CVE-2026-8527

CVE-2026-8527 : In Google Chrome, insufficient validation of untrusted input in Downloads allows a remote attacker to execute arbitrary code via a crafted HTML page. Affected: Chrome (Chromium-based) prior to 148.0.7778.168. Root cause: input validation in the Downloads path. Impact: high severit...

CVE-2026-8581

CVE-2026-8581 : A use‑after‑free vulnerability in Chrome’s GPU stack (Chromium) allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected software is Google Chrome with GPU acceleration; impact is remote code execution with high confidentiality/integrit...

CVE-2026-9111

The CVE-2026-9111 entry describes a use-after-free in WebRTC within Google Chrome on Linux before version 148.0.7778.179, enabling a remote attacker to execute arbitrary code via a crafted HTML page. Affected component: WebRTC in Chrome/Chromium (Linux builds). Root cause: use-after-free vulnerab...

CVE-2026-9122

CVE-2026-9122 : Out-of-bounds read in the GPU component of Google Chrome on macOS, before version 148.0.7778.179. A remote attacker could read potentially sensitive data from process memory via a crafted HTML page. Existence of fixed version is implied by the version boundary; update to the patch...

CVE-2026-9906

CVE-2026-9906 is a GPU-related out-of-bounds write in Google Chrome prior to 148.0.7778.216. The flaw, affecting the Chromium GPU component, could allow a remote attacker who has compromised a renderer process to potentially escape the sandbox via a crafted HTML page. The Chrome update notes indi...

CVE-2026-9926

CVE-2026-9926 describes a heap buffer overflow in the ANGLE component of Google Chrome, prior to 148.0.7778.216. A remote attacker who has already compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page. The issue is tied to ANGLE in Chromium-based Chro...

CVE-2026-9989

The CVE-2026-9989 entry concerns Google Chrome’s Media component, with an inappropriate implementation that allowed a remote attacker to bypass the same-origin policy via a crafted video file. Affected software is Google Chrome prior to 148.0.7778.216; impact is the bypass of SOP, as described in...

CVE-2025-11215

CVE-2025-11215 refers to an off-by-one error in the V8 engine of Google Chrome/Chromium that allows a remote attacker to cause an out-of-bounds memory read via a crafted HTML page. The documented impact is a medium severity (CVSS 3.1: 4.3) with network attack vector, no privileges, and user inter...

CVE-2025-12905

CVE-2025-12905 affects Google Chrome on Windows: an Inappropriate implementation in Downloads allows bypass of Mark of the Web via a crafted HTML page. Root cause is improper handling in Chrome’s Downloads feature prior to 140.0.7339.80. Impact is bypass of a security boundary (MOF) with low seve...

CVE-2025-12909

CVE-2025-12909 affects Google Chrome via Devtools: Insufficient policy enforcement in Devtools allows a remote attacker to leak cross-origin data. The vulnerability is tied to Chrome versions before 140.0.7339.80. Affected component: Devtools policy enforcement in Chrome/Chromium. Impact per sour...

CVE-2026-10884

The connected sources confirm a use-after-free in Chromecast within Google Chrome before version 149.0.7827.53. If a renderer process is compromised, an attacker could potentially escape the sandbox via a crafted HTML page. The issue is labeled as Critical in Chromium’s security notes, and the Ch...

CVE-2026-10894

CVE-2026-10894 (Chrome on Linux): Use-after-free in Printing component allows sandbox escape when a renderer is compromised via a crafted HTML page. Affected: Google Chrome for Linux prior to 149.0.7827.53. Impact as stated: remote attacker could potentially escape the sandbox. Root cause per des...

CVE-2026-10906

CVE-2026-10906 : Use-after-free in WebAuthentication of Google Chrome before 149.0.7827.53 allows a remote attacker, user must engage in specific UI gestures, potentially leading to heap corruption via a crafted HTML page. Affected component: WebAuthentication in Chrome/Chromium stack. Root cause...

CVE-2026-10926

The CVE-2026-10926 entry describes a use-after-free in Cast in Google Chrome prior to 149.0.7827.53, enabling an attacker on the local network segment to execute arbitrary code via crafted network traffic. Affected component: Cast in Chrome (Chromium-derived). Impact is high (per Chromium advisor...

CVE-2026-10938

CVE-2026-10938 affects Google Chrome before version 149.0.7827.53, where an inappropriate implementation in the Input handling of the renderer process allows a remote attacker who has compromised the renderer to bypass site isolation via a crafted HTML page. The impact is described as high (I/H) ...

