CVE-2026-17968

CVE-2026-17968 affects Google Chrome on Android and is caused by an uninitialized use in WebXR, enabling a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The issue is tied to Chrome versions preceding 151.0.7922.72; remediation is to update ...

CVE-2026-17975

CVE-2026-17975 : An inappropriate implementation flaw was found in the IME component of the Chromium-based Google Chrome browser on macOS, prior to version 151.0.7922.72. The issue could allow a remote attacker to potentially obtain sensitive information from process memory via a crafted HTML pag...

CVE-2026-17982

CVE-2026-17982 affects Google Chrome (Cast) with insufficient validation of untrusted input in Cast, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact: potential cross-origin issues; severity deemed Low by Chromium. Affected versions are Chrome prior to 1...

CVE-2026-17988

CVE-2026-17988 is a Chrome vulnerability affecting the Navigation component. It stems from insufficient validation of untrusted input, letting a remote attacker who has compromised the renderer bypass navigation restrictions via a crafted HTML page in Chrome versions prior to 151.0.7922.72. The w...

CVE-2026-17999

CVE-2026-17999: A race condition in Chrome’s PictureInPicture on Android (before 151.0.7922.72) enables a remote attacker to perform domain spoofing via a crafted HTML page. Affected software is Google Chrome on Android; root cause is a race in PictureInPicture logic. The Chromium advisory assign...

CVE-2026-18004

CVE-2026-18004 affects Google Chrome’s Speech component. The vulnerability allows a remote attacker, who has already compromised the renderer process, to leak cross-origin data via a crafted HTML page due to insufficient policy enforcement. Affected version: Chrome prior to 151.0.7922.72. Impact ...

CVE-2026-18010

CVE-2026-18010 : In Google Chrome (and Chromium-based) Passwords component, an inappropriate implementation allows a remote attacker to trigger UI spoofing via malicious network traffic. This affects Chrome versions prior to 151.0.7922.72 (Chromium security severity: Low). The NVD entry notes a l...

CVE-2026-3928

CVE-2026-3928 is a vulnerability in Chromium-based extensions handling in Google Chrome. The issue is insufficient policy enforcement in the Extensions framework, allowing a user-assisted attacker who lures a target to install a malicious extension to perform UI spoofing via the extension. Affect...

CVE-2026-3939

Google Chrome/Chromium is affected by CVE-2026-3939 due to insufficient policy enforcement in PDF handling, allowing a crafted PDF to bypass navigation restrictions. Affected component: PDF policy enforcement in Chrome/Chromium prior to version 146.0.7680.71 (specific fixed versions cited by Debi...

CVE-2026-4451

CVE-2026-4451 concerns Google Chrome’s navigation flow. The connected documents confirm that insufficient validation of untrusted input in the Navigation path (Chromium-based Chrome prior to 146.0.7680.153) could allow a remote attacker who has compromised the renderer process to potentially perf...

CVE-2026-5862

CVE-2026-5862 affects Google Chrome/Chromium’s V8 engine. The issue is described as an inappropriate implementation in V8 that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability is rated High and is associated with an in-sandbox cod...

CVE-2026-7348

CVE-2026-7348 is a use-after-free in Chrome's Codecs component. A crafted HTML page can trigger the bug to achieve remote arbitrary code execution inside the Chrome sandbox. Affected: Google Chrome before 147.0.7727.138. Root cause: use-after-free in Codecs. Impact: high (arbitrary code execution...

CVE-2026-7982

CVE-2026-7982 affects Google Chrome’s WebCodecs: an uninitialized use in WebCodecs prior to 148.0.7778.96 may allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The issue is described across multiple sources (NVD/DEBIAN/EUVD) with the ...

CVE-2026-8013

CVE-2026-8013 affects Google Chrome FedCM (Federated Credential Management) prior to 148.0.7778.96. The vulnerability is due to insufficient validation of untrusted input, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Impact is described as cross-origin data leakag...

CVE-2026-8571

CVE-2026-8571 describes an issue in the GPU policy enforcement of Google Chrome on Android, where insufficient enforcement could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability affects Chrome versions pr...

CVE-2026-9118

CVE-2026-9118 is a Use-After-Free vulnerability affecting Google Chrome on Windows in the XR stack, prior to version 148.0.7778.179. The issue allows remote code execution via a crafted HTML page, with a Chromium-based severity marked as High. The connected documents confirm the vulnerability des...

