CVE-2026-4678

Technical details beyond the initial description are not provided in the connected documents. CVE-2026-4678 concerns a use-after-free in WebGPU in Google Chrome prior to 146.0.7680.165, enabling remote code execution via a crafted HTML page.

CVE-2026-7985

CVE-2026-7985: A use-after-free in Chrome's GPU component allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affected Software: Google Chrome prior to 148.0.7778.96 (GPU). Root cause: use-after-free in the GPU path. Impact: sandbox escape potential ...

CVE-2026-7992

CVE-2026-7992 affects Google Chrome on Linux and ChromeOS prior to 148.0.7778.96. The root cause is insufficient validation of untrusted input in the UI, allowing a remote attacker who entices a user to perform specific UI gestures to execute arbitrary code via a crafted HTML page. The CVE is ref...

CVE-2026-7998

Google Chrome prior to 148.0.7778.96 exposes a UI spoofing risk in the Dialog component due to insufficient validation of untrusted input. The root cause is improper input validation in Dialog, which could be leveraged by a remote attacker who has already compromised the renderer process to craft...

CVE-2026-8510

CVE-2026-8510: Integer overflow in Skia within Google Chrome on Windows (before 148.0.7778.168) allows a remote attacker who has compromised the renderer process to trigger an out-of-bounds memory write via a crafted HTML page. Affected component: Skia in Chrome; impact is high (remote code execu...

CVE-2026-8547

CVE-2026-8547 affects Google Chrome on Windows prior to 148.0.7778.168, where insufficient policy enforcement in Passwords allows a remote attacker who has compromised the renderer process to escalate privileges via a crafted HTML page. The available documents do not provide additional exploit de...

CVE-2026-8564

CVE-2026-8564 describes an issue in Google Chrome’s Downloads UI on Android and macOS, where an incorrect security UI could allow a remote attacker to perform UI spoofing via a crafted HTML page. Affected versions are prior to 148.0.7778.168; remediation is to update to 148.0.7778.168 or later. T...

CVE-2026-9953

CVE-2026-9953 describes an out-of-bounds read in ANGLE used by Google Chrome (Chromium-based) prior to version 148.0.7778.216. The vulnerability allows a remote attacker to read potentially sensitive information from a process’s memory via a crafted HTML page. Affected component: ANGLE within Chr...

CVE-2025-12434

CVE-2025-12434 affects Google Chrome/Chromium on Windows with a race in Storage that allows UI spoofing when a user performs specific UI gestures on a crafted HTML page. The issue is fixed in Chromium/Chrome updates (e.g., Chromium 142.0.7444.162+; Chrome 142.0.7444.59+ in some channels). Impact ...

CVE-2025-12908

CVE-2025-12908 concerns Google Chrome for Android prior to 140.0.7339.80, where insufficient validation of untrusted input in the Downloads component could allow a remote attacker to perform domain spoofing via a crafted HTML page. The issue is documented with Chromium-based details and is graded...

CVE-2026-13818

CVE-2026-13818 affects Google Chrome’s Passwords feature. The issue is an inappropriate implementation that allowed a remote attacker to bypass navigation restrictions via a crafted HTML page in Chrome versions prior to 150.0.7871.47. Impact is a navigation bypass; no exploits are detailed in the...

CVE-2026-13958

CVE-2026-13958 concerns Google Chrome on Windows prior to 150.0.7871.47 where an uninitialized use in the codecs component could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. This is the explicit vulnerability scenario described across mul...

CVE-2026-13961

The CVE-2026-13961 issue affects Google Chrome on Windows, specifically DevTools. It arises from insufficient validation of untrusted input, allowing a remote attacker who convinces a user to perform certain UI gestures to potentially read sensitive data from process memory via a crafted HTML pag...

CVE-2026-14006

CVE-2026-14006 affects Google Chrome prior to 150.0.7871.47 due to a use-after-free in Navigation, allowing remote code execution. Vulnerable component: Navigation in Chrome (Chromium). Impact: arbitrary code execution; severity shown as High (CVSS 3.1 base 8.8). Remediation: update Chrome to 150...

CVE-2026-14042

CVE-2026-14042 concerns Google Chrome Isolated Web Apps. The issue is an inappropriate implementation that allows a remote attacker to perform UI spoofing via a crafted HTML page. It affects Chrome versions prior to 150.0.7871.47 and is described with a Chromium security severity of Low. The prac...

CVE-2026-17793

CVE-2026-17793 describes an inappropriate implementation flaw in the Messages component of the Chromium-based Google Chrome on Android, prior to version 151.0.7922.72. The issue enables a remote attacker to perform UI spoofing via a crafted HTML page, due to the root cause described as an inappro...

CVE-2026-3921

CVE-2026-3921 is a use-after-free in TextEncoding in Google Chrome prior to 146.0.7680.71 that could enable a remote attacker to trigger heap corruption via a crafted HTML page. Affected software is Chrome/Chromium (text encoding handling). The Chromium-based advisories and Chrome release notes c...

