CVE-2026-4455

CVE-2026-4455 describes a heap buffer overflow in PDFium used by Google Chrome, affecting builds prior to 146.0.7680.153. An attacker could trigger heap corruption via a crafted PDF file, enabling remote code execution under the conditions stated (high severity). The public materials consistently...

CVE-2026-8012

CVE-2026-8012 is an issue in Google Chrome’s MHTML handling. The vulnerability stems from an inappropriate MHTML implementation that allows a remote attacker who has compromised the renderer process to inject arbitrary scripts or HTML via a crafted page (UXSS). Affected software is Google Chrome ...

CVE-2026-14091

The CVE-2026-14091 entry documents a use-after-free in Chrome’s DevTools before version 150.0.7871.47. The underlying issue is in DevTools handling, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected software is Google Chrome (DevTools componen...

CVE-2026-14099

CVE-2026-14099 affects Chrome for iOS (Google Chrome on iOS) prior to version 150.0.7871.47. The issue is a use-after-free in the browser, potentially allowing heap corruption when a user is induced to perform specific UI gestures via a crafted HTML page. The problem is rooted in Chrome/Chromium ...

CVE-2026-14409

CVE-2026-14409 affects the Chrome V8 engine prior to 150.0.7871.46. Affected component: V8 in Google Chrome. Root cause: inappropriate implementation allowing a remote attacker to execute arbitrary code inside a sandbox when a user is tricked into performing specific UI gestures on a crafted HTML...

CVE-2026-14416

CVE-2026-14416 affects Dawn in Google Chrome (Chromium-based) with an out-of-bounds read that could allow a remote attacker to potentially escape the sandbox via a crafted HTML page. The description specifies the vulnerable state as Chrome prior to version 150.0.7871.46. No exploitation status is...

CVE-2026-15768

CVE-2026-15768 affects Google Chrome’s HTML-in-Canvas: insufficient policy enforcement could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is tied to Chrome prior to version 150.0.7871.125. A Chromium security advisory confirms this CVE among 15 fixes...

CVE-2026-17715

CVE-2026-17715 concerns Google Chrome Passwords with an inappropriate implementation in Chrome prior to 151.0.7922.72. The flaw allows a remote attacker, via a crafted HTML page and specific UI gestures, to leak cross-origin data. Chromuim security severity is reported as High. The issue affects ...

CVE-2026-17771

The CVE-2026-17771 issue is an uninitialized-use flaw in the Skia component of Google Chrome/Chromium, affecting Chrome versions prior to 151.0.7922.72. The flaw can allow a remote attacker to leak cross-origin data via a crafted HTML page. Upstream reference: Chromium issue 513160525. Remediatio...

CVE-2026-17776

CVE-2026-17776 is a policy-bypass in the Receiver component of Google Chrome prior to 151.0.7922.72. A remote attacker who has already compromised the renderer could potentially perform a sandbox escape via a crafted HTML page, as described in upstream/ vendor advisories. The core issue involves ...

CVE-2026-17781

CVE-2026-17781 describes an inappropriate implementation in Chrome’s Extensions component (Chromium) that could allow a user-interaction-required attacker who tricks a user into installing a malicious extension to leak cross-origin data via the extension. Upstream details reference Chromium issue...

CVE-2026-17820

CVE-2026-17820 affects Google Chrome's Autofill component. The issue is caused by insufficient policy enforcement, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions are Chrome prior to 151.0.7922.72; the advisory and linked updates suggest upgrading t...

CVE-2026-17839

In CVE-2026-17839, an inappropriate implementation in Chrome for iOS (Google Chrome on iOS) prior to version 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. This vulnerability affects Chrome for iOS on iPhone/iPad and is classified with a Medium severity (C...

CVE-2026-17878

In Google Chrome/Chromium, CVE-2026-17878 is due to an inappropriate implementation in the CSS component, enabling UXSS via a crafted HTML page. Affected versions are before 151.0.7922.72, with the issue classified as Medium severity. Upstream reference: Chromium issue 522781838. Remediation is t...

CVE-2026-17918

The CVE-2026-17918 entry refers to a Use-After-Free in Sync within Google Chrome, fixed in versions before 151.0.7922.72 (i.e., patched in 151.0.7922.72). The vulnerability allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected component: Ch...

CVE-2026-17923

CVE-2026-17923 affects Google Chrome (Enterprise) before 151.0.7922.72. The issue is a policy/navigation bypass triggered by a crafted domain name, enabling a remote attacker to bypass navigation restrictions. The Chromium-based description notes a low severity (from core descriptions). Mitigatio...

CVE-2026-5273

Concrete details found: CVE-2026-5273 is a use-after-free in CSS handling in Google Chrome prior to 146.0.7680.178, allowing remote code execution inside the sandbox via a crafted HTML page. The issue affects Chrome/Chromium CSS processing and is addressed by the Chrome update to 146.0.7680.178 (...