CVE-2026-9894

CVE-2026-9894 describes a use-after-free in the GPU component of the Chromium-based Google Chrome browser. The vulnerability could allow a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page, with the documented impact...

CVE-2026-9917

CVE-2026-9917 involves an uninitialized use flaw in the WebGL component of Google Chrome for Android. The issue, reported as affecting Chrome on Android prior to version 148.0.7778.216, could allow a remote attacker to read potentially sensitive information from a process’s memory via a crafted H...

CVE-2026-9920

Technical details such as affected products, components, and fixes are not publicly available in the provided documents for CVE-2026-9920; monitor for updates.

CVE-2026-9996

CVE-2026-9996 affects Google Chrome on macOS, with an out-of-bounds read in WebRTC that could allow a remote, crafted HTML page to read potentially sensitive data from the browser process memory. Affected component: WebRTC in Chromium-based Chrome; root cause is an out-of-bounds read. Version det...

CVE-2025-10892

CVE-2025-10892 is a Chromium/Google Chrome vulnerability involving an integer overflow in V8 prior to 140.0.7339.207 that can lead to heap corruption when processing crafted HTML pages. The issue affects Chrome’s V8 engine and is classified as High severity with network attack vector, user intera...

CVE-2026-10916

This CVE affects Google Chrome DevTools: insufficient validation of untrusted input in DevTools allowed UXSS via a crafted HTML page on renderer-compromised contexts, prior to Chrome 149.0.7827.53. The vulnerability, caused by inadequate input validation in DevTools, could enable a remote attacke...

CVE-2026-10924

Summary of CVE-2026-10924 (CVE list entry): Integer overflow in the Chromecast component of Google Chrome before 149.0.7827.53 allowed a remote attacker who had already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. This affects Chrome/Chromecast imple...

CVE-2026-10933

CVE-2026-10933 is a use-after-free in Audio in Google Chrome on Windows. The vulnerability could allow a compromised renderer process to escape the sandbox via a crafted HTML page. Affected software is Google Chrome on Windows; the issue is tied to the Audio component and is described as high sev...

CVE-2026-10948

CVE-2026-10948 describes a use-after-free in WebRTC affecting Google Chrome up to 149.0.7827.53 . The vulnerability allows a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. The impact is described as high severity with possible full compromise of the san...

CVE-2026-10951

CVE-2026-10951 refers to a use-after-free in Autofill for Google Chrome on iOS. The underlying issue causes heap corruption via a crafted HTML page when a user is guided to perform specific UI gestures, with remote attack potential. Affected product: Google Chrome on iOS; vulnerable component: Au...

CVE-2026-10958

CVE-2026-10958 is a use-after-free vulnerability in Chrome for iOS (Google Chrome on iOS) prior to version 149.0.7827.53 . A remote attacker could trick a user into performing specific UI gestures to cause arbitrary code execution via a crafted HTML page. The root cause is a use-after-free in the...

CVE-2026-10978

Summary of CVE-2026-10978 (Chromoting) : A use-after-free defect in Chromoting within Google Chrome on Windows allows a remote attacker to execute arbitrary code via crafted network traffic. Affected component is Chromoting/Chromium-based Chrome; vulnerable version range is Windows builds prior t...

CVE-2026-10990

CVE-2026-10990 affects Google Chrome (Chromium-based) prior to 149.0.7827.53. A use-after-free in the Glic component from the renderer process could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page. The issue is documented across NVD/EUVD/NV... and is addressed by Chro...

CVE-2026-11067

CVE-2026-11067 describes an uninitialized use in Dawn within Google Chrome before version 149.0.7827.53. The issue allows a remote attacker to potentially read sensitive information from process memory via a crafted HTML page. The connected sources confirm the vulnerability affects Dawn in Chrome...

CVE-2026-11068

Summary: CVE-2026-11068 is a use-after-free in Chrome’s WebSockets implementation that could allow remote code execution inside a sandbox. The issue affects Google Chrome builds prior to version 149.0.7827.53. The vulnerability description across multiple sources aligns on the same root cause and...

CVE-2026-11075

CVE-2026-11075 describes an out-of-bounds read in V8 within Google Chrome prior to 149.0.7827.53, enabling a remote attacker to potentially reading sensitive data from a process’s memory through a crafted HTML page. Affected component is V8 (JavaScript engine) in Chrome; impact is information dis...

