CVE-2026-17777

CVE-2026-17777: Google Chrome autofill in Chromium-based builds prior to 151.0.7922.72 allows a remote attacker to leak cross-origin data via a crafted HTML page. Impact is MEDIUM (CVSS 3.1: 4.3). Attack vector: NETWORK; privileges: NONE; user interaction required; scope: UNCHANGED; confidentiali...

CVE-2026-17781

CVE-2026-17781 describes an inappropriate implementation in Chrome’s Extensions component (Chromium) that could allow a user-interaction-required attacker who tricks a user into installing a malicious extension to leak cross-origin data via the extension. Upstream details reference Chromium issue...

CVE-2026-17806

CVE-2026-17806 : Insufficient validation of untrusted input in the Extensions component of Google Chrome/Chromium allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Affected product: Google Chrome (Extensions). Upstr...

CVE-2026-17820

CVE-2026-17820 affects Google Chrome's Autofill component. The issue is caused by insufficient policy enforcement, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions are Chrome prior to 151.0.7922.72; the advisory and linked updates suggest upgrading t...

CVE-2026-17835

CVE-2026-17835: In Chrome for iOS, Google Chrome on iOS versions before 151.0.7922.72 are vulnerable to UI spoofing via a crafted HTML page. Affected: Chrome for iOS (iOS builds using Chromium). Root cause: Inappropriate implementation within Chrome for iOS leading to spoofed UI. Impact: potentia...

CVE-2026-17839

In CVE-2026-17839, an inappropriate implementation in Chrome for iOS (Google Chrome on iOS) prior to version 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. This vulnerability affects Chrome for iOS on iPhone/iPad and is classified with a Medium severity (C...

CVE-2026-17878

In Google Chrome/Chromium, CVE-2026-17878 is due to an inappropriate implementation in the CSS component, enabling UXSS via a crafted HTML page. Affected versions are before 151.0.7922.72, with the issue classified as Medium severity. Upstream reference: Chromium issue 522781838. Remediation is t...

CVE-2026-17918

The CVE-2026-17918 entry refers to a Use-After-Free in Sync within Google Chrome, fixed in versions before 151.0.7922.72 (i.e., patched in 151.0.7922.72). The vulnerability allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected component: Ch...

CVE-2026-17923

CVE-2026-17923 affects Google Chrome (Enterprise) before 151.0.7922.72. The issue is a policy/navigation bypass triggered by a crafted domain name, enabling a remote attacker to bypass navigation restrictions. The Chromium-based description notes a low severity (from core descriptions). Mitigatio...

CVE-2026-5273

Concrete details found: CVE-2026-5273 is a use-after-free in CSS handling in Google Chrome prior to 146.0.7680.178, allowing remote code execution inside the sandbox via a crafted HTML page. The issue affects Chrome/Chromium CSS processing and is addressed by the Chrome update to 146.0.7680.178 (...

CVE-2026-8509

Technical details for CVE-2026-8509 are not publicly available in the provided documents. Monitor for updates from official advisories; no specifics on affected product versions, root cause, exploit status, or fixes are included here.

CVE-2026-9899

Summary of CVE-2026-9899 : A use-after-free in ANGLE within Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is in the ANGLE component of Chromium/Chrome, with an ex...

CVE-2026-9913

This CVE (CVE-2026-9913) concerns an inappropriate implementation in ANGLE used by Google Chrome. The issue allows a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page in Chrome builds affected by ANGLE, prior to version 148.0.7778.216. Root cause: ANGLE im...

CVE-2026-9930

CVE-2026-9930 affects the Dawn component of Google Chrome on macOS. A crafted HTML page can trigger an out-of-bounds write in Dawn, allowing a remote attacker to perform an out-of-bounds memory write. The issue is tied to Chrome versions before 148.0.7778.216. No exploitation details are provided...

CVE-2026-9954

CVE-2026-9954 affects Google Chrome (Chromium TabStrip). A use-after-free in the TabStrip component prior to version 148.0.7778.216 allows a remote attacker to trigger heap corruption by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability is documented acro...

CVE-2010-4041

CVE-2010-4041 : Google Chrome on Linux prior to 7.0.517.41 contains a sandbox flaw in the worker process isolation, which may allow remote attackers to bypass access restrictions via unspecified vectors. The issue affects the Chrome sandbox implementation and is described as potentially enabling ...

CVE-2011-2796

The CVE-2011-2796 entry concerns a Use-after-free vulnerability in Skia used by Google Chrome prior to version 13.0.782.107. The underlying issue is in Skia, and the impact is described as a remote cause for a denial of service or possibly other unspecified effects via unknown vectors. The affect...

