CVE-2026-9968

CVE-2026-9968 describes an integer overflow in V8 of Google Chrome, affecting versions prior to 148.0.7778.216. This could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Connected documents confirm the issue and cite upstream Chromium trackin...

CVE-2025-11207

CVE-2025-11207 affects Google Chrome/Chromium prior to 141.0.7390.54. A side-channel information leakage in Storage allows a remote attacker to perform arbitrary read/write via a crafted HTML page. CVSSv3.1 base score 6.5 (Network exploit, LOW complexity, No privileges, No user interaction, Confi...

CVE-2025-13635

CVE-2025-13635 affects Google Chrome/Chromium: Inappropriate implementation in the Downloads path allows a local attacker to perform UI spoofing via a crafted HTML page. Affected versions are prior to 143.0.7499.41 (Chrome/Chromium). The issue is marked Chromium security severity: Low. Related up...

CVE-2026-0902

CVE-2026-0902 is an issue in V8 used by Google Chrome prior to version 144.0.7559.59, described as an inappropriate implementation that allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Connected feeds show Chromium/Chrome updates delivering a fix (Chromium...

CVE-2026-10891

CVE-2026-10891 details : A use-after-free in GFX within Google Chrome on Linux allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The vulnerability is tied to Chrome/Chromium code paths, with a high-severity impact (CVSS v3.1: 8.8, Critical). Affected product: ...

CVE-2026-10896

CVE-2026-10896 affects Chrome for iOS (Google Chrome on iOS) prior to 149.0.7827.53. The vulnerability is a use-after-free in handling crafted HTML pages, enabling a remote attacker to execute arbitrary code. The Google Chrome 149 stable release (Chrome 149.0.7827.53 for Linux/Windows/macOS; iOS ...

CVE-2026-10908

CVE-2026-10908 affects Google Chrome on Windows. It is a Use-after-Free in FullScreen handling that, if a renderer process is compromised, could allow a sandbox escape via a crafted HTML page. Google Chrome 149.0.7827.53 (and later) includes fixes. The EUVD/NVD entries corroborate the same vector...

CVE-2026-10914

The CVE-2026-10914 entry affects ANGLE in Google Chrome on Windows. The issue is a Use-after-Free in ANGLE that could allow a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected software is Google Chrome with ANGLE enabled, prior to version 149.0....

CVE-2026-10999

An identified vulnerability CVE-2026-10999 affects ANGLE in Google Chrome on Windows prior to 149.0.7827.53. The root cause is an integer overflow in ANGLE, allowing a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory via a cra...

CVE-2026-11012

CVE-2026-11012 : In Google Chrome on Android, a use-after-free in Serial (prior to version 149.0.7827.53) could allow a renderer-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. Impact described as sandbox escape with high/severe implications; remediation is ...

CVE-2026-11032

CVE-2026-11032 affects Google Chrome's Password Manager. The issue stems from an inappropriate implementation in the Password Manager prior to Chrome 149.0.7827.53, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The documented impact is cross-origin data exposure (C...

CVE-2026-11035

CVE-2026-11035 describes an inappropriate implementation in Google Chrome for Android’s Custom Tabs prior to version 149.0.7827.53, enabling a local attacker to escalate privileges via a crafted XML file. The underlying issue is in the Custom Tabs integration, leading to total impact on confident...

CVE-2026-11057

Technical details are not publicly available in the provided documents. No specifics on affected components, versions beyond Chrome prior to 149.0.7827.53, or remediation are included. Monitor for updates from official advisories.

CVE-2026-11071

CVE-2026-11071 describes a use-after-free in Base within Google Chrome on Linux prior to version 149.0.7827.53. The issue allows a remote attacker who has compromised the renderer process to read potentially sensitive information from process memory via a crafted HTML page. Affected product: Goog...

CVE-2026-11093

CVE-2026-11093 concerns Google Chrome: a flaw in the Printing implementation allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (Printing subsystem under the renderer process). Root cause: Inappropri...

CVE-2026-11119

CVE-2026-11119 involves an insecure GPU implementation in Google Chrome on Android up to version before 149.0.7827.53, where a remote attacker who has already compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page. The connected documents reiterate the...

CVE-2026-11133

CVE-2026-11133: Affected software is Google Chrome (Chromium-based) prior to 149.0.7827.53. The issue is reported as Insufficient policy enforcement in Paint, enabling a remote attacker to bypass same-origin policy via a crafted HTML page. Root cause is described as insufficient policy enforcemen...

CVE-2026-11134

CVE-2026-11134 arises from an insufficient data validation issue in the Media component of Google Chrome (Chromium-based) before version 149.0.7827.53. The flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page. The description and connected sources consistently indi...

