CVE-2026-13863

The CVE-2026-13863 entry describes insufficient validation of untrusted input in CustomTabs for Google Chrome on Android, prior to version 150.0.7871.47, enabling a local privilege escalation via a malicious file. Affected component: Chrome’s CustomTabs on Android; root cause: inadequate input va...

CVE-2026-13870

CVE-2026-13870 describes a use-after-free in WebView for Google Chrome on Android, before version 150.0.7871.47. The underlying issue is a use-after-free in WebView that could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The impact is a hig...

CVE-2026-13875

Chrome on Windows is affected by CVE-2026-13875 due to insufficient validation of untrusted input in the GPU, enabling a renderer-compromised attacker to potentially read process memory via a crafted HTML page. The issue is tied to Chromium-based Chrome and is reported as a Medium-severity vulner...

CVE-2026-13881

CVE-2026-13881 details (concrete): In Google Chrome (Chromium WebAppInstalls) before version 150.0.7871.47, an inappropriate implementation allows a remote attacker to bypass the same-origin policy via a crafted HTML page. This is a network-exploitable issue with user interaction required and pot...

CVE-2026-13889

Consolidated analysis for CVE-2026-13889: A side-channel information leakage in WebAuthentication on Google Chrome for iOS (Chromium-based) affects the WebAuthentication component. The vulnerability allows a remote attacker to leak cross-origin data through a crafted HTML page. Affected product/a...

CVE-2026-13891

Vulnerability summary (CVE-2026-13891): Insufficient validation of untrusted input in the Extensions component of Google Chrome up to version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escalate privileges by loading a crafted HTML page. The issue is...

CVE-2026-13899

CVE-2026-13899 affects Google Chrome (Chromium) prior to 150.0.7871.47, with a use-after-free in HTML that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Impact is rated high (C/H/I/A: High). The vulnerability is addressed by updating to Chrome 150....

CVE-2026-13908

CVE-2026-13908 : Insufficient validation of untrusted input in the Omnibox of Google Chrome on iOS (before 150.0.7871.47) could allow a remote attacker to bypass navigation restrictions when a user performs specific UI gestures, via malicious network traffic. The vulnerability is documented with ...

CVE-2026-13910

Summary: CVE-2026-13910 affects Google Chrome on Android, where WebXR policy enforcement is insufficient. The vulnerability could allow a remote attacker to leak cross-origin data through a crafted HTML page. The issue is tied to Chrome/Android WebXR, with the described impact as per multiple sou...

CVE-2026-13922

Summary of CVE-2026-13922 : A side-channel information leak in Chrome’s Paint component allows a remote attacker to exfiltrate cross-origin data via a crafted HTML page. Affected product/version: Google Chrome (Paint functionality) up to version 150.0.7871.47. Root cause: described as a side-chan...

CVE-2026-13938

CVE-2026-13938 affects Google Chrome fonts handling prior to 150.0.7871.47. The underlying issue is an integer overflow in the Fonts component that enables a remote attacker to induce an out-of-bounds memory write via a crafted HTML page. The vulnerability is described with a Chromium-derived sev...

CVE-2026-14021

Affected software: Google Chrome (StorageAccessAPI in Chromium). Vulnerability: insufficient policy enforcement allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Versions: prior to 150.0.7871.47. Impact: cross-origin data leakage...

CVE-2026-14033

CVE-2026-14033: Google Chrome on Windows has insufficient policy enforcement in Media, enabling a remote bypass of site isolation through a crafted HTML page. Affects Chrome versions prior to 150.0.7871.47; the issue is mitigated by upgrading to 150.0.7871.47 or later. Exploitation details are no...

CVE-2026-14035

Technical details for CVE-2026-14035 are not publicly available in the provided documents; monitor for updates from vendors and security advisories.

CVE-2026-14071

CVE-2026-14071 describes a side-channel information leakage in WebAudio of Google Chrome, where a remote attacker could leak cross-origin data via a crafted HTML page. The vulnerability affects Chrome prior to version 150.0.7871.47. The available connected documents consistently indicate the issu...

CVE-2026-14088

CVE-2026-14088 concerns an uninitialized-use vulnerability in Canvas within Google Chrome on Android . The issue allows a remote attacker to potentially read sensitive information from the process memory through a crafted HTML page, with the impact described as confidential data exposure and the ...

CVE-2026-14114

The vulnerability CVE-2026-14114 affects Google Chrome on Android (WebAppInstalls component). An inappropriate implementation allows a local attacker to spoof UI via a malicious file. Root cause: flawed handling in WebAppInstalls leading to UI spoofing. Affected version: Chrome for Android prior ...

CVE-2026-14147

CVE-2026-14147 concerns Google Chrome prior to 150.0.7871.47, where an inappropriate implementation in CSS enables UXSS by a crafted HTML page. The vulnerability permits a remote attacker to inject arbitrary scripts or HTML, potentially affecting user sessions and page content (impacting confiden...

