CVE-2026-11283

The CVE-2026-11283 entry concerns Google Chrome on macOS where Shortcuts mishandles untrusted input due to insufficient validation, allowing a remote attacker to bypass navigation restrictions via a malicious file. Affected product/version: Chrome for macOS, before 149.0.7827.53. Root cause: inad...

CVE-2026-11639

CVE-2026-11639 describes a use-after-free in the Compositing path of Google Chrome on macOS prior to version 149.0.7827.103, allowing a remote attacker to execute arbitrary code via a crafted HTML page. The issue is labeled Critical in Chromium terms, with network attack vector, high impact on co...

CVE-2026-12447

CVE-2026-12447 affects Google Chrome/WebRTC (Chromium). The issue is a heap buffer overflow in WebRTC that allows remote code execution via a crafted HTML page, affecting builds prior to 149.0.7827.155. Impact is a sandbox escape/total compromise of the browser process, per the cited descriptions...

CVE-2026-13779

CVE-2026-13779 : Use after free in Chromoting of Google Chrome on ChromeOS, prior to 150.0.7871.47. This allows a remote attacker to execute arbitrary code via malicious network traffic (Chromium security severity: Critical). Connected sources corroborate the issue in Chromoting/Ursos components ...

CVE-2026-13797

CVE-2026-13797 (Chromecast in Google Chrome) : The issue is caused by insufficient validation of untrusted input in Chromecast-related components of Chrome before version 150.0.7871.47. If an attacker could lure a user to load a crafted HTML page and compromised the renderer process, they could p...

CVE-2026-13806

CVE-2026-13806 affects Google Chrome on desktop. The vulnerability arises from insufficient validation of untrusted input in Accessibility, allowing a renderer process compromise to bypass site isolation via a crafted HTML page. Affected versions are prior to 150.0.7871.47. The Chrome stable chan...

CVE-2026-13825

CVE-2026-13825 describes an uninitialized use in Dawn within Google Chrome (Chromium-based) prior to version 150.0.7871.47, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product: Google Chrome (Chromium Dawn component). Root cause: uninitializ...

CVE-2026-13853

CVE-2026-13853 — Use-after-free in Journeys of Google Chrome prior to 150.0.7871.47 could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. Affected: Chrome (Journeys) with renderer process involvement; root cause: use-after-free in Journeys. Impact: pote...

CVE-2026-13883

CVE-2026-13883 describes a Type Confusion in ANGLE used by Google Chrome prior to 150.0.7871.47 that can potentially allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability impact is described as high/critical (CVSS v3.1 base score 9.6) with network attack v...

CVE-2026-13900

CVE-2026-13900 concerns Chromecast in Google Chrome. A flawed implementation allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. Affected software is Chrome/Chromecast prior to version 150.0.7871.47. This could enable navig...

CVE-2026-13903

CVE-2026-13903 affects Google Chrome’s Bluetooth implementation. The connected records describe insufficient policy enforcement in Chrome prior to version 150.0.7871.47, enabling privilege escalation via a crafted HTML page. There is no explicit exploitation detail or confirmed in-the-wild use in...

CVE-2026-13976

CVE-2026-13976 : In Google Chrome, insufficient data validation in Storage prior to 150.0.7871.47 could allow a remote attacker who has compromised a renderer process to potentially perform a sandbox escape via a crafted HTML page. This vulnerability has a Medium severity (CVSS 3.1: AV:N/AC:H/PR:...

CVE-2026-13977

CVE-2026-13977 describes an insecure implementation in HTMLParser in Google Chrome/Chromium, enabling UXSS by injecting scripts/HTML through a crafted HTML page. The vulnerability affects Chrome/Chromium builds prior to 150.0.7871.47, with a CVSS v3.1 base score of 5.4 (Medium). The provided docu...

CVE-2026-14005

Google Chrome for Android is affected by a use-after-free in Omnibox leading to potential heap corruption via a crafted HTML page. This vulnerability requires user interaction (UI gestures) and can impact confidentiality, integrity, and availability as per CVSS. Affected component: Chrome Android...

CVE-2026-14068

Vulnerability: CVE-2026-14068 affects Google Chrome on iOS, caused by an inappropriate implementation in the Omnibox. The issue enables UXSS via a crafted HTML page when a user is induced to perform specific UI gestures, using Chrome versions prior to 150.0.7871.47. Impact is described as low sev...

CVE-2026-14145

CVE-2026-14145 corresponds to an UXSS issue in Google Chrome caused by an inappropriate CSS implementation, permitting a remote attacker to inject arbitrary scripts/HTML via a crafted HTML page. Affected software is Chrome (pre-150.0.7871.47). The underlying impact is confined to user-level data ...