CVE-2026-11148

The CVE-2026-11148 entry affects Google Chrome on Android prior to version 149.0.7827.53 due to an inappropriate implementation in Payments , allowing a local attacker to leak cross-origin data via a crafted HTML page. Connected sources confirm the same description across multiple feeds; no expli...

CVE-2026-11190

CVE-2026-11190 affects Google Chrome extensions: an attacker could bypass discretionary access control by convincing a user to install a crafted extension, via an inappropriate implementation in Extensions prior to 149.0.7827.53. Impact is described as Medium; the issue is mitigated by updating C...

CVE-2026-11201

The CVE-2026-11201 entry reports a use-after-free in Chrome’s ServiceWorker that could allow arbitrary code execution when a user is convinced to install a crafted Chrome Extension, affecting Google Chrome versions prior to 149.0.7827.53. The vulnerability is linked to the Chromium-based extensio...

CVE-2026-11210

CVE-2026-11210 concerns Google Chrome’s Safe Browsing component. The issue is an inappropriate implementation that allows a remote attacker to bypass discretionary access control via a crafted RAR file, affecting Chrome builds prior to 149.0.7827.53 . The vulnerability is remote, requires user in...

CVE-2026-11215

CVE-2026-11215 concerns an insecure/incorrect Cronet implementation in Google Chrome on Android prior to version 149.0.7827.53, enabling a remote attacker to spoof a domain via a crafted domain name. The vulnerability arises in Cronet’s domain handling and is described with a Chromium security se...

CVE-2026-11227

Summary: CVE-2026-11227 affects Google Chrome’s Tab Hover Cards UI. The vulnerability is a mismatch in the security UI that could allow a remote attacker to spoof a domain via a crafted domain name. The issue is associated with Chrome versions before 149.0.7827.53 (Chromium security severity: Low...

CVE-2026-11272

CVE-2026-11272 affects Google Chrome on iOS, specifically the Reading List feature. The root cause is insufficient validation of untrusted input, enabling a remote attacker to escalate privileges via a crafted HTML page when a user is guided to perform certain UI gestures. Impact is described as ...

CVE-2026-11297

CVE-2026-11297 : In Google Chrome on Android, Reader Mode suffers from insufficient validation of untrusted input, allowing a local attacker to bypass navigation restrictions via a malicious file. The issue affects Chrome versions prior to 149.0.7827.53; updating to 149.0.7827.53 or later is the ...

CVE-2026-11301

In Google Chrome, the LiveCaption feature has an inappropriate implementation that could allow a remote attacker to cause out-of-bounds memory access via malicious network traffic. Affected product: Google Chrome (LiveCaption). Root cause: improper handling in LiveCaption code leading to memory a...

CVE-2026-12022

The vulnerability CVE-2026-12022 affects Google Chrome on macOS, where a race in Safe Browsing could allow a renderer‑process–hijacked attacker to escape the sandbox via a malicious file. The issue is tied to Chrome versions prior to 149.0.7827.115; evidence from ENISA/EUVD and Chrome security no...

CVE-2026-12023

CVE-2026-12023 is a use-after-free in the GPU code of Google Chrome for Mac, prior to version 149.0.7827.115. The flaw could be exploited by a remote attacker who had already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software is Ch...

CVE-2026-12461

CVE-2026-12461 affects Google Chrome on Windows, with an out-of-bounds read in WebRTC present in versions prior to 149.0.7827.155. The vulnerability could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Mitigation is to update Chrome to 149....

CVE-2026-13032

CVE-2026-13032: A use-after-free vulnerability in WebGL on Google Chrome for Android (prior to 149.0.7827.197) could allow a remote attacker to perform a sandbox escape via a crafted HTML page. Impact is labeled Critical . Affected component: WebGL/Chromium stack; root cause is use-after-free. Th...

CVE-2026-13797

CVE-2026-13797 (Chromecast in Google Chrome) : The issue is caused by insufficient validation of untrusted input in Chromecast-related components of Chrome before version 150.0.7871.47. If an attacker could lure a user to load a crafted HTML page and compromised the renderer process, they could p...

CVE-2026-13801

CVE-2026-13801 affects Google Chrome/Chromecast components (Chromium) with an integer overflow that could enable a sandbox escape when a renderer process is compromised via a crafted HTML page. The public advisory indicates a fix in Chrome 150.0.7871.47 (and related stable-channel update notes), ...

CVE-2026-13807

CVE-2026-13807 describes a use-after-free in Import for Google Chrome on iOS, exploited by convincing a user to perform specific UI gestures to run arbitrary code via a malicious file. Affected product: Google Chrome for iOS (before 150.0.7871.47). Root cause: use-after-free in the Import path. I...

