CVE-2026-5863

Summary: CVE-2026-5863 is an insecure implementation in the V8 engine of Google Chrome/Chromium prior to 147.0.7727.55 that could allow remote code execution via a crafted HTML page. The current public docs list the issue and indicate high impact, but do not provide exploitation details. Public u...

CVE-2026-10977

CVE-2026-10977 affects Google Chrome on all platforms through versions prior to 149.0.7827.53. The root cause is an uninitialized use in Skia, which, if a rendererProcess is compromised, allows a remote attacker to leak cross-origin data via a crafted HTML page. According to the provided sources,...

CVE-2026-2321

CVE-2026-2321: Use-after-free in Ozone affecting Chromium/Chrome prior to 145.0.7632.75 (as reported with Chrome 145.x). The issue arises from Ozone during UI-related handling, enabling potential heap corruption via a crafted HTML page after user interaction. Fedora advisories show updates to cef...

CVE-2026-3538

CVE-2026-3538 : Integer overflow in Skia used by Google Chrome/Chromium prior to 145.0.7632.159 can enable a remote attacker to cause out-of-bounds memory access via a crafted HTML page. Affected software includes Google Chrome (Chromium-based) with Skia. The issue’s root cause is an overflow in ...

CVE-2026-4455

CVE-2026-4455 describes a heap buffer overflow in PDFium used by Google Chrome, affecting builds prior to 146.0.7680.153. An attacker could trigger heap corruption via a crafted PDF file, enabling remote code execution under the conditions stated (high severity). The public materials consistently...

CVE-2026-4460

CVE-2026-4460 affects Google Chrome (Skia). A memory safety issue in Skia allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page, leading to potential information disclosure. Affected software: Google Chrome prior to version 146.0.7680.153. Root cause: out-of-bou...

CVE-2026-5292

CVE-2026-5292 affects Google Chrome WebCodecs: an out-of-bounds memory read is possible via a crafted HTML page in Chrome versions before 146.0.7680.178. Multiple connected sources (Chromium/Chrome security notes and vendor advisories) corroborate that the WebCodecs component is the vulnerable su...

CVE-2026-7339

CVE-2026-7339 : Heap buffer overflow in WebRTC for Google Chrome (Chrome/Chromium) prior to 147.0.7727.138. Exploitation could enable remote heap corruption via a crafted HTML page. Affected product: Google Chrome (WebRTC component). Underlying cause: heap buffer overflow in WebRTC; impact: poten...

CVE-2026-7999

CVE-2026-7999 affects Google Chrome's V8 engine: an inappropriate implementation allows a remote attacker to read potentially sensitive data from a process's memory via a crafted HTML page. A fix is available in Chrome 148.0.7778.96 and later; update to the patched version. The vulnerability deta...

CVE-2026-8012

CVE-2026-8012 is an issue in Google Chrome’s MHTML handling. The vulnerability stems from an inappropriate MHTML implementation that allows a remote attacker who has compromised the renderer process to inject arbitrary scripts or HTML via a crafted page (UXSS). Affected software is Google Chrome ...

CVE-2026-8558

The CVE-2026-8558 issue affects Google Chrome prior to 148.0.7778.168, in the Fonts component. An out-of-bounds write mishandles memory during font rendering, enabling a remote attacker to run arbitrary code inside the browser sandbox via a crafted HTML page. Remediation: update to Chrome 148.0.7...

CVE-2026-8570

The CVE-2026-8570 entry concerns Google Chrome’s V8 engine. A Type Confusion in V8, affecting Chrome versions prior to 148.0.7778.168, could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. The description does not specify exact vulnerable bu...

CVE-2026-9957

CVE-2026-9957 describes a use-after-free in Google's Chrome PDF handling (Chromium) prior to version 148.0.7778.216. A crafted PDF could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox. The public references confirm the vulnerability in the PDF component of Chromium with...

CVE-2026-9965

CVE-2026-9965 affects Google Chrome (ANGLE component). An out-of-bounds write in ANGLE can allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is rated High severity (CVSS 3.1: 8.8, Network vector, No privileges, User interaction required) and is associat...

CVE-2010-2298

Google Chrome before 5.0.375.70 on Linux is vulnerable due to improper handling of ViewHostMsg_DatabaseOpenFile in chroot-based sandboxing, allowing sandbox bypass via fchdir/chdir. Root cause: database_dispatcher_host.cc in renderer_host. Affected: Chrome versions prior to 5.0.375.70. Mitigation...

CVE-2011-1452

CVE-2011-1452 affects Google Chrome prior to 11.0.696.57. The vulnerability allows a user-assisted attacker to spoof the URL bar via a redirect and a manual reload, enabling potential confusion or phishing-like tricks. The issue is explicitly tied to the URL bar spoofing vector in Chrome’s naviga...