CVE-2011-3882

CVE-2011-3882: A use-after-free in Google Chrome before 15.0.874.102 affects media buffers, enabling remote DoS and possibly other impact. Affected product: Google Chrome; vulnerable component is the media buffer handling. Remediation: upgrade to Chrome 15.0.874.102 or later (per Gentoo GLSA 2011...

CVE-2025-11756

Use-after-free in Safe Browsing of Google Chrome/Chromium prior to 141.0.7390.107 allowed a remote attacker with renderer access to potentially cause out-of-bounds memory access. Affected: Chromium-based Chrome/Chromium builds; vulnerability severity high. Remediation: upgrade to 141.0.7390.107 o...

CVE-2025-8882

CVE-2025-8882 is a use-after-free in Aura within Chromium-based Google Chrome, affected up to version 139.0.7258.127. The underlying issue is a use-after-free that could allow heap corruption when a user is enticed to perform specific UI gestures via a crafted HTML page. The vulnerability is tied...

CVE-2026-10912

CVE-2026-10912 affects Google Chrome extensions. The issue is caused by insufficient validation of untrusted input in Extensions, allowing a remote attacker who has compromised the renderer process to bypass the same-origin policy via a crafted HTML page. The vulnerability is tied to Chrome versi...

CVE-2026-10921

This CVE affects Google Chrome (Dawn component) prior to version 149.0.7827.53. An integer overflow in the Dawn renderer could allow a remote attacker who already gained renderer access to escape the sandbox via a crafted HTML page. The documented impact is a high-severity sandbox escape with lik...

CVE-2026-10968

CVE-2026-10968 affects Google Chrome on Windows, specifically Dawn, with insufficient validation of untrusted input. The underlying issue allows a remote attacker who has compromised theRenderer process to leak cross-origin data through a crafted HTML page. Affected version range is before Chrome...

CVE-2026-10989

CVE-2026-10989 affects Google Chrome’s V8 engine prior to version 149.0.7827.53 . The weakness stems from an inappropriate implementation in V8 , allowing a remote attacker to potentially exploit a heap corruption vulnerability via a crafted HTML page after convincing a user to perform specific U...

CVE-2026-11016

CVE-2026-11016: Insufficient validation of untrusted input in Network in Google Chrome (Chromium-based) prior to 149.0.7827.53 allows a renderer-compromised attacker to bypass the same-origin policy via a crafted HTML page. Publicly referenced disclosures include Debian/openSUSE advisories and Ch...

CVE-2026-11021

CVE-2026-11021 : Concrete details across connected docs show that in Google Chrome on Windows prior to 149.0.7827.53, the GPU component suffers from insufficient validation of untrusted input, potentially enabling a remote attacker who has compromised the renderer process to escape the sandbox vi...

CVE-2026-11024

CVE-2026-11024: A stack buffer overflow in Skia used by Google Chrome/Chromium prior to 149.0.7827.53 allows remote exploitation via a crafted HTML page, potentially causing stack corruption. Multiple connected sources confirm affected components and versions (Chromium/Skia, Chrome upstream), wit...

CVE-2026-11027

Affected product: Google Chrome (Chromium-based renderer). Vulnerable component: Glic in the renderer process. Root cause: insufficient validation of untrusted input. Impact: remote attacker who already compromised the renderer can leak cross-origin data via a crafted HTML page (Medium severity; ...

CVE-2026-11048

CVE-2026-11048 affects Google Chrome extensions; root cause is an inappropriate implementation in Chrome’s Extensions that allows bypassing the same-origin policy via a crafted extension. Impact is partial (I) as per CVSS, with no confidentiality loss and high integrity impact. Affected component...

CVE-2026-11056

CVE-2026-11056 affects Google Chrome on Windows, in the Site Isolation feature. The vulnerability stems from insufficient validation of untrusted input, allowing a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The issue is linked to Chrome versions prior...

CVE-2026-11078

CVE-2026-11078 affects Google Chrome’s file system handling. The vulnerability arises from an inappropriate/file-system implementation in Chrome prior to version 149.0.7827.53, which could let a remote attacker who has compromised the renderer process bypass the same-origin policy via a crafted H...

CVE-2026-11101

CVE-2026-11101 concerns an uninitialized use in Dawn within Google Chrome on Windows prior to 149.0.7827.53, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chromium-based (Chrome/Edge), with the root cause described as an uninitialized use in th...

CVE-2026-11104

CVE-2026-11104 affects Google Chrome (and Chromium-based Edge) via an uninitialized use in ANGLE. The vulnerability permits a remote attacker who has already compromised the renderer process to potentially read sensitive data from process memory through a crafted HTML page. Affected version famil...

