CVE-2026-14111

Use-after-free in Chrome’s WebProtect feature allows arbitrary code execution when a user is convinced to install a crafted Chrome Extension. Affected: Google Chrome (WebProtect) versions before 150.0.7871.47. Attack chain: attacker coerces user to install a malicious extension, enabling code exe...

CVE-2026-14125

The CVE affects Google Chrome’s ANGLE component in Chromium. Affected: Chrome builds using ANGLE before version 150.0.7871.47. Description indicates an uninitialized use in ANGLE that could let a remote attacker obtain potentially sensitive information from process memory via a crafted HTML page....

CVE-2026-14399

CVE-2026-14399 affects Google Chrome (Dawn) prior to 150.0.7871.46. The issue is an uninitialized-use defect in Dawn that lets a remote attacker extract potentially sensitive data from a process’s memory via a crafted HTML page. The available documents do not specify exact vulnerable products bey...

CVE-2026-15119

CVE-2026-15119 concerns a race condition in Google Chrome’s GetUserMedia that can enable a sandbox escape when an attacker already compromised the renderer process. The vulnerability is associated with Chrome versions prior to 150.0.7871.115, with the 150.0.7871.115 release addressing the issue. ...

CVE-2026-3924

CVE-2026-3924 affects Google Chrome/Chromium: a use-after-free in WindowDialog allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected versions are prior to 146.0.7680.71. Reported impacts align with sandbox escape risk...

CVE-2026-3928

CVE-2026-3928 is a vulnerability in Chromium-based extensions handling in Google Chrome. The issue is insufficient policy enforcement in the Extensions framework, allowing a user-assisted attacker who lures a target to install a malicious extension to perform UI spoofing via the extension. Affect...

CVE-2026-3939

Google Chrome/Chromium is affected by CVE-2026-3939 due to insufficient policy enforcement in PDF handling, allowing a crafted PDF to bypass navigation restrictions. Affected component: PDF policy enforcement in Chrome/Chromium prior to version 146.0.7680.71 (specific fixed versions cited by Debi...

CVE-2026-4455

CVE-2026-4455 describes a heap buffer overflow in PDFium used by Google Chrome, affecting builds prior to 146.0.7680.153. An attacker could trigger heap corruption via a crafted PDF file, enabling remote code execution under the conditions stated (high severity). The public materials consistently...

CVE-2026-5861

CVE-2026-5861 is a use-after-free in Chrome’s V8 engine (prior to 147.0.7727.55) that could allow remote code execution via a crafted HTML page in a sandbox. Public references show Chrome fixed this in version 147.0.7727.55 (and Debian security advisories map this fix to chromium 147.0.7727.55 va...

CVE-2026-5871

CVE-2026-5871 is a Type Confusion in the V8 engine used by Google Chrome/Chromium. The initial description states that older Chrome builds were vulnerable to remote code execution inside the sandbox via a crafted HTML page. Connected sources corroborate involvement of Chromium/Chrome components a...

CVE-2026-5909

CVE-2026-5909 is a Chromium/Chrome media-related vulnerability: an integer overflow in the Media pipeline could enable heap corruption via a crafted video file in versions prior to 147.0.7727.55. Public disclosures and vendor advisories confirm affected product is Chromium/Chrome, with Debian/Fre...

CVE-2026-6297

CVE-2026-6297 is a use-after-free in the Proxy component of Google Chrome fixed in version 147.0.7727.101. The vulnerability could allow a privileged network-position attacker to potentially perform a sandbox escape via a crafted HTML page. The description specifies the affected product as Google...

CVE-2026-6362

CVE-2026-6362 involves a memory safety defect in Google Chrome’s Codecs component (Chromium). A use-after-free in Codecs could enable a remote attacker to cause out-of-bounds memory access by parsing a specially crafted video file. The issue affects Chrome/Chromium releases prior to the patched b...

CVE-2026-7336

CVE-2026-7336 is a use-after-free in WebRTC reported for Google Chrome versions before 147.0.7727.138. The issue allows remote code execution in the sandbox via a crafted HTML page. Affected product: Google Chrome (pre-147.7727.138). Root cause: use-after-free in WebRTC per the sources. Impact: a...

CVE-2026-7342

The CVE-2026-7342 entry corresponds to a use-after-free in WebView used by Google Chrome on Android, fixed in Chrome 147.0.7727.138 and related updates. Technical details across connected advisories confirm the vulnerability affects WebView within Chrome for Android and is tied to a crafted HTML ...

CVE-2026-7920

CVE-2026-7920: Use-after-free in Skia used by Google Chrome prior to 148.0.7778.96. If an attacker compromises the renderer, they could potentially escape the sandbox via a crafted HTML page. The Chrome 148 stable release (148.0.7778.96) includes fixes for this issue among many others.

