CVE-2026-13856

The CVE-2026-13856 entry concerns Google Chrome on Android, where insufficient validation of untrusted input in Speech enables privilege escalation. A renderer-compromised remote attacker could escalate via a crafted HTML page before version 150.0.7871.47. Affected component: Speech in Chrome’s A...

CVE-2026-13917

Affected product: Chrome for iOS (Google Chrome on iOS). Vulnerable component: untrusted input validation in the iOS browser. Root cause: insufficient validation of untrusted input in a crafted HTML page that, with user engagement via specific UI gestures, lets an attacker bypass navigation restr...

CVE-2026-13930

CVE-2026-13930 affects Google Chrome and Chromium-based components where insufficient policy enforcement in an Actor allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is described as enabling navigation restriction bypass before version 150.0.7871.47. A...

CVE-2026-13953

Summary: CVE-2026-13953 affects Google Chrome’s SplitView implementation in Chromium. An insecure/incorrect SplitView behavior allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. This is rated Medium (CVSSv3.1 base score 6....

CVE-2026-14124

CVE-2026-14124 affects Google Chrome on Windows (before version 150.0.7871.47). The vulnerability is due to an inappropriate CredentialProvider implementation, enabling a local attacker to escalate privileges via a malicious file. The described impact is OS-level, with high confidentiality, integ...

CVE-2026-15772

The CVE-2026-15772 entry describes a Use-After-Free in the GPU component of Google Chrome on Android prior to version 150.0.7871.125, which could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is classified...

CVE-2026-16417

CVE-2026-16417 affects Google Chrome with uninitialized use in Skia . A remote attacker who compromised the renderer could leak cross-origin data via a crafted HTML page. Affected versions are Chrome prior to 150.0.7871.182 . The incident is documented by multiple sources (NVD, EUVD, MSRC, Debian...

CVE-2026-17841

CVE-2026-17841 describes a race condition in Chrome for iOS (Google Chrome on iOS) prior to version 151.0.7922.72 that allows a remote attacker to spoof UI via a crafted HTML page. The vulnerability affects the iOS build of Chrome using Chromium components and has a reported CVSSv3.1 base score o...

CVE-2026-17905

Google Chrome vulnerability CVE-2026-17905 involves an inappropriate implementation in SurfaceCapture that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected software: Google Chrome prior to version 151.0.7922.72. Root cause: improper handling in SurfaceCapt...

CVE-2026-3917

CVE-2026-3917 corresponds to a use-after-free in Google Chrome’s Agents component, leading to potential heap corruption via a crafted HTML page. The vulnerability is described across multiple sources as affecting Chrome/Chromium and tied to Agents resource management; the issue is categorized as ...

CVE-2026-3922

CVE-2026-3922 is a confirmed vulnerability in Google Chrome/Chromium involving a use-after-free in the MediaStream path. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with the impact described as high. Affected product/version details present i...

CVE-2026-4439

The CVE-2026-4439 entry describes an out-of-bounds memory access in WebGL affecting Google Chrome on Android prior to version 146.0.7680.153, with potential sandbox escape via a crafted HTML page (critical). Connected advisories confirm Chromium-based builds (Chromium/Chrome) across distributions...

CVE-2026-4454

CVE-2026-4454 is a use-after-free vulnerability in the Network component of Google Chrome, allowing remote exploitation that could lead to heap corruption. Affected product: Google Chrome prior to version 146.0.7680.153. Root cause described as use-after-free in the Network component with crafted...

CVE-2026-4458

CVE-2026-4458 is a use-after-free in Chrome extensions, allowing heap corruption via a malicious extension. Connected sources confirm the flaw affects Google Chrome’s Extensions component and is fixed in Chrome 146.0.7680.153 (and later) across platforms, with Debian advisories and Alpine/other t...

CVE-2026-5285

Summary: CVE-2026-5285 is a use-after-free in the WebGL component of Google Chrome, affecting versions prior to 146.0.7680.178. The vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox via a crafted HTML page. The issue is tied to memory mismanagement in Web...

CVE-2026-5869

CVE-2026-5869 is a heap buffer overflow in WebML within Google Chrome/Chromium, exploitable via a crafted HTML page to reveal potentially sensitive process-memory data. Affected: Chromium/WebML prior to 147.0.7727.55. Remediation: upgrade to Chromium 147.0.7727.55 or newer (Debian fix 147.0.7727....

CVE-2026-5885

CVE-2026-5885 affects Google Chrome on Windows prior to 147.0.7727.55, attributed to insufficient validation of untrusted input in WebML. The issue could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The Chrome 147 release notes c...

