CVE-2026-11201

The CVE-2026-11201 entry reports a use-after-free in Chrome’s ServiceWorker that could allow arbitrary code execution when a user is convinced to install a crafted Chrome Extension, affecting Google Chrome versions prior to 149.0.7827.53. The vulnerability is linked to the Chromium-based extensio...

CVE-2026-11209

CVE-2026-11209 applies to Google Chrome, affecting the Passwords implementation prior to version 149.0.7827.53. The issue arises from an inappropriate implementation that allows a remote attacker who has compromised the renderer process to read potentially sensitive information from process memor...

CVE-2026-11217

CVE-2026-11217 describes an inappropriate implementation in Google Chrome's Fenced Frames that, before version 149.0.7827.53, could allow a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The vulnerability is labeled with Low severity in ...

CVE-2026-11219

CVE-2026-11219 concerns Google Chrome: an Inappropriate implementation in Navigation allows bypassing navigation restrictions via a crafted HTML page. Affected software is Chrome prior to version 149.0.7827.53. The underlying issue is described as an improper/navigation-related implementation in ...

CVE-2026-11245

CVE-2026-11245 affects Google Chrome (Payments) and is caused by an inappropriate implementation that allowed a remote attacker to perform UI spoofing via a crafted HTML page. Affected: Chrome versions before 149.0.7827.53. Impact is UI spoofing with no information disclosure or remote code execu...

CVE-2026-11263

CVE-2026-11263 involves insufficient policy enforcement in WebAuthentication for Google Chrome on Android. The issue allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected software is Chrome on Android prior to version 149.0.7...

CVE-2026-11629

CVE-2026-11629 is a Use-after-Free in Chrome’s Ozone component that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected software is Google Chrome, with the vulnerability present in builds prior to 149.0.7827.103. Remediation is provided by the Chrome Stable up...

CVE-2026-11655

CVE-2026-11655 is a vulnerability in Google Chrome on macOS caused by an integer overflow in Media handling, prior to build 149.0.7827.103. The flaw could allow a remote attacker who has compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page, with a Chr...

CVE-2026-13799

CVE-2026-13799 is a heap-corruption risk caused by a Use-After-Free in QUIC within Google Chrome prior to 150.0.7871.47. Public sources consistently describe the vulnerability as a QUIC-related use-after-free issue that could be triggered by malicious network traffic, leading to potential heap co...

CVE-2026-13820

CVE-2026-13820 : An out-of-bounds read in Skia used by Google Chrome on macOS prior to 150.0.7871.47 allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue affects Chrome’s rendering path (Skia) on macOS, with the root cause ...

CVE-2026-13841

CVE-2026-13841 affects Google Chrome components using Skia . The issue is an integer overflow in Skia that, on Chrome builds prior to 150.0.7871.47 , could allow a remote attacker who already compromised the renderer process to perform a sandbox escape via a crafted HTML page . The explicit impac...

CVE-2026-13846

CVE-2026-13846 affects Google Chrome on macOS, caused by a use-after-free in USB handling that could allow a sandbox escape when a renderer process is compromised and a crafted HTML page is loaded. Impact described as high/highest severity; no exploitation details are provided in the source docum...

CVE-2026-13847

Chrome for iOS (Google Chrome on iOS) is affected by CVE-2026-13847 due to insufficient validation of untrusted input, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects Chrome on iOS prior to version 150.0.7871.47. Impact is cross-origin data ...

CVE-2026-13849

Chromoting component in Google Chrome on Windows is affected by CVE-2026-13849 due to insufficient validation of untrusted input, allowing a local attacker to potentially perform a sandbox escape via a malicious file. The issue affects Chrome’s Windows builds prior to version 150.0.7871.47 and is...

CVE-2026-13868

Technical details (affected components, root cause, fixes) are not publicly available in the provided documents; monitor for updates from official advisories.

CVE-2026-13881

CVE-2026-13881 details (concrete): In Google Chrome (Chromium WebAppInstalls) before version 150.0.7871.47, an inappropriate implementation allows a remote attacker to bypass the same-origin policy via a crafted HTML page. This is a network-exploitable issue with user interaction required and pot...

CVE-2026-13892

CVE-2026-13892 concerns Chrome for iOS before version 150.0.7871.47, where an inappropriate implementation allowed a remote attacker who lured a user into specific UI gestures to leak cross-origin data via a crafted HTML page. The issue affects Chrome on iOS (Chromium-based) and has a Medium seve...

CVE-2026-13926

The CVE-2026-13926 entry concerns Google Chrome prior to 150.0.7871.47, where insufficient validation of untrusted input in the Network component allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. The primary impact is a p...