CVE-2011-2782

Google Chrome on Linux (pre-13.0.782.107) is affected by CVE-2011-2782 due to a drag-and-drop file permission handling flaw that could allow a user‑assisted remote attacker to bypass access restrictions via unspecified vectors. The issue is addressed in Chrome 13.0.782.107 (Stable Channel update)...

CVE-2011-2798

CVE-2011-2798 affects Google Chrome before 13.0.782.107, where access to internal schemes is not properly restricted, enabling remote attackers to influence the browser via a crafted website. The available documents confirm the affected product and the root cause (improper restriction of internal...

CVE-2011-3873

The CVE-2011-3873 entry concerns Google Chrome (Oct 2011 era). Description: Chrome before 14.0.835.202 may fail to correctly translate shader code, enabling a remote attacker to execute arbitrary code or cause memory corruption via unspecified vectors. Connected documents confirm Chrome/Chromium-...

CVE-2017-15405

Summary: CVE-2017-15405 describes a local code execution risk in Chrome OS’s cryptohomed due to improper symlink handling and a race in the stateful recovery feature, allowing a local attacker to run arbitrary code via a crafted HTML page on Chrome OS versions prior to 61.0.3163.113. The Chrome O...

CVE-2025-12432

This CVE-2025-12432 describes a race in Google's V8 engine within Chrome prior to version 142.0.7444.59 that could lead to heap corruption via a crafted HTML page. Multiple connected sources corroborate the issue and identify the affected component as Chrome/Chromium’s V8 handling of HTML content...

CVE-2025-13631

CVE-2025-13631 affects Google Chrome on macOS due to an inappropriate implementation in Google Updater, allowing a remote attacker to escalate privileges via a crafted file. Affected version set is Chrome/Chromium prior to 143.0.7499.41; the issue is mitigated by updating to 143.0.7499.41 or late...

CVE-2025-13634

CVE-2025-13634 affects Google Chrome on Windows, due to an inappropriate implementation in Downloads that allows a local attacker to bypass the web security mark via a crafted HTML page. The issue is tied to Chromium/Chrome versions prior to 143.0.7499.41; Debian/Fedora advisories reference Chrom...

CVE-2025-13636

CVE-2025-13636 affects Google Chrome/Chromium Split View. The vulnerability arises from an inappropriate implementation in Split View, enabling UI spoofing via a crafted domain name when a user performs specific UI gestures. Impact is UI spoofing with Low severity; affected products are Chrome/Ch...

CVE-2026-0904

CVE-2026-0904 concerns an incorrect security UI in Digital Credentials in Google Chrome, enabling potential domain spoofing via a crafted HTML page. The issue affects Chrome/Chromium prior to the referenced 144.0.7559.59 baseline. Fedora package updates show chromium/cef builds shipping Chromium ...

CVE-2026-0905

CVE-2026-0905: Insufficient policy enforcement in the Network component of Google Chrome/Chromium before 144.0.7559.59 could let an attacker with access to a network log file potentially obtain sensitive information. Affected software includes Chrome/Chromium builds; CVSS 3.1 metrics indicate Net...

CVE-2026-10005

Google Chrome on macOS is affected by CVE-2026-10005 via a use-after-free in the WebAppInstalls component. The flaw allows a remote attacker to execute arbitrary code if the user is persuaded to perform certain UI gestures on a crafted HTML page; impact is high. A patch exists in Chrome version 1...

CVE-2026-10010

Technical details for CVE-2026-10010 are not publicly provided in the connected documents. Monitor for updates; the materials only reiterate high-level description without specifics (affected components, root cause, impact, or remediation).

CVE-2026-10934

The CVE-2026-10934 entry concerns a use-after-free in Autofill for Google Chrome on Android, prior to version 149.0.7827.53. The underlying issue in the Autofill component could allow a remote attacker who already compromised the renderer process to trigger a sandbox escape via a crafted HTML pag...

CVE-2026-10967

CVE-2026-10967 affects Google Chrome on Android and is due to a use-after-free in SurfaceCapture. A remote attacker who has compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page. The issue is triggered in Chrome versions prior to 149.0.7827.53; the fi...

CVE-2026-10971

CVE-2026-10971 : In Google Chrome on Windows, printing input is insufficiently validated, enabling a remote attacker who compromised the renderer process to escape the sandbox via a crafted HTML page. Affected: Windows builds before 149.0.7827.53. Remediation: update to 149.0.7827.53 or later. Re...

CVE-2026-11041

CVE-2026-11041 affects Google Chrome on Windows and involves insufficient validation of untrusted input in Media, allowing a sandbox escape if a renderer process is compromised. A crafted HTML page could trigger the escape. The vulnerability is tied to Chrome versions prior to 149.0.7827.53; the ...