CVE-2026-4459

Chrome WebAudio: CVE-2026-4459 - Out-of-bounds read/write in WebAudio before 146.0.7680.153 may enable remote heap corruption via a crafted HTML page. Impact described as high severity with potential for total impact; exploit requires user interaction and network access. Google Chrome has release...

CVE-2026-5274

CVE-2026-5274 is a Chrome/Chromium vulnerability: an integer overflow in Codecs allows a remote attacker to perform arbitrary read/write through a crafted HTML page. Affected software includes Google Chrome prior to version 146.0.7680.178 (with references to Chromium fixes). The issue is describe...

CVE-2026-5860

CVE-2026-5860 is a use-after-free vulnerability in Chrome's WebRTC component. A remote attacker could trigger arbitrary code execution inside the browser sandbox by delivering a crafted HTML page. Affected product: Google Chrome prior to version 147.0.7727.55. The public description confirms the ...

CVE-2026-5867

CVE-2026-5867 is a heap buffer overflow in WebML within Google Chrome/Chromium prior to 147.0.7727.55, enabling a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Connected advisories confirm fixes in chromium updates: Debian DSA-6205-1 ships version...

CVE-2026-5879

CVE-2026-5879 affects Google Chrome on macOS prior to 147.0.7727.55 due to insufficient validation of untrusted input in ANGLE. This vulnerability allowed remote code execution inside the sandbox via a crafted HTML page. The Chrome stable update 147.0.7727.55 (Windows, Mac, Linux) includes multip...

CVE-2026-5896

The issue CVE-2026-5896 concerns a policy bypass in Audio in Google Chrome (Chromium) prior to 147.0.7727.55, where a crafted HTML page could lure a user into specific UI gestures to bypass sandbox download restrictions. Connected documents show Chromium/Chrome updates addressing this, with Chrom...

CVE-2026-6304

CVE-2026-6304 covers a use-after-free in Graphite within Google Chrome prior to version 147.0.7727.101 . The issue allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox escape via a crafted HTML page . The vulnerability affects Chrome’s Graphit...

CVE-2026-6309

CVE-2026-6309 describes a use-after-free in Viz within Google Chrome prior to version 147.0.7727.101. If an attacker compromised the renderer process via a crafted HTML page, they could potentially perform a sandbox escape. The entry notes a high severity. Affected software/version: Google Chrome...

CVE-2026-7953

CVE-2026-7953 describes UXSS in Google Chrome due to insufficient validation of untrusted input in the Omnibox. Affects Chrome versions prior to 148.0.7778.96; exploitation would require malicious network traffic to inject scripts/HTML. The linked PT-2026-38146 and OSV/NVD entries confirm the sam...

CVE-2026-7958

Summary: CVE-2026-7958 describes an UXSS vulnerability in Google Chrome caused by an inappropriate implementation in the ServiceWorker, reported for Chrome versions before 148.0.7778.96. An attacker could persuade a user to install a malicious extension, enabling injection of arbitrary scripts or...

CVE-2026-7972

The entry CVE-2026-7972 affects Google Chrome, describing an uninitialized use in the GPU that allowed a remote attacker, after compromising the renderer process, to leak cross-origin data via a crafted HTML page. The vulnerability is tied to Chrome prior to version 148.0.7778.96 (in desktop chan...

CVE-2026-7974

CVE-2026-7974 describes a use-after-free in Blink affecting Google Chrome before version 148.0.7778.96 . The underlying issue is a memory corruption flaw in Blink that allows a remote attacker to execute arbitrary code inside the browser’s sandbox via a crafted HTML page. Multiple connected sourc...

CVE-2026-7977

CVE-2026-7977 involves an inappropriate implementation in Canvas in Google Chrome before 148.0.7778.96 that allows a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected software is Google Chrome (Canvas component in Chromium). Root cause is an incorrect Canvas imple...

CVE-2026-8525

CVE-2026-8525 affects Google Chrome on macOS via the ANGLE component. The issue is a heap buffer overflow in ANGLE that could allow a remote attacker to perform a sandbox escape through a crafted HTML page. Affected versions are Chrome builds prior to 148.0.7778.168. The remediation stated in con...

CVE-2026-8583

CVE-2026-8583 : Affected product is Google Chrome on Android, specifically the WebXR component. The issue is described as insufficient policy enforcement in WebXR, allowing a remote attacker who had already compromised the renderer process to obtain potentially sensitive information from process ...

CVE-2026-9985

The CVE-2026-9985 entry affects Google Chrome on ChromeOS, leveraging the Media component in Chromium. The root cause is insufficient validation of untrusted input within Media, allowing a remote attacker that already compromised the renderer process to read potentially sensitive memory contents ...