CVE-2026-13956

CVE-2026-13956 affects Google Chrome’s PageInfo security UI, where an attacker could induce UI spoofing via a crafted HTML page. The issue is described as an incorrect security UI in PageInfo, allowing a remote attacker to exploit user interactions after luring a user to perform specific UI gestu...

CVE-2026-13982

Concretely, CVE-2026-13982 affects Google Chrome (Chromium-based) Passwords UI, where incorrect security UI allowed a remote attacker who compromised the renderer process to perform UI spoofing via a crafted HTML page. The vulnerability is tied to rendering context abuse and is exploitable withou...

CVE-2026-13984

The CVE-2026-13984 entry covers Google Chrome’s TabStrip UI security flaw. Affects Chrome versions before 150.0.7871.47, allowing a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is due to incorrect security UI behavior in the TabStrip, as described across multi...

CVE-2026-13989

Google Chrome is affected by CVE-2026-13989 due to an inappropriate implementation in PageInfo. Before version 150.0.7871.47, a remote attacker who had compromised a renderer process could trigger UI spoofing via a crafted HTML page. The core issue is in PageInfo; impact is limited to UI spoofing...

CVE-2026-13999

CVE-2026-13999 affects Google Chrome where insufficient validation of untrusted input in Extensions can enable UI spoofing via a crafted Chrome Extension. The vulnerability is triggered when a user is convinced to install a malicious extension, allowing spoofed UI elements as described in multipl...

CVE-2026-14097

CVE-2026-14097 describes an inappropriate implementation in WebAppInstalls for Google Chrome on macOS, prior to version 150.0.7871.47. The underlying issue allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Th...

CVE-2026-14103

According to the connected documents, CVE-2026-14103 is a use-after-free bug in SSL handling on Google Chrome running on ChromeOS, prior to version 150.0.7871.47. The vulnerability could allow a remote attacker to obtain potentially sensitive data from process memory via a crafted HTML page. The ...

CVE-2026-14114

The vulnerability CVE-2026-14114 affects Google Chrome on Android (WebAppInstalls component). An inappropriate implementation allows a local attacker to spoof UI via a malicious file. Root cause: flawed handling in WebAppInstalls leading to UI spoofing. Affected version: Chrome for Android prior ...

CVE-2026-14147

CVE-2026-14147 concerns Google Chrome prior to 150.0.7871.47, where an inappropriate implementation in CSS enables UXSS by a crafted HTML page. The vulnerability permits a remote attacker to inject arbitrary scripts or HTML, potentially affecting user sessions and page content (impacting confiden...

CVE-2026-14425

This CVE affects ANGLE in Google Chrome and is caused by a use-after-free in ANGLE that could allow a remote attacker to perform a sandbox escape via a crafted HTML page in Chrome versions prior to 150.0.7871.46. Impact is described as high/critical with potential full compromise of confidentiali...

CVE-2026-15903

CVE-2026-15903 affects Google Chrome’s V8 engine, with an out-of-bounds read/write vulnerability in V8 prior to version 150.0.7871.128. The issue allows a crafted HTML page to run arbitrary code inside the sandbox. The description notes the vulnerability as High severity and implies remote code e...

CVE-2026-3932

CVE-2026-3932 : Insufficient policy enforcement in PDF handling within Google Chrome on Android (Chromium core) allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected component is the PDF policy enforcement in Chromium/Chrome prior to version 146.0.7680.71 . ...

CVE-2026-4450

CVE-2026-4450 is a vulnerability in Google Chrome’s V8 engine. It describes an out-of-bounds write in V8 prior to 146.0.7680.153 that could enable a remote attacker to cause heap corruption via a crafted HTML page. The issue affects Chrome releases using the affected V8, with a high severity (CVS...

CVE-2026-4464

CVE-2026-4464 is an ANGLE-related vulnerability in Google Chrome where an integer overflow could allow remote heap corruption via a crafted HTML page. The issue affects Chrome prior to version 146.0.7680.153 and is addressed by the 146.0.7680.153 (and subsequent) security update. The CVE entry is...

CVE-2026-4677

Google Chrome WebAudio in versions prior to 146.0.7680.165 is affected by an inappropriate implementation that allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affected component: WebAudio (Chrome/Chromium). Root cause: improper WebAudio implementation. Im...

CVE-2026-5283

CVE-2026-5283 concerns an inappropriate ANGLE implementation in Google Chrome before 146.0.7680.178 that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The connected documents indicate this is fixed in Chrome/Chromium around the 146.0.7680.178 update, with relate...

