CVE-2026-7991

Chrome 148.0.7778.96 and earlier versions are affected by CVE-2026-7991 due to a use-after-free in the UI. A remote attacker who has compromised the renderer could execute arbitrary code inside the sandbox by luring a user to a crafted HTML page. The vulnerability is addressed in Chrome 148.0.777...

CVE-2026-7997

CVE-2026-7997 : Insufficient validation of untrusted input in Chrome’s Updater on macOS before 148.0.7778.96 allows a local attacker to escalate privileges via a malicious file. Multiple sources (NVD/NVDC, Debian, EUVD, Debian/OSV) corroborate this entry. The Chrome stable-channel update (148.0.7...

CVE-2026-8539

CVE-2026-8539 describes a script injection (UXSS) in Chrome on Android via the SanitizerAPI, exploitable through a crafted HTML page. Affected software: Google Chrome for Android (Chromium-based). Vulnerable component: SanitizerAPI. Root cause: insufficient input handling in SanitizerAPI leading ...

CVE-2025-12447

CVE-2025-12447 covers an Incorrect security UI in the Omnibox of Chromium-based browsers (Chrome/Edge) where a crafted HTML page could trigger UI spoofing. The underlying issue is in the Omnibox UI surface, enabling spoofed UI via user-observed prompts. Public exploits exist per MSRC and related ...

CVE-2026-13936

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-13936 for new information, and potential remediation guidance.

CVE-2026-4456

CVE-2026-4456 involves a use-after-free in the Digital Credentials API of Chromium/Google Chrome, allowing a remote attacker who already has renderer access to potentially escape the Chrome sandbox via a crafted HTML page. Affected component: Chromium-based browsers (Chrome/Chromium) prior to ver...

CVE-2026-4461

CVE-2026-4461 affects Google Chrome’s V8 engine and Chrome/Chromium builds prior to 146.0.7680.153, where an inappropriate V8 implementation could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue is rated High severity (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, bas...

CVE-2026-5910

CVE-2026-5910 is an integer overflow in Chrome/Chromium's Media component that can lead to heap corruption via a crafted video file. Connected sources confirm affected product is Chromium-based (Chrome/Chromium) and that the issue is addressed by Chrome/Chromium updates; Debian lists fixed versio...

CVE-2026-6299

CVE-2026-6299 : A use-after-free in Prerender in Google Chrome before 147.0.7727.101 allowed remote code execution via a crafted HTML page. Affected software is Google Chrome (Chromium-based). Root cause: use-after-free in Prerender. Impact: arbitrary code execution with the web-page attacker-con...

CVE-2026-6311

CVE-2026-6311 affects Google Chrome on Windows before version 147.0.7727.101, where an uninitialized use in the Accessibility feature could allow a renderer process that’s already compromised to escape the sandbox via a crafted HTML page. The issue is classified as High severity; exploitation wou...

CVE-2026-7909

The CVE-2026-7909 entry concerns Google Chrome’s ServiceWorker. Affected component: Chrome’s ServiceWorker. Root cause: Inappropriate implementation allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Impact: bypass of site isolatio...

CVE-2026-7938

CVE-2026-7938: Use-after-free in CSS in Google Chrome before 148.0.7778.96 allows remote code execution inside the sandbox via a crafted HTML page. Affected: Google Chrome (Chromium CSS path). Remediation: update to 148.0.7778.96 or later (per PT-2026-38131). Exploit details are not provided in t...

CVE-2026-7944

Summary: CVE-2026-7944 relates to Google Chrome prior to 148.0.7778.96, where insufficient validation of untrusted input in the Persistent Cache could allow a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Affected software/sequence: Goo...

CVE-2026-7947

CVE-2026-7947 affects Google Chrome prior to 148.0.7778.96. The issue is insufficient validation of untrusted input in Chrome’s Network component, enabling a renderer-compromised remote attacker to spoof UI via a crafted HTML page. Impact is UI spoofing with low confidentiality/integrity/availabi...

CVE-2026-7984

CVE-2026-7984: Use-after-free in Chrome’s ReadingMode prior to 148.0.7778.96 allows a remote attacker with renderer access to execute arbitrary code in a sandbox via a crafted HTML page. Affected software: Google Chrome (ReadingMode component). Root cause: use-after-free in ReadingMode. Impact: c...

CVE-2026-9123

CVE-2026-9123 describes a heap buffer overflow in Chromecast within Google Chrome on Android, Linux, and ChromeOS prior to version 148.0.7778.179, allowing a local attacker to run arbitrary code inside the sandbox through malicious network traffic. The issue affects Chromecast functionality in Ch...

CVE-2024-9126

CVE-2024-9126 affects Google Chrome on iOS (Internals component). A use-after-free in Internals could allow heap corruption when a user is guided to perform specific UI gestures. The issue is mitigated by updating Chrome to version 127.6533.88 or later (per Chrome release notes). Exploitation is ...