CVE-2026-14381

CVE-2026-14381 affects Google Chrome’s WebAppInstalls UI. A crafted HTML page can trigger UI spoofing due to an incorrect security UI in WebAppInstalls prior to Chrome 150.0.7871.46. Impact: remote attacker could spoof UI. Mitigation: update to Chrome 150.0.7871.46 or later (Chromium-based). Refe...

CVE-2026-15777

CVE-2026-15777 – Use-after-free in the Chrome UI on Linux prior to 150.0.7871.125 can allow a remote attacker to induce heap corruption by tricking a user into performing specific UI gestures on a crafted HTML page. Affected product: Google Chrome (Linux UI subsystem). Root cause: use-after-free ...

CVE-2026-15778

CVE-2026-15778 affects Google Chrome navigation logic prior to version 150.0.7871.125, due to insufficient validation of untrusted input in Navigation. An attacker who compromises the renderer could bypass navigation restrictions via a crafted HTML page. The issue is addressed in Chrome 150.0.787...

CVE-2026-16419

CVE-2026-16419 : Out-of-bounds read/write in ANGLE affects Google Chrome on Android (pre-150.0.7871.182). The issue could enable a remote attacker to escape the Chrome sandbox via a crafted HTML page. Connected sources confirm Chromium/Chrome involvement and specify ANGLE as the vulnerable compon...

CVE-2026-16420

CVE-2026-16420 is a Type Confusion in WebAudio affecting Google Chrome prior to 150.0.7871.182 (Chromium). The flaw, exploitable via a crafted HTML page, allows remote code execution inside the sandbox. Affected product: Google Chrome (older than 150.0.7871.182). Remediation: upgrade to Chrome 15...

CVE-2026-17702

CVE-2026-17702 concerns an inappropriate implementation in Skia used by Google Chrome before 151.0.7922.72. The issue enables a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HTML page. The Chromium advisory assigns a High severity, no...

CVE-2026-17780

The CVE-2026-17780 issue affects Google Chrome/Chromium’s Isolated Web Apps component. An inappropriate implementation allowed a remote attacker to bypass navigation restrictions using a crafted HTML page, in versions prior to 151.0.7922.72. Impact is described as a bypass of navigation controls ...

CVE-2026-17786

CVE-2026-17786 : Insufficient validation of untrusted input in DevTools of Google Chrome (before 151.0.7922.72) allows an attacker who tricks a user into installing a malicious extension to escalate privileges via a crafted Chrome Extension. Affected component: DevTools in Chrome. Root cause: ins...

CVE-2026-17854

The CVE-2026-17854 entry concerns Google Chrome/Chromium WebMCP with insufficient policy enforcement, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected product is Chromium-based; the vulnerability is tied to WebMCP in Chrome prior to version 151.0.7922....

CVE-2026-17864

CVE-2026-17864: In Google Chrome on macOS, the Updater has an inappropriate implementation flaw prior to version 151.0.7922.72 that enables local attackers to escalate privileges via a malicious file. Affected component: Chrome for macOS updater; root cause: improper Updater implementation. Impac...

CVE-2026-17906

CVE-2026-17906: Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue affects Chrome/Chromium’s Bluetooth handling...

CVE-2026-17936

CVE-2026-17936: In Google Chrome, an inappropriate DevTools implementation before version 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability affects the Chrome/Chromium DevTools c...

CVE-2026-17975

CVE-2026-17975 : An inappropriate implementation flaw was found in the IME component of the Chromium-based Google Chrome browser on macOS, prior to version 151.0.7922.72. The issue could allow a remote attacker to potentially obtain sensitive information from process memory via a crafted HTML pag...

CVE-2026-17982

CVE-2026-17982 affects Google Chrome (Cast) with insufficient validation of untrusted input in Cast, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact: potential cross-origin issues; severity deemed Low by Chromium. Affected versions are Chrome prior to 1...

CVE-2026-4446

Summary: CVE-2026-4446 is a use-after-free in WebRTC within Google Chrome, related to heap corruption via a crafted HTML page. Affected product/version: Google Chrome prior to 146.0.7680.153 (WebRTC component). Root cause / vulnerability detail: Use-after-free in WebRTC handling, enabling potenti...

CVE-2026-4449

CVE-2026-4449 is aUse-after-Free in Blink affecting Google Chrome prior to 146.0.7680.153, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability is described in multiple sources as a use-after-free in Blink that could lead to arbitrary code e...

CVE-2026-5284

CVE-2026-5284 is a use-after-free vulnerability in Dawn (Chromium-based) present in Google Chrome before version 146.0.7680.178. A remote attacker who has compromised the renderer process could execute arbitrary code via a crafted HTML page. Severity is High; CVSS 3.1 base score 7.5 (AV:N/AC:H/PR...

CVE-2026-5871

CVE-2026-5871 is a Type Confusion in the V8 engine used by Google Chrome/Chromium. The initial description states that older Chrome builds were vulnerable to remote code execution inside the sandbox via a crafted HTML page. Connected sources corroborate involvement of Chromium/Chrome components a...