CVE-2026-7933

CVE-2026-7933 describes an out-of-bounds read in WebCodecs affecting Google Chrome before 148.0.7778.96. A remote attacker could trigger memory read via a crafted video file. The issue is mitigated by updating to version 148.0.7778.96 or later. Connected sources from NVD, Debian OSV, ENISA EUVD, ...

CVE-2026-7951

CVE-2026-7951 concerns an out-of-bounds write in WebRTC in Google Chrome prior to 148.0.7778.96. The described impact is remote code execution inside the Chrome sandbox via a crafted HTML page. The vulnerability affects Google Chrome’s WebRTC component; the root cause is an out-of-bounds write th...

CVE-2026-7954

CVE-2026-7954 describes a race condition in Chrome’s Shared Storage. A remote attacker who already compromised the renderer process could leak cross-origin data via a crafted HTML page. Affected software is Google Chrome versions prior to 148.0.7778.96. The issue is fixed in Chrome 148.0.7778.96 ...

CVE-2026-7959

CVE-2026-7959 affects Google Chrome prior to 148.0.7778.96. The vulnerability is described as an Inappropriate implementation in Navigation that could allow a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Connected sources (DEBIAN-CVE-2...

CVE-2026-8531

CVE-2026-8531 describes a heap buffer overflow in WebML within Google Chrome on Windows, affecting builds prior to 148.0.7778.168. The underlying issue allows a remote attacker to potentially cause heap corruption by processing a crafted HTML page. Reported impact is high (CVSS 3.1: 8.8, Network ...

CVE-2026-8573

Google Chrome on Windows is affected by CVE-2026-8573 due to an integer overflow in Codecs, enabling a remote attacker to potentially escape the sandbox via a crafted video file. Affected versions are Windows builds prior to 148.0.7778.168; remediation is to update to 148.0.7778.168 or newer. Chr...

CVE-2026-9895

CVE-2026-9895 is a GPU-related out-of-bounds read in the Chromium-based Google Chrome browser. The vulnerability affects the GPU component and was exploitable by a renderer process compromise via a crafted HTML page, potentially enabling a sandbox escape. Affected versions are Chrome prior to 148...

CVE-2026-9909

The CVE-2026-9909 issue is an integer overflow in Skia used by Google Chrome, leading to remote code execution if a renderer process is compromised via a crafted HTML page. Affected software is Chrome (Skia) prior to 148.0.7778.216. Impact described as arbitrary code execution inside the sandbox ...

CVE-2026-9939

CVE-2026-9939 is a heap buffer overflow in the WebCodecs component of Google Chrome prior to 148.0.7778.216. The issue enables a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. Root cause: a heap buffer overflow in WebCodecs. Affected product/version: Go...

CVE-2026-9941

The CVE-2026-9941 entry describes a Use-After-Free vulnerability in ANGLE within Google Chrome (Chromium) prior to version 148.0.7778.216. The issue allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected component: ANGLE in Chromium-based Ch...

CVE-2026-9968

CVE-2026-9968 describes an integer overflow in V8 of Google Chrome, affecting versions prior to 148.0.7778.216. This could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Connected documents confirm the issue and cite upstream Chromium trackin...

CVE-2026-9970

The CVE-2026-9970 entry concerns a use-after-free in WebGL in Google Chrome’s Chromium-based renderer, leading to a potential sandbox escape via a crafted HTML page. Affected component: WebGL within the Chromium browser; root cause: use-after-free in the WebGL path (renderer process). Impact: rem...

CVE-2026-9989

The CVE-2026-9989 entry concerns Google Chrome’s Media component, with an inappropriate implementation that allowed a remote attacker to bypass the same-origin policy via a crafted video file. Affected software is Google Chrome prior to 148.0.7778.216; impact is the bypass of SOP, as described in...

CVE-2026-10006

CVE-2026-10006 affects Google Chrome’s WebAudio component in Chromium before 148.0.7778.216. A race condition in WebAudio could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The issue is labeled high severity with network attack vector, requ...

CVE-2026-10011

CVE-2026-10011 concerns an inappropriate implementation in the Skia component of Google Chrome before 148.0.7778.216, where a remote attacker who already had renderer access could leak cross-origin data via a crafted HTML page. The issue is tied to the Skia/Chromium stack and is described in mult...

CVE-2026-10913

CVE-2026-10913 : Use-after-free in ANGLE (Google Chrome on Windows) prior to 149.0.7827.53. An attacker could trigger arbitrary code execution in the sandbox via a crafted HTML page. The Chrome 149 stable update (Windows/macOS/Linux) includes fixes for this and other ANGLE-related issues, with CV...

CVE-2026-10930

CVE-2026-10930 describes an out-of-bounds read in ANGLE used by Google Chrome on macOS, exploitable via a crafted HTML page. The issue affects Chrome on Mac prior to version 149.0.7827.53, with the underlying cause being an out-of-bounds memory read in ANGLE. The vulnerability is rated high sever...