CVE-2025-12435

CVE-2025-12435 describes an incorrect security UI in the Omnibox that enables UI spoofing in Chromium-based browsers (Chrome on Android pre-142.0.7444.59). Connected advisories show Chromium/CEF updates shipping versions 142.0.7444.162 and corresponding Chromium-based Edge patches, indicating the...

CVE-2025-12441

CVE-2025-12441 affects the V8 engine in Google Chrome up to version 142.0.7444.59. An out-of-bounds memory read can be triggered by a crafted HTML page, enabling a remote attacker to read memory. Chromium-based distributions have shipped updated Chromium/CEF packages (e.g., Chromium 142.0.7444.59...

CVE-2026-3916

CVE-2026-3916 concerns an out-of-bounds read in Web Speech affecting Google Chrome/Chromium. Connected feeds show fixes tied to Chromium 146.0.7680.71 (e.g., chromium-146.0.7680.71-1.fc42/43, Debian DSA-6164-1 notes 146.0.7680.71 fixes). Affected component: Web Speech parsing/access path in Chrom...

CVE-2026-5859

CVE-2026-5859 affects Google Chrome/Chromium via an integer overflow in WebML that can lead to heap corruption when processing a crafted HTML page. The issue is described as a critical, remote-exploit-risk vulnerability and is associated with Chromium 147.0.7727.55 and later, with multiple vendor...

CVE-2026-5891

CVE-2026-5891 : In Google Chrome (Chromium core), insufficient policy enforcement in the browser UI allows a remote attacker who has already compromised the renderer process to perform UI spoofing via a crafted HTML page. Documents indicate a fixed version in Chrome 147.0.7727.55 (and related Chr...

CVE-2026-5894

CVE-2026-5894 is an issue in Google Chrome/Chromium related to an inappropriate implementation in PDF handling that allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is rated as Chromium/Chrome security severity Low in the CVE entry, with a CVS...

CVE-2026-5903

CVE-2026-5903 affects Google Chrome/Chromium prior to 147.0.7727.55, where a flaw in IFrameSandbox allowed a remote attacker to bypass navigation restrictions after convincing a user to perform specific UI gestures via a crafted HTML page. Connected advisories indicate Chromium-based patches exis...

CVE-2026-6312

Google Chrome Vulnerability CVE-2026-6312 affects the Passwords feature. The issue is caused by insufficient policy enforcement in Passwords, allowing a remote attacker who compromises the renderer process to leak cross-origin data via a crafted HTML page. Affected: Chrome versions before 147.0.7...

CVE-2026-6313

CVE-2026-6313 : Google Chrome had insufficient policy enforcement in CORS before version 147.0.7727.101 , allowing a remote attacker who already compromised a renderer process to leak cross-origin data via a crafted HTML page. The vulnerability is ranked High impact. Affected product: Google Chro...

CVE-2026-6317

CVE-2026-6317: Use-after-free in the Cast component of Google Chrome prior to 147.0.7727.101 allows a remote attacker to execute arbitrary code via a crafted HTML page. Impact is high; upgrade to Chrome 147.0.7727.101 or later to mitigate. No exploitation details are provided in the documents.

CVE-2026-76046

Affected component: ANGLE (Android graphics layer) in Google Chrome on Android, prior to version 151.0.7922.169. Root cause: Buffer overflow triggered by a crafted HTML page. Impact: A remote attacker with a compromised renderer process can execute arbitrary code outside the Chrome sandbox. CVSS ...

CVE-2026-7918

CVE-2026-7918 describes a use-after-free in Google Chrome's GPU component prior to 148.0.7778.96, which could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue pertains to the Chrome/Chromium GPU stack and is docu...

CVE-2026-7922

This CVE-2026-7922 affects Google Chrome (ServiceWorker) and is caused by a use-after-free in ServiceWorker code, enabling a potential sandbox escape via a crafted HTML page. The issue is categorized as High severity with CVSS: Network attack vector, high impact on confidentiality, integrity, and...

CVE-2026-7926

CVE-2026-7926 affects Google Chrome’s PresentationAPI prior to Chrome 148.0.7778.96. Description: use-after-free in PresentationAPI could allow a remote attacker to execute arbitrary code in the sandbox via a crafted HTML page. Connected sources indicate the fix is included in the Chrome 148 stab...

CVE-2026-7976

CVE-2026-7976 describes a use-after-free in the Chrome Chrome Views component prior to 148.0.7778.96. An attacker could trick a user into installing a malicious extension to achieve arbitrary code execution via the crafted Chrome Extension. Affected software: Google Chrome versions before 148.0.7...

CVE-2026-7990

CVE-2026-7990 affects Google Chrome Updater on Windows prior to 148.0.7778.96, where insufficient validation of untrusted input in the Updater could allow a local attacker to achieve OS-level privilege escalation via a malicious file. The vulnerability is described consistently across NVD, Debian...

