CVE-2026-6362

CVE-2026-6362 involves a memory safety defect in Google Chrome’s Codecs component (Chromium). A use-after-free in Codecs could enable a remote attacker to cause out-of-bounds memory access by parsing a specially crafted video file. The issue affects Chrome/Chromium releases prior to the patched b...

CVE-2026-11633

Summary (CVE-2026-11633) : A use-after-free in Bluetooth handling in Google Chrome on macOS allows a remote attacker to execute arbitrary code via a malicious Bluetooth peripheral. The flaw’s impact is described as critical; affected software is “Google Chrome on Mac” with the vulnerable componen...

CVE-2026-11640

CVE-2026-11640 : Integer overflow in libyuv within Google Chrome prior to 149.0.7827.103 can allow a remote attacker (with renderer access) to potentially escape the sandbox via a crafted HTML page. This is a Chromium-level issue; the referenced Chrome Security Update notes a fix in the Stable Ch...

CVE-2026-11655

CVE-2026-11655 is a vulnerability in Google Chrome on macOS caused by an integer overflow in Media handling, prior to build 149.0.7827.103. The flaw could allow a remote attacker who has compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page, with a Chr...

CVE-2026-11192

AffectedSoftware : Google Chrome (Password Manager). Vulnerability : Insufficient validation of untrusted input in Password Manager allows a remote attacker to perform UI spoofing via malicious network traffic. Impact : UI spoofing could mislead users or steal credentials if leveraged against the...

CVE-2026-11201

The CVE-2026-11201 entry reports a use-after-free in Chrome’s ServiceWorker that could allow arbitrary code execution when a user is convinced to install a crafted Chrome Extension, affecting Google Chrome versions prior to 149.0.7827.53. The vulnerability is linked to the Chromium-based extensio...

CVE-2026-11217

CVE-2026-11217 describes an inappropriate implementation in Google Chrome's Fenced Frames that, before version 149.0.7827.53, could allow a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The vulnerability is labeled with Low severity in ...

CVE-2026-11220

CVE-2026-11220 : The provided documents indicate a vulnerability in Google Chrome related to the Navigation component, caused by insufficient validation of untrusted input. This weakness exists in Chrome versions prior to 149.0.7827.53 and could let a remote attacker who has already compromised t...

CVE-2026-11237

The CVE-2026-11237 entry concerns Google Chrome (Chromium-based) with the vulnerability in the Media component failing to validate untrusted input. A remote attacker who has compromised the renderer process could abuse a crafted HTML page to trigger UI spoofing. Affected versions are prior to 149...

CVE-2026-11242

The CVE refers to Google Chrome before version 149.0.7827.53, where insufficient validation of untrusted input in Plugins could allow a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. The vulnerability is tied to the Plugins component; i...

CVE-2026-11259

CVE-2026-11259 : In Google Chrome, the Cast feature allowed a remote attacker to bypass the same-origin policy due to insufficient validation of untrusted input. This affects Chrome versions prior to 149.0.7827.53. The issue is limited to a policy bypass and is described with a Low severity in Ch...

CVE-2026-13779

CVE-2026-13779 : Use after free in Chromoting of Google Chrome on ChromeOS, prior to 150.0.7871.47. This allows a remote attacker to execute arbitrary code via malicious network traffic (Chromium security severity: Critical). Connected sources corroborate the issue in Chromoting/Ursos components ...

CVE-2026-13796

CVE-2026-13796 affects Chromecast in Google Chrome, caused by an integer overflow in the renderer that could enable sandbox escape via a crafted HTML page. The issue requires access to a vulnerable renderer and has been fixed in Chrome 150.x; guidance is to upgrade to Chrome 150.0.7871.47 or newe...

CVE-2026-13797

CVE-2026-13797 (Chromecast in Google Chrome) : The issue is caused by insufficient validation of untrusted input in Chromecast-related components of Chrome before version 150.0.7871.47. If an attacker could lure a user to load a crafted HTML page and compromised the renderer process, they could p...

CVE-2026-13799

CVE-2026-13799 is a heap-corruption risk caused by a Use-After-Free in QUIC within Google Chrome prior to 150.0.7871.47. Public sources consistently describe the vulnerability as a QUIC-related use-after-free issue that could be triggered by malicious network traffic, leading to potential heap co...

CVE-2026-13859

The CVE-2026-13859 entry describes an issue in ANGLE used by Google Chrome, where an inappropriate ANGLE implementation prior to Chrome 150.0.7871.47 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected product/component: ANGLE in Chromium-based ...

CVE-2026-13871

CVE-2026-13871 affects Google Chrome (GuestView) with insufficient policy enforcement prior to 150.0.7871.47. A remote attacker who has compromised the renderer process could bypass site isolation via a crafted HTML page. The technical impact is a bypass of isolation mechanisms within Chrome’s Gu...