CVE-2026-11116

This CVE (CVE-2026-11116) affects Chromoting in Google Chrome before version 149.0.7827.53. The underlying issue is a use-after-free defect in Chromoting, allowing a remote attacker to execute arbitrary code via malicious network traffic. The Microsoft/MSRC and EU/national advisories align on the...

CVE-2026-11124

CVE-2026-11124 is a heap buffer overflow in Skia used by Chromium/Google Chrome prior to version 149.0.7827.53. According to connected advisories, a remote attacker could exploit this via a crafted HTML page to potentially achieve arbitrary code execution or heap corruption. Mitigations are provi...

CVE-2026-11137

CVE-2026-11137 is an uninitialized-use flaw in ANGLE within Google Chrome prior to 149.0.7827.53, allowing a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affected component: ANGLE in Chromium-based Chrome; root cause: uninitialized memor...

CVE-2026-11204

CVE-2026-11204 describes an inappropriate implementation in the Signin flow of Google Chrome on iOS before 149.0.7827.53 that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is in the Chromium-based iOS Signin function, with a Network attack v...

CVE-2026-11214

CVE-2026-11214 affects Chrome for iOS (Google Chrome on iOS) due to an inappropriate implementation. On versions prior to 149.0.7827.53, a remote attacker could leak cross-origin data via a crafted HTML page. Severity is Medium (CVSS base 6.5). Remediation: update to 149.0.7827.53 or later. If de...

CVE-2026-11218

CVE-2026-11218 affects Google Chrome on Windows prior to 149.0.7827.53. The root cause is an inappropriate implementation in PlatformIntegration, enabling a remote attacker to trigger arbitrary code execution when a user is persuaded to perform specific UI gestures with a malicious file. This is ...

CVE-2026-11221

Affected software: Google Chrome. Vulnerable component: PointerLock (Chromium). Root cause: insufficient validation of untrusted input. Impact: remote attacker with renderer access can spoof UI via crafted HTML page (Low severity). Affected versions: Chrome prior to 149.0.7827.53. Exploitation co...

CVE-2026-11225

CVE-2026-11225 affects Google Chrome WebUI prior to 149.0.7827.53, due to an inappropriate implementation in the WebUI component. The issue allows a remote attacker to perform domain spoofing via a crafted domain name. The vulnerability is categorized as Low severity (Chromium), with an exploit v...

CVE-2026-11240

CVE-2026-11240 affects Google Chrome (Loader) with insufficient validation of untrusted input, allowing a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. The issue is described for Chrome versions prior to 149.0.7827.53; exploitation deta...

CVE-2026-11269

CVE-2026-11269 involves an inappropriate implementation in Google Chrome extensions that allows an attacker with a privileged network position to run arbitrary code in the sandbox via a crafted extension. Affected product: Google Chrome (Extensions component). Root cause: inappropriate extension ...

CVE-2026-11275

CVE-2026-11275 affects Google Chrome on Android (pre-149.0.7827.53) where an inappropriate Page Info implementation could allow a renderer-compromised remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is tied to the Page Info handling in Chromium/Chrome; the des...

CVE-2026-11279

CVE-2026-11279 affects Google Chrome DevTools; an out-of-bounds read in DevTools could allow a remote attacker to run arbitrary code inside the browser sandbox via a crafted HTML page. Affected version range is Chrome versions before 149.0.7827.53. The issue is described with Chromium security se...

CVE-2026-11294

CVE-2026-11294 affects Google Chrome (Chromium-based) Passwords UI handling. The issue is described as an inappropriate implementation in Passwords that enables a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is associated with versions prior to 149.0.7827.53, ...

CVE-2026-11650

CVE-2026-11650 : Use after free in V8 (Google Chrome) prior to 149.0.7827.103 enables remote code execution inside a sandbox via a crafted HTML page. Affected software is Google Chrome’s V8 engine; impact is high as per Chromium advisory. The connected sources indicate the vulnerability arises fr...

CVE-2026-11675

CVE-2026-11675 : Out-of-bounds read in Skia used by Google Chrome before 149.0.7827.103. A remote attacker who compromises the renderer process could leak cross-origin data via a crafted HTML page. The issue arises from Skia, with impact limited to confidentiality (LOW in CVSS 3.1 per the documen...

CVE-2026-11678

Summary: CVE-2026-11678 is an integer overflow in libyuv used by Google Chrome, fixed in version 149.0.7827.103. The issue could allow a remote attacker who has compromised the renderer process to extract potentially sensitive data from process memory via a crafted HTML page. Affected component: ...

CVE-2026-13819

CVE-2026-13819 affects Google Chrome on macOS via ANGLE. The vulnerability is an out-of-bounds memory read in ANGLE that could be triggered by a crafted HTML page when the renderer is compromised, with impact described as high. Remediation: update to Chrome 150.0.7871.47 or later. Exploitation st...