CVE-2026-8002

The CVE-2026-8002 entry concerns a use-after-free in Chrome’s Audio component on macOS, exposing remote code execution within the sandbox due to a crafted HTML page. Connected sources confirm the vulnerability affects Google Chrome on Mac versions before 148.0.7778.96, with exploitation described...

CVE-2025-11212

CVE-2025-11212 concerns an inappropriate Media module implementation in Google Chrome on Windows, enabling domain spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. The connected Fedora advisories indicate Chromium-based updates addressing this vulnerability: ...

CVE-2025-11213

CVE-2025-11213 describes an Omnibox implementation issue in Google Chrome on Android that allows domain spoofing via a crafted HTML page when a user is persuaded to perform specific UI gestures. The available connected documents confirm a Chromium/Chrome family fix in the 141.0.7390.54+ range, wi...

CVE-2026-17876

CVE-2026-17876 describes an inappropriate implementation in Google Chrome's Payments component that allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome, with the issue present in versions prior to 151.0.7922.72 (as noted in the descripti...

CVE-2026-3918

CVE-2026-3918 affects Google Chrome via WebMCP use-after-free leading to potential heap corruption when processing a crafted HTML page. Public sources in connected documents consistently describe the flaw as originating from after-free in WebMCP, with the issue occurring in Chrome builds prior to...

CVE-2026-3934

CVE-2026-3934 affects ChromeDriver in Google Chrome prior to 146.0.7680.71. The connected sources describe an insufficient policy enforcement issue that lets a remote attacker bypass the same-origin policy via a crafted HTML page. The vulnerability impact is stated as part of the Chromium securit...

CVE-2026-5884

CVE-2026-5884 involves insufficient validation of untrusted input in Chrome/Chromium’s Media component prior to v147.0.7727.55. A renderer-compromised remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Debian advisories confirm fixes in Chromium/Chrome packag...

CVE-2026-6315

CVE-2026-6315 affects Google Chrome on Android (before version 147.0.7727.101). It is a use-after-free in Permissions that could let a remote attacker who coerces a user into specific UI gestures execute arbitrary code via a crafted HTML page. The connected documents provide the same details and ...

CVE-2026-7911

CVE-2026-7911: Use-after-free in Aura (Chromium-based Chrome on Windows) before 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially escape the Chromium sandbox via a crafted HTML page. The vulnerability affects Google Chrome’s Aura component; impact is ...

CVE-2026-7923

CVE-2026-7923: Out of bounds write in Skia used by Google Chrome prior to 148.0.7778.96 allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is described as a high-severity issue affecting Chrome’s Skia component with the fix shipped...

CVE-2026-7988

CVE-2026-7988 describes a type confusion in WebRTC within Google Chrome. A remote attacker could run arbitrary code inside the browser sandbox by crafting an HTML page. Affected software is Google Chrome, prior to version 148.0.7778.96. The issue is fixed in Chrome 148.0.7778.96 (and the associat...

CVE-2025-12906

CVE-2025-12906 describes an incorrect Permissions implementation in Google Chrome/Chromium that allows a remote attacker to perform UI spoofing via a crafted HTML page. Affected: Google Chrome/Chromium before 140.0.7339.80. Impact per sources: UI spoofing with low severity (CVSS v3.1 base score 5...

CVE-2026-5887

CVE-2026-5887 affects Google Chrome on Windows (Chromium-based) with insufficient validation of untrusted input in the Downloads feature prior to version 147.0.7727.55, allowing a crafted HTML page to bypass download restrictions. Connected advisories show fixed releases across distros: Chromium ...

CVE-2026-5888

CVE-2026-5888 concerns Google Chrome/WebCodecs. The issue is described as an uninitialized use in WebCodecs that could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability is categorized with a Medium severity in Chromi...

CVE-2026-7904

CVE-2026-7904 impacts Google Chrome/Chromium fonts handling. Description: an out-of-bounds read in Fonts allows a remote attacker to induce an out-of-bounds memory read via a crafted HTML page. Affected state: Chrome before 148.0.7778.96 (Linux, Windows, Mac). Impact details stated: high Chromium...

CVE-2026-7913

Summary: CVE-2026-7913 describes an "Insufficient policy enforcement in DevTools" in Google Chrome on Android . The issue allows a local attacker to escalate privileges through a malicious file, with a Chromium security severity listed as High. The vulnerability is defined as affecting the DevToo...

CVE-2026-7919

CVE-2026-7919 affects Google Chrome/Aura. Use-after-free in Aura prior to 148.0.7778.96 could allow a renderer‑process‑compromised attacker to escape the sandbox via a crafted HTML page. The Chrome 148 stable release (148.0.7778.96 and later) includes fixes for this issue. Mitigation is to update...