CVE-2026-5908

CVE-2026-5908 affects Chromium/Google Chrome where a vulnerability in the Media component allows an attacker to trigger an integer overflow, potentially leading to heap corruption via a crafted video file. The issue is associated with Chrome/Chromium security updates fixing this and related CVEs ...

CVE-2026-6297

CVE-2026-6297 is a use-after-free in the Proxy component of Google Chrome fixed in version 147.0.7727.101. The vulnerability could allow a privileged network-position attacker to potentially perform a sandbox escape via a crafted HTML page. The description specifies the affected product as Google...

CVE-2026-6360

Google Chrome vulnerability CVE-2026-6360: Use-after-free in FileSystem prior to 147.0.7727.101 allows remote exploitation via a crafted HTML page, potentially causing object corruption. Severity: High. Mitigation: upgrade to Chrome 147.0.7727.101 or later.

CVE-2026-7908

CVE-2026-7908 describes a use-after-free in Chrome’s Fullscreen handling that could allow a sandbox escape via a crafted HTML page. Affected component is the browser’s Fullscreen code path in Chromium. The issue is tied to Google Chrome before version 148.0.7778.96 (stable release 148); the Chrom...

CVE-2026-7914

CVE-2026-7914 describes a Type Confusion in Chrome on Windows (Accessibility component) that could allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page. The issue affects Google Chrome before version 148.0.7778.96. The root cause is a type confusion in the Accessibi...

CVE-2026-7975

CVE-2026-7975 : Use-after-free in Chrome DevTools prior to 148.0.7778.96. A remote attacker who can compromise the renderer could potentially escape the sandbox via a crafted HTML page. Affected software is Google Chrome (DevTools component). The vulnerability arises from memory corruption (use-a...

CVE-2026-8015

CVE-2026-8015: In Google Chrome, an inappropriate implementation in Media allows a remote attacker to perform UI spoofing via a crafted HTML page. Affected versions are Chrome before 148.0.7778.96. The issue is classified with a Low severity in Chromium’s security metrics, with network attack vec...

CVE-2026-8018

CVE-2026-8018 describes insufficient policy enforcement in Chrome’s DevTools prior to 148.0.7778.96, enabling a remote attacker to potentially perform a sandbox escape through malicious network traffic. The vulnerability affects Google Chrome (DevTools component) and is categorized with a Chromiu...

CVE-2026-8019

CVE-2026-8019 describes insufficient policy enforcement in the Chrome WebApp, allowing a remote attacker to trigger UI spoofing through a crafted HTML page in Chrome versions before 148.0.7778.96. The root cause is restricted policy enforcement within WebApp handling. Impact is UI spoofing; no ex...

CVE-2026-8555

CVE-2026-8555 pertains to a use-after-free in GTK used by Google Chrome on Windows, affecting Chromium GTK integration. The vulnerability arises in GTK components when handling crafted HTML pages, enabling a remote attacker to execute arbitrary code. The issue is reported for Chrome builds prior ...

CVE-2026-9884

CVE-2026-9884 describes a Use-after-Free in the Google Chrome browser on macOS that allows remote code execution via a crafted HTML page. Affected product/component: Google Chrome (Mac), Chromium-based browser. Root cause: use-after-free in the Browser object. Impact: arbitrary code execution wit...

CVE-2026-9896

CVE-2026-9896 is an out-of-bounds write in the V8 engine of Google Chrome, affecting Chrome versions prior to 148.0.7778.216. The vulnerability could allow a remote attacker to execute arbitrary code within the browser sandbox via a crafted HTML page. The issue is mapped across multiple feeds (NV...

CVE-2026-9939

CVE-2026-9939 is a heap buffer overflow in the WebCodecs component of Google Chrome prior to 148.0.7778.216. The issue enables a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. Root cause: a heap buffer overflow in WebCodecs. Affected product/version: Go...

CVE-2026-9942

CVE-2026-9942 reflects an uninitialized use flaw in ANGLE within Google Chrome prior to 148.0.7778.216. The issue allows a remote attacker who has already compromised the renderer process to bypass site isolation via a crafted HTML page. Affected component: ANGLE in Chromium-based Chrome. Root ca...

CVE-2026-9978

CVE-2026-9978: Use-after-free in the Glic component of Google Chrome (Chromium) allows remote code execution via a crafted HTML page. Affected: Google Chrome, prior to version 148.0.7778.216; root cause is a use-after-free in Glic. Impact: arbitrary code execution inside the sandbox with high sev...

CVE-2026-9981

CVE-2026-9981 affects Google Chrome’s Skia component (pre-148.0.7778.216). The vulnerability is an inappropriate implementation that could allow a remote attacker to extract potentially sensitive data from a process’s memory via a crafted HTML page. Impact is described as exposure of memory conte...