CVE-2026-5863

Summary: CVE-2026-5863 is an insecure implementation in the V8 engine of Google Chrome/Chromium prior to 147.0.7727.55 that could allow remote code execution via a crafted HTML page. The current public docs list the issue and indicate high impact, but do not provide exploitation details. Public u...

CVE-2026-8509

Technical details for CVE-2026-8509 are not publicly available in the provided documents. Monitor for updates from official advisories; no specifics on affected product versions, root cause, exploit status, or fixes are included here.

CVE-2026-8558

The CVE-2026-8558 issue affects Google Chrome prior to 148.0.7778.168, in the Fonts component. An out-of-bounds write mishandles memory during font rendering, enabling a remote attacker to run arbitrary code inside the browser sandbox via a crafted HTML page. Remediation: update to Chrome 148.0.7...

CVE-2026-9899

Summary of CVE-2026-9899 : A use-after-free in ANGLE within Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is in the ANGLE component of Chromium/Chrome, with an ex...

CVE-2026-9913

This CVE (CVE-2026-9913) concerns an inappropriate implementation in ANGLE used by Google Chrome. The issue allows a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page in Chrome builds affected by ANGLE, prior to version 148.0.7778.216. Root cause: ANGLE im...

CVE-2026-9930

CVE-2026-9930 affects the Dawn component of Google Chrome on macOS. A crafted HTML page can trigger an out-of-bounds write in Dawn, allowing a remote attacker to perform an out-of-bounds memory write. The issue is tied to Chrome versions before 148.0.7778.216. No exploitation details are provided...

CVE-2010-4041

CVE-2010-4041 : Google Chrome on Linux prior to 7.0.517.41 contains a sandbox flaw in the worker process isolation, which may allow remote attackers to bypass access restrictions via unspecified vectors. The issue affects the Chrome sandbox implementation and is described as potentially enabling ...

CVE-2011-2796

The CVE-2011-2796 entry concerns a Use-after-free vulnerability in Skia used by Google Chrome prior to version 13.0.782.107. The underlying issue is in Skia, and the impact is described as a remote cause for a denial of service or possibly other unspecified effects via unknown vectors. The affect...

CVE-2011-3882

CVE-2011-3882: A use-after-free in Google Chrome before 15.0.874.102 affects media buffers, enabling remote DoS and possibly other impact. Affected product: Google Chrome; vulnerable component is the media buffer handling. Remediation: upgrade to Chrome 15.0.874.102 or later (per Gentoo GLSA 2011...

CVE-2025-11756

Use-after-free in Safe Browsing of Google Chrome/Chromium prior to 141.0.7390.107 allowed a remote attacker with renderer access to potentially cause out-of-bounds memory access. Affected: Chromium-based Chrome/Chromium builds; vulnerability severity high. Remediation: upgrade to 141.0.7390.107 o...

CVE-2025-8882

CVE-2025-8882 is a use-after-free in Aura within Chromium-based Google Chrome, affected up to version 139.0.7258.127. The underlying issue is a use-after-free that could allow heap corruption when a user is enticed to perform specific UI gestures via a crafted HTML page. The vulnerability is tied...

CVE-2026-0904

CVE-2026-0904 concerns an incorrect security UI in Digital Credentials in Google Chrome, enabling potential domain spoofing via a crafted HTML page. The issue affects Chrome/Chromium prior to the referenced 144.0.7559.59 baseline. Fedora package updates show chromium/cef builds shipping Chromium ...

CVE-2026-10912

CVE-2026-10912 affects Google Chrome extensions. The issue is caused by insufficient validation of untrusted input in Extensions, allowing a remote attacker who has compromised the renderer process to bypass the same-origin policy via a crafted HTML page. The vulnerability is tied to Chrome versi...

CVE-2026-10921

This CVE affects Google Chrome (Dawn component) prior to version 149.0.7827.53. An integer overflow in the Dawn renderer could allow a remote attacker who already gained renderer access to escape the sandbox via a crafted HTML page. The documented impact is a high-severity sandbox escape with lik...

CVE-2026-10989

CVE-2026-10989 affects Google Chrome’s V8 engine prior to version 149.0.7827.53 . The weakness stems from an inappropriate implementation in V8 , allowing a remote attacker to potentially exploit a heap corruption vulnerability via a crafted HTML page after convincing a user to perform specific U...

CVE-2026-11016

CVE-2026-11016: Insufficient validation of untrusted input in Network in Google Chrome (Chromium-based) prior to 149.0.7827.53 allows a renderer-compromised attacker to bypass the same-origin policy via a crafted HTML page. Publicly referenced disclosures include Debian/openSUSE advisories and Ch...