CVE-2025-11209

CVE-2025-11209 concerns an insecure implementation in the Android Omnibox of Google Chrome that allowed spoofing the URL bar via a crafted HTML page. Connected documents confirm the issue relates to Chromium-based Chrome/Chromium, with remediation via upgrading to version 141.0.7390.54 or newer (...

CVE-2026-13928

CVE-2026-13928 concerns Google Chrome (Enterprise) prior to version 150.0.7871.47, where insufficient validation of untrusted input could allow a remote attacker to achieve privilege escalation through a crafted HTML page. The affected component is described as input validation within Chrome/Chro...

CVE-2026-14080

Affected software: Google Chrome on Android. Vulnerable component: TabSwitcher. Root cause: insufficient validation of untrusted input. Impact: enables a remote attacker to bypass navigation restrictions via malicious network traffic (Chromium security severity: Low). Version constraint: vulnerab...

CVE-2026-4440

CVE-2026-4440 involves an out-of-bounds read/write in WebGL in Google Chrome/Chromium prior to 146.0.7680.153, enabling a remote attacker to perform arbitrary read/write via a crafted HTML page. Connected feeds indicate Chromium/Chromium-derived updates (e.g., 146.0.7680.164 in Fedora advisories ...

CVE-2026-4444

CVE-2026-4444 is a stack buffer overflow in WebRTC within Google Chrome’s rendering of WebRTC, exploited via a crafted HTML page. Connected sources confirm the affected component is WebRTC in Chrome prior to version 146.0.7680.153. The underlying issue is a stack buffer overflow that could enable...

CVE-2026-5864

CVE-2026-5864 is a heap buffer overflow in WebAudio in Google Chrome/Chromium before 147.0.7727.55, allowing remote memory information disclosure via a crafted HTML page. Public updates exist: Chromium/Chrome patches were released; Fedora package updates show chromium 147.0.7727.101 across multip...

CVE-2026-5868

CVE-2026-5868 is a heap buffer overflow in ANGLE used by Google Chrome on macOS prior to 147.0.7727.55. The flaw could allow a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. The issue is tracked in Chrome/Chromium advisories and was addressed in the C...

CVE-2026-5905

CVE-2026-5905 affects Chromium/Chrome components on Windows via an incorrect security UI in Permissions that allowed domain spoofing with a crafted HTML page. Connected advisories confirm Chromium-based Chromium versions around 147.0.7727.x, with Fedora/Debian updates targeting Chromium to fixed ...

CVE-2026-7353

CVE-2026-7353 describes a heap buffer overflow in Skia used by Google Chrome before 147.0.7727.138. The flaw could allow a remote attacker who has compromised the renderer process to escape the sandbox via a crafted HTML page, as stated in multiple sources. Affected product: Google Chrome (pre-14...

CVE-2026-7915

This CVE (CVE-2026-7915) concerns Chrome on Android before 148.0.7778.96, where DevTools failed to validate data properly. The underlying issue enables a remote attacker to bypass navigation restrictions by presenting a crafted HTML page. Affected component: DevTools in Chrome Android; root cause...

CVE-2026-7916

CVE-2026-7916 affects Google Chrome up to version 148.0.7778.96. Description:Insufficient data validation in the InterestGroups component can allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page (Chromium security severity: High). Connected sources (Chrome stable re...

CVE-2026-7942

CVE-2026-7942 describes an integer overflow in ANGLE used by Google Chrome, prior to 148.0.7778.96. The vulnerability could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected software: Google Chrome (ANGLE component). Root cause: integer overflow in ANGLE triggeri...

CVE-2026-7963

CVE-2026-7963 affects Google Chrome prior to 148.0.7778.96 due to an inappropriate ServiceWorker implementation that could allow a sandbox escape when a renderer process is compromised via a crafted HTML page. The issue is documented across multiple sources (NVD, Debian OSV, EUVD, CVE list, and C...

CVE-2026-7967

CVE-2026-7967 affects Google Chrome versions prior to 148.0.7778.96. The issue is "Insufficient validation of untrusted input in Navigation" in the renderer, allowing a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Impact...

CVE-2026-7970

CVE-2026-7970 affects Google Chrome’s TopChrome component. The issue is a use-after-free in TopChrome that, if a renderer process is compromised, could enable a sandbox escape via a crafted HTML page. Google Chrome 148.0.7778.96 and later addresses this by including fixes in the stable channel up...

CVE-2026-7978

CVE-2026-7978 affects Google Chrome on macOS, due to an inappropriate implementation in the Chrome Companion component prior to version 148.0.7778.96. This allows a remote attacker to escalate privileges at the OS level via malicious network traffic. Impact is OS-level compromise on affected macO...

CVE-2026-7980

CVE-2026-7980 is a memory-corruption use-after-free in WebAudio of Google Chrome, exploited via a crafted HTML page to run code in the browser sandbox. Public disclosures in OSV/ND and Debian/NVD entries confirm the issue affects Chrome prior to version 148.0.7778.96 and is tied to WebAudio. The ...