CVE-2026-15122

CVE-2026-15122 affects Google Chrome on Windows prior to 150.0.7871.115, where insufficient validation of untrusted input in Codecs can allow a renderer process–compromised attacker to attempt a sandbox escape via a crafted HTML page. The CVE is referenced in Chrome’s July 2026 stable update (Win...

CVE-2026-15773

CVE-2026-15773 is a Use-After-Free in Chrome’s Core on Windows prior to 150.0.7871.125 that could allow a remote attacker to achieve a sandbox escape via a crafted HTML page. The vulnerability affects Google Chrome Windows builds and is tracked in multiple sources. No exploitation status is provi...

CVE-2026-16414

CVE-2026-16414 affects Chromium-based Chrome/Chromium with insufficient validation of untrusted input in Chromecast, enabling potential sandbox escapes via crafted network traffic. Affected versions are prior to 150.0.7871.182 (Chromium security note: High). Public advisories and distro trackers ...

CVE-2026-17677

CVE-2026-17677 is a confirmed issue in ANGLE used by Google Chrome on Android, caused by an inappropriate implementation in ANGLE that could allow a sandbox escape via a crafted HTML page. The advisory states impact as High with potential for sandbox escape, and Chrome has addressed this in the D...

CVE-2026-17678

CVE-2026-17678 is an Out of bounds read in ANGLE used by Google Chrome before 151.0.7922.72, potentially allowing a renderer compromise to escape the sandbox via a crafted HTML page. The vulnerability is tied to ANGLE within Chrome (desktop). Remediation per the linked Chrome stable update is to ...

CVE-2026-17778

CVE-2026-17778 is a use-after-free vulnerability in Google Chrome’s Extensions component. The issue permits a remote attacker to execute arbitrary code inside a sandbox by convincing a user to install a crafted Chrome Extension; impact is described as arbitrary code execution with sandbox constra...

CVE-2026-17798

Summary: CVE-2026-17798 affects Google Chrome’s Cast component, where an inappropriate implementation allows a remote attacker to leak cross-origin data via a crafted HTML page. What’s affected: Chrome builds prior to 151.0.7922.72 (Chromium baseline). Impact: Cross-origin data leakage; no exploi...

CVE-2026-17819

CVE-2026-17819 describes an inappropriate implementation in the WebAppInstalls component of Google Chrome (Chromium) up to version 151.0.7922.72, enabling a remote attacker to perform UI spoofing via a crafted HTML page. Affected product/component is the Chrome/Chromium WebAppInstalls path; root ...

CVE-2026-17833

CVE-2026-17833 affects Google Chrome (Chromium-based). Root cause: Inappropriate implementation in Passwords allows a remote attacker to leak cross-origin data via a crafted HTML page. Impact per sources: cross-origin data leakage; severity listed as Medium. Affected version: Chrome prior to 151....

CVE-2026-17911

CVE-2026-17911 affects Google Chrome prior to 151.0.7922.72, where insufficient policy enforcement in SVG could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is described with a Chromium-based impact of data leakage (CVSS: Medium, 4.3) and does not i...

CVE-2026-17915

CVE-2026-17915 affects Google Chrome on Android WebView prior to 151.0.7922.72 due to an inappropriate WebView implementation. This allows a remote attacker to perform UI spoofing via a crafted HTML page. The Chromium advisory lists the impact as Low; no exploits are described in the provided doc...

CVE-2026-17950

CVE-2026-17950 affects Google Chrome on macOS due to an inappropriate Safebrowsing implementation. A remote attacker could execute arbitrary code via a malicious file in versions prior to 151.0.7922.72 (Chromium security severity: Low; CVSSv3.1 base score 8.8). Root cause: flawed Safebrowsing log...

CVE-2026-17976

Google Chrome (

CVE-2026-17992

CVE-2026-17992 affects Google Chrome on Windows prior to 151.0.7922.72 due to an uninitialized use in Skia. The issue could allow a remote attacker to reading potentially sensitive information from process memory via a crafted HTML page. The Chromium note lists the severity as Low and does not in...

CVE-2026-3540

CVE-2026-3540: In Google Chrome, an inappropriate WebAudio implementation allowed remote attackers to trigger out-of-bounds memory access via a crafted HTML page. This vulnerability affects Chrome prior to version 145.0.7632.159. The Chrome security update (Stable Channel) 145.0.7632.159/160 for ...

CVE-2026-4441

CVE-2026-4441 is a Google Chrome/Chromium use-after-free in the Base component causing potential heap corruption on crafted HTML pages, fixed in Chrome 146.0.7680.153 (and Linux/builds referenced by Debian: 146.0.7680.153-1~deb12u1/ -1~deb13u1). Affected product: Google Chrome (Chromium core); ro...