CVE-2026-11021

CVE-2026-11021 : Concrete details across connected docs show that in Google Chrome on Windows prior to 149.0.7827.53, the GPU component suffers from insufficient validation of untrusted input, potentially enabling a remote attacker who has compromised the renderer process to escape the sandbox vi...

CVE-2026-11024

CVE-2026-11024: A stack buffer overflow in Skia used by Google Chrome/Chromium prior to 149.0.7827.53 allows remote exploitation via a crafted HTML page, potentially causing stack corruption. Multiple connected sources confirm affected components and versions (Chromium/Skia, Chrome upstream), wit...

CVE-2026-11027

Affected product: Google Chrome (Chromium-based renderer). Vulnerable component: Glic in the renderer process. Root cause: insufficient validation of untrusted input. Impact: remote attacker who already compromised the renderer can leak cross-origin data via a crafted HTML page (Medium severity; ...

CVE-2026-11048

CVE-2026-11048 affects Google Chrome extensions; root cause is an inappropriate implementation in Chrome’s Extensions that allows bypassing the same-origin policy via a crafted extension. Impact is partial (I) as per CVSS, with no confidentiality loss and high integrity impact. Affected component...

CVE-2026-11056

CVE-2026-11056 affects Google Chrome on Windows, in the Site Isolation feature. The vulnerability stems from insufficient validation of untrusted input, allowing a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The issue is linked to Chrome versions prior...

CVE-2026-11078

CVE-2026-11078 affects Google Chrome’s file system handling. The vulnerability arises from an inappropriate/file-system implementation in Chrome prior to version 149.0.7827.53, which could let a remote attacker who has compromised the renderer process bypass the same-origin policy via a crafted H...

CVE-2026-11101

CVE-2026-11101 concerns an uninitialized use in Dawn within Google Chrome on Windows prior to 149.0.7827.53, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chromium-based (Chrome/Edge), with the root cause described as an uninitialized use in th...

CVE-2026-11104

CVE-2026-11104 affects Google Chrome (and Chromium-based Edge) via an uninitialized use in ANGLE. The vulnerability permits a remote attacker who has already compromised the renderer process to potentially read sensitive data from process memory through a crafted HTML page. Affected version famil...

CVE-2026-11116

This CVE (CVE-2026-11116) affects Chromoting in Google Chrome before version 149.0.7827.53. The underlying issue is a use-after-free defect in Chromoting, allowing a remote attacker to execute arbitrary code via malicious network traffic. The Microsoft/MSRC and EU/national advisories align on the...

CVE-2026-11124

CVE-2026-11124 is a heap buffer overflow in Skia used by Chromium/Google Chrome prior to version 149.0.7827.53. According to connected advisories, a remote attacker could exploit this via a crafted HTML page to potentially achieve arbitrary code execution or heap corruption. Mitigations are provi...

CVE-2026-11137

CVE-2026-11137 is an uninitialized-use flaw in ANGLE within Google Chrome prior to 149.0.7827.53, allowing a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affected component: ANGLE in Chromium-based Chrome; root cause: uninitialized memor...

CVE-2026-11204

CVE-2026-11204 describes an inappropriate implementation in the Signin flow of Google Chrome on iOS before 149.0.7827.53 that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is in the Chromium-based iOS Signin function, with a Network attack v...

CVE-2026-11214

CVE-2026-11214 affects Chrome for iOS (Google Chrome on iOS) due to an inappropriate implementation. On versions prior to 149.0.7827.53, a remote attacker could leak cross-origin data via a crafted HTML page. Severity is Medium (CVSS base 6.5). Remediation: update to 149.0.7827.53 or later. If de...

CVE-2026-11218

CVE-2026-11218 affects Google Chrome on Windows prior to 149.0.7827.53. The root cause is an inappropriate implementation in PlatformIntegration, enabling a remote attacker to trigger arbitrary code execution when a user is persuaded to perform specific UI gestures with a malicious file. This is ...

CVE-2026-11221

Affected software: Google Chrome. Vulnerable component: PointerLock (Chromium). Root cause: insufficient validation of untrusted input. Impact: remote attacker with renderer access can spoof UI via crafted HTML page (Low severity). Affected versions: Chrome prior to 149.0.7827.53. Exploitation co...

CVE-2026-11225

CVE-2026-11225 affects Google Chrome WebUI prior to 149.0.7827.53, due to an inappropriate implementation in the WebUI component. The issue allows a remote attacker to perform domain spoofing via a crafted domain name. The vulnerability is categorized as Low severity (Chromium), with an exploit v...

CVE-2026-11240

CVE-2026-11240 affects Google Chrome (Loader) with insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. The issue is described for Chrome versions prior to 149.0.7827.53; exploitation deta...