CVE-2026-11097

CVE-2026-11097 affects Google Chrome on Android where the WebView implementation allows a remote attacker to leak cross-origin data through a crafted HTML page. The underlying issue is described as an inappropriate implementation in WebView, with impact identified as cross-origin data leakage. Th...

CVE-2026-11108

The CVE-2026-11108 entry concerns Google Chrome on Android. It describes an inappropriate NFC implementation that could allow privilege escalation when a crafted HTML page is loaded, under versions affected prior to 149.0.7827.53. The underlying issue is limited to the NFC handling in Chrome’s An...

CVE-2026-11131

CVE-2026-11131 affects Google Chrome on Android. A use-after-free in Autofill can be triggered in the renderer, potentially allowing a remote attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page. Impact is a sandbox escape with high confidentiality, inte...

CVE-2026-11151

The CVE-2026-11151 entry concerns Google Chrome where the Password Manager component improperly validates untrusted input. A renderer process that has been compromised could be exploited via a crafted HTML page to escape the sandbox. Affected version range is Chrome prior to 149.0.7827.53. The is...

CVE-2026-11163

CVE-2026-11163 describes a use-after-free in Messages for Google Chrome on Android, prior to version 149.0.7827.53, enabling a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. The underlying issue is a memory safety flaw in the Android Messages interaction, leadin...

CVE-2026-11164

CVE-2026-11164 describes a use-after-free in Blink of Google Chrome before 149.0.7827.53, enabling a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The connected documents confirm the component (Blink), impact (remote code execution in sandbox), and affected...

CVE-2026-11166

CVE-2026-11166 concerns an Inappropriate implementation in SVG in Google Chrome (Chromium) prior to 149.0.7827.53. The vulnerability allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected software is Google Chrome’s SVG handling in the Chromium stack...

CVE-2026-11197

CVE-2026-11197 affects Google Chrome: insufficient policy enforcement in Workers allows a remote attacker who has compromised the renderer to bypass the same-origin policy via a crafted HTML page, prior to version 149.0.7827.53 . Documented impact is a Medium severity; exploitation status is not ...

CVE-2026-11205

CVE-2026-11205 concerns Insufficient validation of untrusted input in Chrome for iOS (Google Chrome on iOS) up to build 149.0.7827.53, enabling a remote attacker to cause UXSS if a user performs specific UI gestures prompted by a crafted QR code. The advisory notes a Medium severity (CVSS 3.1: AV...

CVE-2026-11212

The CVE-2026-11212 affects Google Chrome (DevTools) prior to version 149.0.7827.53, where insufficient policy enforcement in DevTools could allow a user- tricked to install a malicious extension to leak cross-origin data. The root cause is policy enforcement gaps in DevTools that enable data exfi...

CVE-2026-11238

CVE-2026-11238 concerns the Google Chrome DevTools implementation. The connected documents state that an insecure DevTools path in Chrome prior to version 149.0.7827.53 allows a user-assisted attack: if a user installs a malicious extension, memory contents from affected processes may be exposed....

CVE-2026-11255

The CVE-2026-11255 entry concerns Google Chrome’s Storage Access API. Insufficient validation of untrusted input in Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected software is Chrome (Stor...

CVE-2026-11259

CVE-2026-11259 : In Google Chrome, the Cast feature allowed a remote attacker to bypass the same-origin policy due to insufficient validation of untrusted input. This affects Chrome versions prior to 149.0.7827.53. The issue is limited to a policy bypass and is described with a Low severity in Ch...

CVE-2026-11300

The CVE-2026-11300 entry concerns Google Chrome. Affected software is Chrome prior to version 149.0.7827.53, where an inappropriate implementation in Permissions allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is described as Low severity (Chromium secur...

CVE-2026-11651

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2026-11653

The CVE-2026-11653 issue concerns Google Chrome extensions. It is described as Insufficient validation of untrusted input in Extensions, enabling a remote attacker who has already compromised the renderer process to bypass site isolation via a crafted HTML page. The vulnerability affects Chrome p...

CVE-2026-11682

CVE-2026-11682 : In Chrome on Linux, an inappropriate implementation in Views (Chromium-based) prior to version 149.0.7827.103 could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Impact is sandbox escape potential...

CVE-2026-12452

The CVE-2026-12452 issue affects Google Chrome on Android (Chromium base). It is a use-after-free in Downloads, leading to potential heap corruption via a crafted HTML page. Version detail: affected prior to 149.0.7827.155; Apache-style phrasing aside, remediation is to update to 149.0.7827.155 o...