CVE-2026-5900

CVE-2026-5900 : Policy bypass in Downloads in Google Chrome/Chromium before 147.0.7727.55 allows a crafted HTML page to bypass multi-download protections. Affected: Chrome/Chromium, Downloads policy logic. Impact: remote attacker could bypass protections for multiple downloads as described in the...

CVE-2026-6302

Chromium-based Google Chrome is affected by CVE-2026-6302 due to a use-after-free in the Video component. Versions before 147.0.7727.101 allow a remote attacker to execute arbitrary code in the sandbox via a crafted HTML page. Mitigation: update Chrome to 147.0.7727.101 or newer. Exploitation sta...

CVE-2026-7921

CVE-2026-7921 corresponds to a use-after-free vulnerability in Google Chrome’s Passwords handling, exploited via a crafted HTML page to achieve remote code execution. Affected product: Google Chrome (Password management code path) prior to version 148.0.7778.96. Root cause: use-after-free in Pass...

CVE-2026-7946

CVE-2026-7946 affects Google Chrome WebUI on Linux, Mac, Windows, and ChromeOS prior to 148.0.7778.96, where insufficient policy enforcement in the WebUI allowed a renderer-compromised remote attacker to bypass site isolation via a crafted HTML page. The connected Debian OSV entry confirms the sa...

CVE-2026-7964

CVE-2026-7964 involves Chrome before 148.0.7778.96, where insufficient validation of untrusted input in the FileSystem component allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. The issue is rooted in inadequate input vali...

CVE-2026-7987

CVE-2026-7987 describes a use-after-free in WebRTC within Google Chrome prior to version 148.0.7778.96, enabling a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The Debian OSV, EUVD ENISA entry, and the Chrome PTSecurity advisory corroborate the same vulnerab...

CVE-2026-8515

CVE-2026-8515 is a use-after-free in HID handling in Google Chrome prior to 148.0.7778.168 that could allow a remote attacker to cause a sandbox escape when a user interacts with a crafted HTML page via specific UI gestures. Affected software is Chrome/Chromium, with the vulnerability rooted in u...

CVE-2026-8530

CVE-2026-8530 affects Google Chrome on Windows. The flaw is a use-after-free in the Network component, exploitable if a renderer process is compromised, potentially enabling a sandbox escape via a crafted HTML page. Impact is described as high, with the prerequisite that the attacker already has ...

CVE-2024-7017

CVE-2024-7017: In Google Chrome DevTools an inappropriate implementation allows sandbox escape via a crafted HTML page. Affected product is Google Chrome (DevTools). Root cause: DevTools mal-implementation described as an inappropriate implementation. Impact: potential sandbox escape with high se...

CVE-2025-11206

CVE-2025-11206 corresponds to a heap buffer overflow in the Video component of Google Chrome/Chromium prior to version 141.0.7390.54. The vulnerability could allow a remote attacker to potentially escape the sandbox via a crafted HTML page. The issue is documented across multiple advisories indic...

CVE-2025-12445

CVE-2025-12445 describes a policy bypass in Google Chrome Extensions prior to 142.0.7444.59. An attacker could entice a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. The CVSS 3.1 base metrics indicate a Medium severity (AV:N/AC:L/PR:N/UI:N/S:U/C:L...

CVE-2025-12911

CVE-2025-12911 affects Google Chrome before 140.0.7339.80 due to an Inappropriate implementation in Permissions, enabling a remote attacker to perform UI spoofing via a crafted HTML page. The issue is addressed in the Chrome 140 stable release (Chrome 140.0.7339.80 and later). Update to the lates...

CVE-2026-10907

CVE-2026-10907 is an out-of-bounds write in ANGLE used by Google Chrome, affecting Chrome versions prior to 149.0.7827.53. The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The connected documents confirm ANGLE as the vulnerable component and Chrome ...

CVE-2026-11059

The vulnerability CVE-2026-11059 affects Google Chrome’s Blink engine, with a use-after-free in Blink that could allow remote code execution inside the sandbox via a crafted HTML page. Affected are Chrome builds prior to 149.0.7827.53; remediation is to update to 149.0.7827.53 or newer (per Chrom...

CVE-2026-11072

The CVE-2026-11072 issue affects WebView in Google Chrome on Android (before version 149.0.7827.53). The root cause is a use-after-free in WebView, enabling a local attacker to execute arbitrary code via a malicious file. The provided sources indicate the impact as local code execution with a Med...

CVE-2026-13817

CVE-2026-13817 affects Google Chrome (Chromium-based) due to insufficient validation of untrusted input in the Glic component, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected range is Chrome versions prior to 150.0.7871.47; the vulnerability is...

