the GPU policy enforcement of Google Chrome on Android, where insufficient enforcement could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability affects Chrome versions pr...

CVE-2026-8585

The CVE-2026-8585 entry describes an out-of-bounds memory read in Chrome on iOS caused by an inappropriate implementation in Media code, exploitable by a remote attacker who already compromises the renderer process. Affected software is Google Chrome for iOS, before version 148.0.7778.168. The de...

CVE-2026-9124

CVE-2026-9124 : In Google Chrome (Chromium-based), there is insufficient validation of untrusted input in Input before version 148.0.7778.179. A remote attacker who compromised the renderer process could leak cross-origin data via a crafted HTML page. The issue is described as Medium severity; co...

CVE-2026-9890

CVE-2026-9890 is a use-after-free in Chrome’s XR component on Windows, prior to version 148.0.7778.216. A renderer process–compromised attacker could potentially escape the Chrome sandbox via a crafted HTML page, as described in multiple sources (EUVD-2026-33185, Red Hat, Debian, NVD). The Chrome...

CVE-2026-9899

Summary of CVE-2026-9899 : A use-after-free in ANGLE within Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is in the ANGLE component of Chromium/Chrome, with an ex...

CVE-2026-9902

CVE-2026-9902 is a use-after-free in the Accessibility component of Google Chrome (Chromium) reported as affecting pre-148.0.7778.216. The issue could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The associated connect...

CVE-2026-9911

CVE-2026-9911 corresponds to an integer overflow in ANGLE used by Google Chrome/Chromium before 148.0.7778.216, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. The issue affects ANGLE within Chromium-based Chrome; impact is described as an out-of-bounds...

CVE-2026-9913

This CVE (CVE-2026-9913) concerns an inappropriate implementation in ANGLE used by Google Chrome. The issue allows a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page in Chrome builds affected by ANGLE, prior to version 148.0.7778.216. Root cause: ANGLE im...

CVE-2026-9944

CVE-2026-9944 : Uninitialized use in ANGLE within Google Chrome/Chromium allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected: ANGLE in Chrome/Chromium prior to 148.0.7778.216. Impact: data leakage; no other impacts confirme...

CVE-2026-9949

CVE-2026-9949 affects Google Chrome on Windows, caused by a use-after-free in the Core component that could allow a remote attacker who compromised the renderer process to escape the sandbox via a crafted HTML page. Affected versions are prior to 148.0.7778.216; remediation is to upgrade to 148.0...

CVE-2025-12440

CVE-2025-12440 affects Google Chrome/Chromium Autofill prior to 142.0.7444.59. A crafted HTML page can leverage an inappropriate Autofill implementation to exfiltrate potentially sensitive data from process memory after convincing a user to perform specific UI gestures. The published data indicat...