CVE-2026-6301

The CVE-2026-6301 entry concerns a Type Confusion in the Turbofan JIT of Google Chrome, prior to version 147.0.7727.101. A crafted HTML page could cause a sandboxed remote-code execution due to the underlying type confusion in Turbofan. The connected document confirms the vulnerability but does n...

CVE-2026-6305

CVE-2026-6305 is a reported heap buffer overflow in the PDFium component used by Google Chrome, allowing a remote attacker to execute arbitrary code inside the browser sandbox when processing a crafted PDF. Affected products include Google Chrome prior to 147.0.7727.101 (desktop builds). The vuln...

CVE-2026-6362

CVE-2026-6362 involves a memory safety defect in Google Chrome’s Codecs component (Chromium). A use-after-free in Codecs could enable a remote attacker to cause out-of-bounds memory access by parsing a specially crafted video file. The issue affects Chrome/Chromium releases prior to the patched b...

CVE-2026-7355

CVE-2026-7355 describes a use-after-free in the Media component of Google Chrome up to version 147.0.7727.138, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The affected product is Google Chrome; root cause is a use-after-free in Media handling. ...

CVE-2026-7358

CVE-2026-7358 is a use-after-free vulnerability in Google Chrome's Animation component that allows a remote attacker to execute arbitrary code inside the Chrome sandbox. Affected product/version: Google Chrome before 147.0.7727.138. Root cause: use-after-free in Animation. Impact: arbitrary code ...

CVE-2026-7914

CVE-2026-7914 describes a Type Confusion in Chrome on Windows (Accessibility component) that could allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page. The issue affects Google Chrome before version 148.0.7778.96. The root cause is a type confusion in the Accessibi...

CVE-2026-7933

CVE-2026-7933 describes an out-of-bounds read in WebCodecs affecting Google Chrome before 148.0.7778.96. A remote attacker could trigger memory read via a crafted video file. The issue is mitigated by updating to version 148.0.7778.96 or later. Connected sources from NVD, Debian OSV, ENISA EUVD, ...

CVE-2026-7950

CVE-2026-7950 describes an out-of-bounds read and write in Chrome’s GFX component. Affected software is Google Chrome prior to version 148.0.7778.96, where an attacker could trigger arbitrary read/write by sending malicious network traffic. The vulnerability is categorized as Chromium/Chrome-rela...

CVE-2026-7994

CVE-2026-7994 : In Chromoting on Windows in Google Chrome, before version 148.0.7778.96, there is an insecure/incorrect implementation that could allow a local attacker to achieve OS-level privilege escalation by processing a malicious file. Multiple connected sources corroborate this, including ...

CVE-2026-8001

CVE-2026-8001 involves a Use After Free in Google Chrome’s printing component for Linux, macOS, and ChromeOS. The vulnerability, present in Chrome builds prior to 148.0.7778.96, could allow a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a ...

CVE-2026-8006

Google Chrome prior to 148.0.7778.96 contains a vulnerability in DevTools where insufficient policy enforcement allows UI spoofing if a user installs a crafted extension. Affected: DevTools UI handling within Chrome’s browser environment (Chrome 148 before the patch). Root cause: insufficient pol...

CVE-2026-8019

CVE-2026-8019 describes insufficient policy enforcement in the Chrome WebApp, allowing a remote attacker to trigger UI spoofing through a crafted HTML page in Chrome versions before 148.0.7778.96. The root cause is restricted policy enforcement within WebApp handling. Impact is UI spoofing; no ex...

CVE-2026-8520

CVE-2026-8520 : A race in the Payments component of Google Chrome before version 148.0.7778.168 could allow a remote attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is described as critical in Chromium, with a network attack vector and high impact on confiden...

CVE-2026-8534

CVE-2026-8534 describes an integer overflow in the GPU path of Google Chrome on Linux and ChromeOS, before version 148.0.7778.168. A remote attacker who already compromised the renderer process could potentially escape the Chrome sandbox via a crafted HTML page. Affected component is the GPU/Chro...

CVE-2026-8552

CVE-2026-8552 describes a heap buffer overflow in the GPU component of Google Chrome on Android prior to 148.0.7778.168, allowing a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. Affected product: Google Chrome (Android); vulnerable component: GPU handling/heap ...

CVE-2026-8558

The CVE-2026-8558 issue affects Google Chrome prior to 148.0.7778.168, in the Fonts component. An out-of-bounds write mishandles memory during font rendering, enabling a remote attacker to run arbitrary code inside the browser sandbox via a crafted HTML page. Remediation: update to Chrome 148.0.7...