CVE-2026-13895

CVE-2026-13895 concerns an inappropriate implementation in Google Chrome’s Autofill component (Chromium) prior to version 150.0.7871.47. A remote attacker could trigger UI spoofing by persuading a user to perform specific UI gestures on a crafted HTML page. The documented impact is limited to UI ...

CVE-2026-13948

CVE-2026-13948 : Concrete details in connected records show an insufficient policy enforcement in Google Chrome extensions prior to 150.0.7871.47, enabling a user-assisted UI spoofing attack if a user is convinced to install a malicious Chrome Extension. Root cause: policy enforcement weakness in...

CVE-2026-14060

CVE-2026-14060 concerns Chrome on Windows with Chromoting, where insufficient validation of untrusted input in this component allows a local attacker to escalate privileges by handling a malicious file. Affected version window is prior to 150.0.7871.47. The vulnerability is described as enabling ...

CVE-2026-14061

The CVE-2026-14061 issue affects Dawn in Google Chrome, prior to version 150.0.7871.47. It is described as an insecure implementation that could allow a remote attacker to obtain potentially sensitive data from process memory via a crafted HTML page. Affected component: Dawn within Chrome. Root c...

CVE-2026-14096

Affects Google Chrome for Android. The issue is an inappropriate implementation in Input that, when the renderer process is compromised, enables a remote attacker to leak cross-origin data via a crafted HTML page. Versions prior to 150.0.7871.47 are affected; update to 150.0.7871.47 or later to m...

CVE-2026-15775

CVE-2026-15775 affects Google Chrome's V8 under a pre-150.0.7871.125 build. The issue is an inappropriate implementation that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact is described as high in Chromium notes, with exploitation requiring user interac...

CVE-2026-17838

The vulnerability CVE-2026-17838 affects Chrome on iOS prior to 151.0.7922.72, where an incorrect security UI could allow a remote attacker to spoof domains via a crafted HTML page. The issue is documented with a Medium severity (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) and an affected com...

CVE-2026-17846

CVE-2026-17846 stems from an inappropriate implementation in the Chromium-based Chrome Media component on Windows, allowing a remote attacker who already compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected software is Google Chrome on Windows, with ...

CVE-2026-17913

CVE-2026-17913 refers to an Inappropriate implementation in Chrome for iOS (Chromium-based) that could allow UI spoofing via a crafted HTML page. Open-source/official records group this under Chrome for iOS and include it among Chromium-involved issues; the vulnerability is not described as explo...

CVE-2026-5866

Google Chrome/Chromium has a Use-after-free in Media vulnerability (CVE-2026-5866) that could allow remote code execution inside the sandbox via a crafted HTML page. It affects Chrome builds prior to 147.0.7727.55. The Chrome 147.0.7727.55 stable update (and Debian’s chromium security fix to 147....

CVE-2026-5878

CVE-2026-5878 affects Google Chrome/Chromium Blink UI: an incorrect security UI in Blink allowed a remote attacker to spoof UI via a crafted HTML page. The Chrome security note states this is fixed in Chrome 147.0.7727.55 (and related Chromium fixes). Debian security advisories list chromium fixe...

CVE-2026-5880

CVE-2026-5880 involves Google Chrome prior to 147.0.7727.55, where insufficient policy enforcement in the browser UI allowed a remote attacker who had compromised the renderer process to spoof the Omnibox (URL bar) contents via a crafted HTML page. The vulnerability affects the Chrome/Chromium UI...

CVE-2026-6319

CVE-2026-6319 is a Use-after-Free in Google Chrome's Payments component for Android, prior to version 147.0.7727.101. The issue could allow remote code execution when a user is tricked into performing specific UI gestures and visits a crafted HTML page. Public sources (Debian security advisory DS...

CVE-2026-7901

CVE-2026-7901 relates to a use-after-free in ANGLE within Google Chrome on macOS prior to 148.0.7778.96. The underlying issue is a dangling reference in ANGLE that could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Affected product/version:...

CVE-2026-7932

CVE-2026-7932 affects Google Chrome (

CVE-2026-7961

CVE-2026-7961 corresponds to a vulnerability in Google Chrome prior to 148.0.7778.96. The connected documents describe insufficient validation of untrusted input in Permissions, enabling an attacker on a local network segment to leak cross-origin data via malicious network traffic. The issue is d...

CVE-2026-7981

CVE-2026-7981 affects Google Chrome before 148.0.7778.96. The vulnerability is an out-of-bounds read in Codecs, allowing a remote attacker to read potentially sensitive data from a process’s memory via a malicious file. Impact is described as potentially sensitive information exposure; exploitati...