CVE-2026-13885

Summary: CVE-2026-13885 is a use-after-free in Skia used by Google Chrome on Android, allowing remote code execution via a crafted HTML page. Affected product/component: Skia within Chrome on Android; Root cause: use-after-free in Skia rendering path. Impact: arbitrary code execution inside the b...

CVE-2026-13904

CVE-2026-13904 describes an Inappropriate implementation in Safe Browsing for Google Chrome on iOS, where navigation restrictions could be bypassed by a remote attacker via a crafted HTML page. Affected product: Google Chrome on iOS. The root cause is an improper Safe Browsing implementation prio...

CVE-2026-13918

CVE-2026-13918 concerns Chrome for iOS (iOS) prior to 150.0.7871.47, where a use-after-free vulnerability in the browser could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. The connected Debian/OSV and related entries corroborate the description and ident...

CVE-2026-13937

CVE-2026-13937 concerns Google Chrome where insufficient policy enforcement in passwords handling within the Chromium-based renderer allowed a remote attacker who had already compromised the renderer to leak cross-origin data via a crafted HTML page. The vulnerability is described in multiple sou...

CVE-2026-13964

CVE-2026-13964 affects WebView in Google Chrome on Android. The vulnerability is due to insufficient policy enforcement that allowed bypassing navigation restrictions via a crafted HTML page. Impact is a medium severity remote issue. The documented fix is Chrome version 150.0.7871.47 or later; up...

CVE-2026-14069

This CVE affects Google Chrome’s WebNN component. An integer overflow in WebNN could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. The issue affects Chrome before version 150.0.7871.47 (Chromium security severity: Low). Impact: high confid...

CVE-2026-14088

CVE-2026-14088 concerns an uninitialized-use vulnerability in Canvas within Google Chrome on Android . The issue allows a remote attacker to potentially read sensitive information from the process memory through a crafted HTML page, with the impact described as confidential data exposure and the ...

CVE-2026-14101

CVE-2026-14101 affects Google Chrome on macOS before 150.0.7871.47, due to insufficient policy enforcement in the Sandbox component, enabling a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The issue is described across multiple sources (NVD/DEBIAN/RH/EU...

CVE-2026-14115

The CVE-2026-14115 entry concerns insufficient validation of untrusted input in Cast in Google Chrome before 150.0.7871.47, enabling a renderer-compromised attacker to escalate privileges via a crafted HTML page. The vulnerability affects Chrome’s Cast component and is tied to Chromium security i...

CVE-2026-14134

CVE-2026-14134 affects Google Chrome for Android: an inappropriate Autofill implementation allows UI spoofing via a crafted HTML page on versions before 150.0.7871.47. Root cause is improper Autofill handling; impact is UI spoofing with remote exploitation potential. Mitigation is updating to 150...

CVE-2026-14146

CVE-2026-14146 describes an insecure CSS implementation in Google Chrome prior to 150.0.7871.47. The issue allows a remote attacker to leak cross-origin data through a crafted HTML page, due to an inappropriate CSS implementation. The practical impact is information disclosure of cross-origin dat...

CVE-2026-14152

CVE-2026-14152 involves an out-of-bounds read and write in ANGLE used by Google Chrome. The vulnerability could allow a remote attacker who has compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The affected component is ANGLE within Chrome, with im...

CVE-2026-14393

CVE-2026-14393: Use-after-free in V8 (Chrome) allows remote code execution inside the sandbox via a crafted HTML page. Affected: Google Chrome's V8 engine prior to version 150.0.7871.46. Impact: arbitrary code execution with high/total impact as per the CVSS vector. Remediation: update to Chrome ...

CVE-2026-14412

The CVE-2026-14412 entry concerns ANGLE in Google Chrome with insufficient validation of untrusted input. Attack vector involves a remote attacker who has already compromised the renderer process and could potentially escape the sandbox through a crafted HTML page. Affected product context is Goo...

CVE-2026-14415

In Chrome, CVE-2026-14415 concerns an inappropriate implementation in V8 that affects Google Chrome before version 150.0.7871.46. A remote attacker could exploit the issue by persuading a user to perform specific UI gestures, potentially triggering heap corruption through a crafted HTML page. The...

CVE-2026-3062

In Google Chrome (Mac), CVE-2026-3062 is a Tint-specific out-of-bounds read and write vulnerability in Tint that could let a remote attacker access memory via a crafted HTML page. Affected product/version: Chrome on macOS prior to 145.0.7632.116. Underlying cause: out-of-bounds memory access. Imp...

CVE-2026-3914

CVE-2026-3914 affects Google Chrome/Chromium WebML with an integer overflow that could lead to heap corruption via a crafted HTML page. Affected versions are prior to 146.0.7680.71. The issue is assessed as High severity; remediation is to upgrade to 146.0.7680.71 or newer (per Debian/ENISA/Astra...