CVE-2026-11082

CVE-2026-11082 is a race condition in the GPU handling of Google Chrome on Android, where a renderer-process compromise could enable a sandbox escape via a crafted HTML page. Affected software: Google Chrome for Android (pre-149.0.7827.53). Root cause: race in GPU/renderer interaction as describe...

CVE-2026-11084

CVE-2026-11084 affects Google Chrome’s Password Manager. The issue is described as an inappropriate implementation allowing a remote attacker to leak cross-origin data through a crafted HTML page. Affected version range is Chrome prior to 149.0.7827.53. The vulnerability is tied to a Chromium sec...

CVE-2026-11100

Summary (CVE-2026-11100): Use-after-free in the File Input component of Google Chrome on macOS, occurring before Chrome version 149.0.7827.53. The underlying issue is a use-after-free in File Input that can be triggered by a user-via UI gestures and a crafted HTML page, potentially enabling a san...

CVE-2026-11170

CVE-2026-11170 describes an insecure implementation in Chromoting within Google Chrome on Linux, where a remote attacker could achieve OS‑level privilege escalation through malicious network traffic prior to Chrome/Chromium 149.0.7827.53. The issue affects the Chromoting component and is identifi...

CVE-2026-11198

CVE-2026-11198 describes an issue in Google Chrome where insufficient validation of untrusted input in the Codecs component could enable a remote attacker to cause a sandbox escape via a crafted video file. Affected product: Google Chrome (Chromium-based). Root cause: insufficient input validatio...

CVE-2026-11222

This CVE (CVE-2026-11222) affects Google Chrome (Chromium engine) and concerns an incorrect security UI in the Tab Strip that enables domain spoofing via a crafted HTML page. The vulnerability is tied to Chrome versions before 149.0.7827.53. Impact is described as a low-severity Chromium issue wi...

CVE-2026-11236

Technical details for CVE-2026-11236 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-11265

CVE-2026-11265 concerns Google Chrome’s Autofill. The issue is described as an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (Chromium-based), with the fixed/patch version cited as 149.0.7827.5...

CVE-2026-11270

CVE-2026-11270 affects Google Chrome on Android, where an inappropriate UI implementation allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chrome/Chromium UI handling prior to version 149.0.7827.53. Impact is confined to cross-origin data leakage; n...

CVE-2026-11299

CVE-2026-11299 describes an integer overflow in the Fonts component of Google Chrome prior to 149.0.7827.53. A remote attacker could cause memory information disclosure by rendering a crafted HTML page. The issue affects Chrome/Chromium’s font handling and was addressed in the Chrome update refer...

CVE-2026-11304

CVE-2026-11304: Use-after-free in PDFium affecting Google Chrome prior to 149.0.7827.53. A crafted PDF could trigger heap corruption. Impact is tied to PDF rendering in Chrome; mitigation is to update Chrome to the patched build (149.0.7827.53+). If exploitation details are not present in the pro...

CVE-2026-11642

CVE-2026-11642 describes a use-after-free in Google Chrome’s Web Apps renderer that could allow a remote attacker who already compromised the renderer to potentially perform a sandbox escape via a crafted HTML page. Affected product: Chrome (Web Apps) prior to version 149.0.7827.103. Impact : san...

CVE-2026-11648

CVE-2026-11648 is a use-after-free in FullScreen on Windows Chrome prior to 149.0.7827.103, potentially enabling heap corruption via a crafted HTML page. Affected software: Google Chrome (Windows). Root cause: use-after-free in FullScreen path. Impact: remote code execution risk (as implied by he...

CVE-2026-11685

CVE-2026-11685 involves an inappropriate implementation in MediaCapture in Google Chrome on macOS, where versions prior to 149.0.7827.103 allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is scoped to Chrome on Mac and is triggered by processing a crafted HTML p...

CVE-2026-12016

Affected software: Google Chrome (DevTools component). The CVE-2026-12016 entry describes an inappropriate implementation in DevTools that could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Root cause: insufficient inp...

CVE-2026-12028

The CVE-2026-12028 issue affects Google Chrome on Android (before 149.0.7827.115) and is caused by a use-after-free in the GPU code. A compromised renderer process could potentially escape the Chrome sandbox via a crafted HTML page. The connected sources confirm the vulnerability detail and indic...

CVE-2026-12451

CVE-2026-12451 is a use-after-free in Google Chrome’s DigitalCredentials component that could allow a remote attacker who has compromised the renderer process to escape sandbox via a crafted HTML page. Affected product: Google Chrome (Chromium-based) prior to version 149.0.7827.155. The underlyin...

CVE-2026-13026

CVE-2026-13026 is a use-after-free in Digital Credentials in Google Chrome for Mac, triggered by heap corruption via a crafted HTML page. Affected: Chrome on macOS before version 149.0.7827.197. Impact: remote code execution due to severe memory corruption; exploit would require user interaction ...