CVE-2026-4442

CVE-2026-4442 is a Chrome/Chromium-related vulnerability described as a heap buffer overflow in CSS that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Google Chrome prior to 146.0.7680.153. Impact as stated: high severity with potential for arbi...

CVE-2026-4463

CVE-2026-4463 is a heap buffer overflow in Chrome’s WebRTC component that could allow remote heap corruption via a crafted HTML page. Affected product: Google Chrome (WebRTC path); root cause: heap buffer overflow; impact: high (remote code execution/impact on confidentiality, integrity, availabi...

CVE-2026-4675

CVE-2026-4675 details (concrete): Heap buffer overflow in WebGL within Google Chrome before version 146.0.7680.165. The issue allows a remote attacker to trigger an out-of-bounds memory read by processing a crafted HTML page. Affected component: WebGL in Chrome (browser rendering stack); underlyi...

CVE-2026-5897

CVE-2026-5897 affects Google Chrome/Chromium before version 147.0.7727.55, where an incorrect security UI in Downloads could enable UI spoofing via a crafted HTML page if the user performed specific UI gestures. Connected reports show Chromium/Chromium-based Chrome updates across multiple distros...

CVE-2026-5899

CVE-2026-5899 affects Chromium/Google Chrome History Navigation; root cause is insufficient policy enforcement allowing UXSS via crafted HTML and specific UI gestures. Impact: remote attacker could inject scripts/HTML. Remediation: update to patched Chromium/Chrome versions (examples seen in Fedo...

CVE-2026-6301

The CVE-2026-6301 entry concerns a Type Confusion in the Turbofan JIT of Google Chrome, prior to version 147.0.7727.101. A crafted HTML page could cause a sandboxed remote-code execution due to the underlying type confusion in Turbofan. The connected document confirms the vulnerability but does n...

CVE-2026-7334

CVE-2026-7334 is a report of a Use-After-Free in the Chromium-based Google Chrome browser’s Views component on macOS, leading to potential heap corruption via a crafted HTML page. The issue affects Google Chrome versions before 147.0.7727.138; multiple sources (NVD, Debian, Red Hat, EUVD) describ...

CVE-2026-7959

CVE-2026-7959 affects Google Chrome prior to 148.0.7778.96. The vulnerability is described as an Inappropriate implementation in Navigation that could allow a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Connected sources (DEBIAN-CVE-2...

CVE-2026-8544

CVE-2026-8544 affects Google Chrome’s Media component. A use-after-free in Media could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, with the impact described as High (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected versions are Chr...

CVE-2026-8574

This CVE concerns Google Chrome on Windows, where a Use-after-Free in Core could let a remote attacker who already compromised the renderer process escape the sandbox via a crafted HTML page. Affected versions are before 148.0.7778.168. The root cause is a use-after-free in Core; the document spe...

CVE-2026-9119

CVE-2026-9119 describes a heap buffer overflow in WebRTC within Google Chrome prior to 148.0.7778.179, leading to potential remote code execution in the browser sandbox via a crafted HTML page. Affected component is Chrome's WebRTC stack; root cause is a heap buffer overflow. Impact stated: remot...

CVE-2026-9120

CVE-2026-9120 : A use-after-free vulnerability in Chrome’s WebRTC codebase allows remote arbitrary code execution via a crafted HTML page. Affected software: Google Chrome (WebRTC component) prior to version 148.0.7778.179. Root cause: use-after-free in WebRTC. Impact: high-severity remote code e...

CVE-2026-9905

CVE-2026-9905 is a Use-after-free in Chrome’s Accessibility component on Windows, potentially enabling a sandbox escape via a crafted HTML page when the renderer is compromised. Multiple sources (NVD, ENISA EUVD-2026-33200, Red Hat, Debian, OSV) describe the issue with the same root cause and imp...

CVE-2026-9916

CVE-2026-9916 affects the ANGLE component in Google Chrome prior to 148.0.7778.216. The issue is an out-of-bounds write in ANGLE that could allow a remote attacker who has already compromised the renderer process to attempt a sandbox escape via a crafted HTML page. The vulnerability is documented...

CVE-2026-9935

Summary (CVE-2026-9935): Uninitialized Use in ANGLE affects Google Chrome’s ANGLE component, prior to version 148.0.7778.216. The root cause is an uninitialized use flaw in ANGLE, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The CVSSv3.1 vector (AV:N/AC:L/PR:N...

CVE-2026-9945

Google Chrome (Chromium) for Windows is affected by a use-after-free in the Media component, allowing remote code execution inside the Chrome sandbox via a crafted HTML page. Affected versions are prior to 148.0.7778.216. Upstream bug 503565293 is cited, and the Chrome stable update referenced in...