CVE-2026-4442

CVE-2026-4442 is a Chrome/Chromium-related vulnerability described as a heap buffer overflow in CSS that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Google Chrome prior to 146.0.7680.153. Impact as stated: high severity with potential for arbi...

CVE-2026-5286

The provided documents describe CVE-2026-5286 as a memory-use-after-free in Chrome’s Dawn component, exploitable via crafted HTML pages to achieve remote code execution. Affected software: Google Chrome (Dawn component) with vulnerable Dawn paths in Chromium prior to version 146.0.7680.178. Root ...

CVE-2026-6301

The CVE-2026-6301 entry concerns a Type Confusion in the Turbofan JIT of Google Chrome, prior to version 147.0.7727.101. A crafted HTML page could cause a sandboxed remote-code execution due to the underlying type confusion in Turbofan. The connected document confirms the vulnerability but does n...

CVE-2026-6310

CVE-2026-6310 describes a use-after-free in Dawn within Google Chrome before 147.0.7727.101, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The connected documents confirm the vulnerability details and severity (High)...

CVE-2026-7334

CVE-2026-7334 is a report of a Use-After-Free in the Chromium-based Google Chrome browser’s Views component on macOS, leading to potential heap corruption via a crafted HTML page. The issue affects Google Chrome versions before 147.0.7727.138; multiple sources (NVD, Debian, Red Hat, EUVD) describ...

CVE-2026-7358

CVE-2026-7358 is a use-after-free vulnerability in Google Chrome's Animation component that allows a remote attacker to execute arbitrary code inside the Chrome sandbox. Affected product/version: Google Chrome before 147.0.7727.138. Root cause: use-after-free in Animation. Impact: arbitrary code ...

CVE-2026-7908

CVE-2026-7908 describes a use-after-free in Chrome’s Fullscreen handling that could allow a sandbox escape via a crafted HTML page. Affected component is the browser’s Fullscreen code path in Chromium. The issue is tied to Google Chrome before version 148.0.7778.96 (stable release 148); the Chrom...

CVE-2026-8513

CVE-2026-8513 : Use-after-free in Input handling in Google Chrome on Android (pre-148.0.7778.168). If a renderer process is compromised, this may allow a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. The provided documents do not specify a fixed version or reme...

CVE-2026-8520

CVE-2026-8520 : A race in the Payments component of Google Chrome before version 148.0.7778.168 could allow a remote attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is described as critical in Chromium, with a network attack vector and high impact on confiden...

CVE-2026-8527

CVE-2026-8527 : In Google Chrome, insufficient validation of untrusted input in Downloads allows a remote attacker to execute arbitrary code via a crafted HTML page. Affected: Chrome (Chromium-based) prior to 148.0.7778.168. Root cause: input validation in the Downloads path. Impact: high severit...

CVE-2026-8541

CVE-2026-8541 describes an out-of-bounds read in Google Chrome UI that could allow a remote attacker—who has already compromised the renderer process—to read potentially sensitive data from process memory via a crafted HTML page. The issue affects Chrome versions prior to 148.0.7778.168. The vuln...

CVE-2026-8543

CVE-2026-8543 describes an out-of-bounds read in the FileSystem component of Google Chrome on macOS. The issue exists before Chrome 148.0.7778.168 and can be triggered when a user is convinced to perform specific UI gestures on a crafted HTML page, potentially allowing access to sensitive data fr...

CVE-2026-8558

The CVE-2026-8558 issue affects Google Chrome prior to 148.0.7778.168, in the Fonts component. An out-of-bounds write mishandles memory during font rendering, enabling a remote attacker to run arbitrary code inside the browser sandbox via a crafted HTML page. Remediation: update to Chrome 148.0.7...

CVE-2026-8574

This CVE concerns Google Chrome on Windows, where a Use-after-Free in Core could let a remote attacker who already compromised the renderer process escape the sandbox via a crafted HTML page. Affected versions are before 148.0.7778.168. The root cause is a use-after-free in Core; the document spe...

CVE-2026-9884

CVE-2026-9884 describes a Use-after-Free in the Google Chrome browser on macOS that allows remote code execution via a crafted HTML page. Affected product/component: Google Chrome (Mac), Chromium-based browser. Root cause: use-after-free in the Browser object. Impact: arbitrary code execution wit...

CVE-2026-9905

CVE-2026-9905 is a Use-after-free in Chrome’s Accessibility component on Windows, potentially enabling a sandbox escape via a crafted HTML page when the renderer is compromised. Multiple sources (NVD, ENISA EUVD-2026-33200, Red Hat, Debian, OSV) describe the issue with the same root cause and imp...