CVE-2026-10945

Summary: CVE-2026-10945 is a use-after-free in Google Chrome’s PDF handling prior to 149.0.7827.53. A remote attacker could lure a user into specific UI gestures to trigger execution of arbitrary code inside the browser sandbox via a crafted PDF file. The impact is high (arbitrary code execution ...

CVE-2026-10949

Summary of CVE-2026-10949 : A heap buffer overflow in Chrome’s Video component allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected product is Google Chrome (before build 149.0.7827.53). The vulnerability is ...

CVE-2026-10950

CVE-2026-10950 affects Google Chrome on iOS (Autofill) where insufficient policy enforcement allowed a remote attacker to exfiltrate cross-origin data via a crafted HTML page. The issue is tied to Autofill handling in Chrome for iOS before version 149.0.7827.53. A patch is expected in 149.0.7827....

CVE-2026-10960

CVE-2026-10960 affects Google Chrome on all platforms where the Codecs component handles uninitialized state. The connected documents specify that prior to version 149.0.7827.53, an uninitialized use in Codecs allowed a remote attacker who had compromised the renderer process to potentially escap...

CVE-2026-10974

Summary : CVE-2026-10974 affects ANGLE in Google Chrome prior to 149.0.7827.53. The issue is insufficient validation of untrusted input in ANGLE, which could allow a remote attacker to perform a sandbox escape via a crafted HTML page. The known severity is high (NVD and EUVD references list a bas...

CVE-2026-10996

CVE-2026-10996 describes an inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability affects Google Chrome (Chromium-based) and is addressed by updating to Chrome 149....

CVE-2026-10997

CVE-2026-10997 affects Google Chrome extensions due to insufficient policy enforcement in Extensions, allowing a user to be persuaded to install a crafted malicious extension to bypass discretionary access control. Affected software is Chrome (Chromium-based) with the specific fix in version 149....

CVE-2026-11004

CVE-2026-11004 refers to an out-of-bounds read in ANGLE used by Google Chrome prior to 149.0.7827.53. A remote attacker who has compromised the renderer could obtain potentially sensitive information from process memory via a crafted HTML page. The issue is addressed in Chrome 149.0.7827.53 (and ...

CVE-2026-11006

This CVE (CVE-2026-11006) affects Google Chrome prior to 149.0.7827.53, specifically the Dawn component. The root cause is an out-of-bounds read in Dawn, exploitable via a crafted HTML page by a remote attacker. The vulnerability impacts Chrome on desktop environments and is addressed by the Chro...

CVE-2026-11049

The CVE-2026-11049 entry concerns a use-after-free in Google Chrome’s Password Manager (Chromium-based) prior to 149.0.7827.53, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected component: Password Manager; root cause: use-after-free. Impact: ...

CVE-2026-11081

CVE-2026-11081 describes an insecure implementation in Canvas within Google Chrome prior to 149.0.7827.53 that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue affects Chrome’s Canvas handling and is rated with CVSS v3.1: High impact on integrity, no c...

CVE-2026-11086

Summary: CVE-2026-11086 describes an insecure implementation in Chrome’s Dawn component that allowed a remote attacker who had already compromised the renderer process to run arbitrary code inside the Chromium sandbox via a crafted HTML page. Affected software: Google Chrome (Dawn) prior to versi...

CVE-2026-11098

CVE-2026-11098 affects the GPU component in Google Chrome (Chromium-based) where there is insufficient validation of untrusted input prior to version 149.0.7827.53. The vulnerability could allow a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted...

CVE-2026-11105

This CVE describesInsufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53. A remote attacker that already compromised the renderer process could leak cross-origin data through a crafted HTML page. Affected software is Google Chrome (WebUI component); impact is ...

CVE-2026-11106

Summary: CVE-2026-11106 describes an inappropriate implementation in Media in Google Chrome (Chromium-based) prior to 149.0.7827.53 that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects the Chrome/Chromium media pipeline and is rated Medium se...

CVE-2026-11123

CVE-2026-11123 concerns an Uninitialized Use in ANGLE within Google Chrome/Chromium prior to version 149.0.7827.53. The issue could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page (impact: information disclosure). Connected documents...

CVE-2026-11127

CVE-2026-11127 involves an inappropriate implementation in the WebAPKs component of Google Chrome/Chromium. The issue, described as a domain spoofing vulnerability via a crafted WebAPK, affects Chrome/Chromium builds prior to version 149.0.7827.53 (on Android for WebAPKs; Debian mentions multiple...

CVE-2026-11138

CVE-2026-11138 affects Google Chrome via an uninitialized use flaw in ANGLE. The vulnerability could allow a remote attacker to leak cross-origin data through a crafted HTML page, involving a network attack vector with low attack complexity but requiring user interaction. The published data indic...