CVE-2026-10935

CVE-2026-10935: Type Confusion in Google Chrome’s V8 engine (Chromium) prior to 149.0.7827.53. A crafted HTML page enables a remote attacker to execute arbitrary code inside the sandbox. Affected product: Google Chrome/Chromium with V8. Root cause: type confusion in V8. Impact: remote code execut...

CVE-2026-10940

CVE-2026-10940 describes a race in the Codecs component of Google Chrome on Windows, prior to version 149.0.7827.53. A remote attacker who compromises the renderer could potentially escape the sandbox via a crafted HTML page. Affected product: Chrome/Chromium codecs subsystem; Root cause: race co...

CVE-2026-10941

CVE-2026-10941: Out-of-bounds memory access in Skia used by Google Chrome before version 149.0.7827.53 enables a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High. Affected software: Google Chrome (Skia component). Root cause: memory access outsi...

CVE-2026-10946

CVE-2026-10946 is a heap-buffer-overflow in Chrome's Media stack, fixed in Chrome 149.0.7827.53. The vulnerability could allow remote code execution inside a sandbox when a user is convinced to perform specific UI gestures on a crafted HTML page. Affected product: Google Chrome (pre-149.0.7827.53...

CVE-2026-10952

Chrome for iOS is affected by a use-after-free causing heap corruption via a crafted HTML page. Affected product/version: Google Chrome on iOS prior to 149.0.7827.53. Impact: remote attacker could potentially exploit the heap corruption. Severity: High (CVSS 3.1 base 8.8). Mitigation: update to v...

CVE-2026-10969

CVE-2026-10969 describes insufficient input validation in Google Chrome extensions, allowing a remote attacker who has compromised the renderer process to escalate privileges via a crafted HTML page. Affected software: Google Chrome extensions (pre-149.0.7827.53). Root cause: untrusted input not ...

CVE-2026-10992

CVE-2026-10992 affects Google Chrome (Chromium-based) prior to 149.0.7827.53, where insufficient data validation in the Animation component may allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability is linked to the Chrom...

CVE-2026-10994

CVE-2026-10994 affects Google Chrome (ANGLE) with an uninitialized use in ANGLE. A remote attacker could read potentially sensitive data from process memory via a crafted HTML page. Exploitation context is web content; impact is confidential data exposure. The issue has been addressed in Chrome r...

CVE-2026-11032

CVE-2026-11032 affects Google Chrome's Password Manager. The issue stems from an inappropriate implementation in the Password Manager prior to Chrome 149.0.7827.53, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The documented impact is cross-origin data exposure (C...

CVE-2026-11045

CVE-2026-11045 describes an vulnerability in Google Chrome's GPU pathway where there is insufficient validation of untrusted input in the GPU stack. A remote attacker who already compromised the renderer process could read potentially sensitive data from process memory by presenting a crafted HTM...

CVE-2026-11057

Technical details are not publicly available in the provided documents. No specifics on affected components, versions beyond Chrome prior to 149.0.7827.53, or remediation are included. Monitor for updates from official advisories.

CVE-2026-11079

CVE-2026-11079 concerns Google Chrome’s Codecs. The issue is caused by insufficient validation of untrusted input in codecs, enabling a remote attacker to trigger an out-of-bounds memory write via a crafted video file. Affected product: Google Chrome (before 149.0.7827.53). The impact, as describ...

CVE-2026-11086

Summary: CVE-2026-11086 describes an insecure implementation in Chrome’s Dawn component that allowed a remote attacker who had already compromised the renderer process to run arbitrary code inside the Chromium sandbox via a crafted HTML page. Affected software: Google Chrome (Dawn) prior to versi...

CVE-2026-11102

CVE-2026-11102 affects Google Chrome’s Isolated Web Apps in Chromium-based builds, where an inappropriate implementation allowed a remote attacker to run arbitrary code inside a sandbox via a malicious file. The vulnerability is tied to Chrome/Chromium prior to version 149.0.7827.53. The impact i...

CVE-2026-11117

CVE-2026-11117 is a use-after-free in the Views component of Google Chrome on Windows, prior to version 149.0.7827.53. The vulnerability allows a remote attacker to trigger arbitrary code execution by presenting a crafted HTML page. The underlying issue is a use-after-free flaw in the Views handl...

CVE-2026-11123

CVE-2026-11123 concerns an Uninitialized Use in ANGLE within Google Chrome/Chromium prior to version 149.0.7827.53. The issue could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page (impact: information disclosure). Connected documents...

CVE-2026-11129

This CVE concerns Google Chrome Extensions with an inappropriate implementation in Chrome prior to 149.0.7827.53. The issue allows a remote attacker to leak cross-origin data through a crafted HTML page, as described (Chromium security severity: Medium). Affected product: Chrome (Extensions compo...