CVE-2026-13869

CVE-2026-13869 describes a use-after-free in Device in Google Chrome on Windows, before version 150.0.7871.47. A remote attacker who had already compromised the renderer process could potentially escape the sandbox via a crafted HTML page. The issue is tied to Chromium components and is classifie...

CVE-2026-13954

The CVE-2026-13954 entry concerns Google Chrome on Android with an XML policy enforcement flaw. The issue is described as insufficient policy enforcement in XML that could allow a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. Affected softw...

CVE-2026-13972

CVE-2026-13972 affects Google Chrome (Paint) prior to version 150.0.7871.47. Root cause: Inappropriate implementation in Paint allowing a remote attacker to trigger UI spoofing through a crafted HTML page. Impact is UI spoofing with no data disclosure or other impacts stated; impact categories in...

CVE-2026-13977

CVE-2026-13977 describes an insecure implementation in HTMLParser in Google Chrome/Chromium, enabling UXSS by injecting scripts/HTML through a crafted HTML page. The vulnerability affects Chrome/Chromium builds prior to 150.0.7871.47, with a CVSS v3.1 base score of 5.4 (Medium). The provided docu...

CVE-2026-14008

CVE-2026-14008 describes an uninitialized-use flaw in WebXR within Google Chrome on Android (pre-150.0.7871.47). A crafted HTML page could cause the Chrome process to disclose potentially sensitive memory contents to remote attackers. The impact is information disclosure with a Medium severity pe...

CVE-2026-14010

Google Chrome on Windows is affected by CVE-2026-14010 due to an uninitialized use in codecs prior to version 150.0.7871.47. A remote attacker could read potentially sensitive data from process memory via a crafted HTML page. This affects Chrome on Windows; the vulnerability is categorized as Med...

CVE-2026-14025

CVE-2026-14025 concerns a use-after-free in Chrome’s Views on macOS prior to version 150.0.7871.47, which can lead to heap corruption when a user is tricked into performing specific UI gestures on a crafted HTML page. Affected product: Google Chrome for macOS; vulnerable component: Views; root ca...

CVE-2026-14070

CVE-2026-14070 affects Google Chrome’s WebNN component. The root cause is an integer overflow in WebNN that could allow a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. Affected software is Chrome prior to version 150.0.7871.47; the impact i...

CVE-2026-14101

CVE-2026-14101 affects Google Chrome on macOS before 150.0.7871.47, due to insufficient policy enforcement in the Sandbox component, enabling a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The issue is described across multiple sources (NVD/DEBIAN/RH/EU...

CVE-2026-14408

CVE-2026-14408 affects Google Chrome Dawn prior to 150.0.7871.46, with an uninitialized use in Dawn allowing a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The vulnerability’s impact is described as information disclosure (Medium severity)...

CVE-2026-15120

CVE-2026-15120 affects Google Chrome on Windows (Core). A use-after-free in Core, triggered by a crafted HTML page after renderer compromise, could enable a sandbox escape. Impact is described as high; patch to Chrome 150.0.7871.115 or later (Windows). Exploitation status is not specified in the ...

CVE-2026-15125

The CVE-2026-15125 entry refers to Google Chrome’s Forms handling with an inappropriate implementation, affecting Chrome versions prior to 150.0.7871.115. The root cause is in the Forms component, enabling a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The...

CVE-2026-15767

Summary of CVE-2026-15767 : A heap buffer overflow in libyuv used by Google Chrome on Windows allows remote code execution in the sandbox via a crafted video file. The issue is tied to Chrome prior to version 150.0.7871.125. In the connected advisories, Chrome’s July 2026 Stable Channel update li...

CVE-2026-16419

CVE-2026-16419 : Out-of-bounds read/write in ANGLE affects Google Chrome on Android (pre-150.0.7871.182). The issue could enable a remote attacker to escape the Chrome sandbox via a crafted HTML page. Connected sources confirm Chromium/Chrome involvement and specify ANGLE as the vulnerable compon...

CVE-2026-17677

CVE-2026-17677 is a confirmed issue in ANGLE used by Google Chrome on Android, caused by an inappropriate implementation in ANGLE that could allow a sandbox escape via a crafted HTML page. The advisory states impact as High with potential for sandbox escape, and Chrome has addressed this in the D...

CVE-2026-17688

CVE-2026-17688: In Google Chrome, a Use-After-Free in the Input component was triggered when a renderer process was compromised, potentially enabling a sandbox escape via a crafted HTML page. The description indicates this affects Chrome versions prior to 151.0.7922.72 and is rated High in impact...