CVE-2026-11144

Consolidated details for CVE-2026-11144: A use-after-free in the Media component of Google Chrome (Chromium-based) allows a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted video file. Affected software: Google Chrome versions before 149.0.7827.53. Root cause: use-a...

CVE-2026-11155

CVE-2026-11155 describes an inappropriate implementation in CSS in Google Chrome that, before version 149.0.7827.53, allowed a remote attacker to leak cross-origin data via a crafted HTML page. The underlying issue is in Chrome’s CSS handling (Chromium-based), creating potential cross-origin data...

CVE-2026-11161

CVE-2026-11161 affects Google Chrome due to an inappropriate implementation in DataTransfer. A crafted HTML page can leak cross-origin data, as described for Chrome versions prior to 149.0.7827.53. The described impact is a cross-origin data leak with Medium severity. The fix is to update to Chro...

CVE-2026-11179

CVE-2026-11179 concerns Google Chrome/Chromium: an inappropriate ORB implementation allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected software: Chrome prior to version 149.0.7827.53. The impact is described as bypassing site isolation, enabling potential cross-o...

CVE-2026-11183

CVE-2026-11183 describes an out-of-bounds read in GWP-ASan used by Google Chrome, allowing a local attacker to read potentially sensitive data from a process’s memory via a malicious file. Affected software: Google Chrome (GWP-ASan component). Impact: potential exposure of sensitive information; ...

CVE-2026-11195

CVE-2026-11195 : In Google Chrome, an inappropriate implementation in MHTML handling allows a remote attacker to leak cross-origin data via a crafted HTML page when a user is induced to perform specific UI gestures. Affected product/component: Chrome/MHTML. Root cause: improper implementation in ...

CVE-2026-11203

CVE-2026-11203 describes an inappropriate implementation in the GPU component of Google Chrome on macOS , affected prior to version 149.0.7827.53 . This flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page, with the impact described as high confidentiality risk and...

CVE-2026-11209

CVE-2026-11209 applies to Google Chrome, affecting the Passwords implementation prior to version 149.0.7827.53. The issue arises from an inappropriate implementation that allows a remote attacker who has compromised the renderer process to read potentially sensitive information from process memor...

CVE-2026-11223

CVE-2026-11223 describes insufficient validation of untrusted input in Google Chrome’s Network component prior to 149.0.7827.53. A remote attacker who has compromised the renderer process could bypass the same-origin policy via a crafted HTML page. The root cause is insufficient input validation ...

CVE-2026-11233

CVE-2026-11233 affects Google Chrome’s FoldableAPIs. The issue is insufficient policy enforcement allowing a remote attacker who has compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Impact is limited to confidentiality (information exposure) and could ena...

CVE-2026-11635

Summary: CVE-2026-11635 is a use-after-free in Chrome’s Bluetooth stack on macOS prior to 149.0.7827.103. If a renderer process is already compromised, this flaw could enable a sandbox escape via a crafted HTML page. Affected product/version: Google Chrome on macOS, before version 149.0.7827.103....

CVE-2026-12450

CVE-2026-12450 describes an inappropriate implementation in the Media component of Google Chrome (Chromium-based) prior to build 149.0.7827.155. The underlying issue allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability...

CVE-2026-13839

CVE-2026-13839 corresponds to an issue in Google Chrome (CSS handling) where an inappropriate CSS implementation allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected software: Google Chrome prior to version 150.0.7871.47. Root cause: CSS/HTML rendering path...

CVE-2026-13844

CVE-2026-13844 describes a use-after-free flaw in the Google Chrome Updater on Windows, before version 150.0.7871.47, enabling a local attacker to achieve OS-level privilege escalation via a malicious file. Affected software: Google Chrome and its Updater components on Windows. Root cause: use-af...

CVE-2026-13846

CVE-2026-13846 affects Google Chrome on macOS, caused by a use-after-free in USB handling that could allow a sandbox escape when a renderer process is compromised and a crafted HTML page is loaded. Impact described as high/highest severity; no exploitation details are provided in the source docum...

CVE-2026-13847

Chrome for iOS (Google Chrome on iOS) is affected by CVE-2026-13847 due to insufficient validation of untrusted input, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects Chrome on iOS prior to version 150.0.7871.47. Impact is cross-origin data ...

CVE-2026-13855

CVE-2026-13855 involves a use-after-free in the Ozone component of Google Chrome on Linux, prior to version 150.0.7871.47. The vulnerability allows a remote attacker to trigger arbitrary code execution by persuading a user to perform specific UI gestures on a crafted HTML page. The issue is descr...