CVE-2026-7973

CVE-2026-7973 corresponds to an integer overflow in Dawn within Google Chrome on Windows, fixed in Chrome 148.0.7778.96. The vulnerability could allow a sandbox escape via a crafted HTML page. Affected component: Dawn (graphics pipeline) in Chrome’s Chromium-based stack. Root cause: integer overf...

CVE-2025-12446

The CVE-2025-12446 issue affects Google Chrome (Chromium-based) before version 142.0.7444.59, where an Incorrect security UI in SplitView could be exploited by a user who engaged in specific UI gestures to trigger UI spoofing via a crafted domain name. The connected Astra/Fedora/DEBIAN/EUVD entri...

CVE-2026-13804

CVE-2026-13804 is a use-after-free in Chrome’s Chromecast component (Chromium-based) that could allow a remote attacker with renderer access to escape the sandbox via a crafted HTML page. Affected product: Google Chrome on desktop (Chromecast path). Root cause: use-after-free in Chromecast in Chr...

CVE-2026-5882

CVE-2026-5882 affects Google Chrome/Chromium's fullscreen UI, where a crafted HTML page could trigger UI spoofing. The issue is described as an incorrect security UI in fullscreen prior to version 147.0.7727.55. The Chrome stable update 147.0.7727.55 (and related Chromium fixes) addresses this vu...

CVE-2026-6358

The CVE describes a Use-After-Free in XR for Google Chrome on Android, before version 147.0.7727.101, allowing a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affected product: Google Chrome for Android (XR component). Cause: use-after-free in the XR path leads ...

CVE-2026-6359

The CVE-2026-6359 vulnerability affects Google Chrome on Windows and stems from a Use‑After‑Free in the Video component. A remote attacker who has already compromised the renderer process could trigger out‑of‑bounds memory access via a crafted HTML page, underlining the impact of high severity. A...

CVE-2026-6361

Google Chrome on Windows is affected by a heap buffer overflow in PDFium (CVE-2026-6361). The flaw allows a remote attacker to execute arbitrary code inside the sandbox by guiding a user to perform specific UI gestures with a crafted PDF file. Affected version range is Chrome on Windows prior to ...

CVE-2026-76039

Google Chrome on Android prior to 151.0.7922.169 contains an incorrect reference resolution flaw in Core, allowing a remote attacker to use social engineering and a crafted HTML page to obtain sensitive information (CVSS 6.5, confidentiality-high). CISA SSVC reports no active exploitation. Fix: u...

CVE-2026-7925

CVE-2026-7925 is a use-after-free in Chromoting within Google Chrome on Windows, prior to 148.0.7778.96, enabling a local attacker to perform OS‑level privilege escalation via a malicious file. Affected software: Chrome/Chromoting component on Windows; root cause: use-after-free. Impact: local pr...

CVE-2026-7928

Use-after-free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected: Chrome (Windows) with WebRTC; root cause: use-after-free in WebRTC. Impact: high; exploitability limited to a craft...

CVE-2025-12910

CVE-2025-12910 describes an improper Passkeys implementation in Google Chrome/Chromium that allows a local attacker to obtain potentially sensitive information via debug logs. The vulnerability is tied to Chrome/Chromium’s Passkeys handling and is classified with a low severity in Chromium’s metr...

CVE-2026-76037

CVE-2026-76037 is a link following vulnerability in the CredentialProvider component of Google Chrome on Windows , affecting versions prior to 151.0.7922.169 . A local attacker can potentially execute arbitrary code outside the sandbox via a local program. The Chromium security severity is High ,...

CVE-2026-4452

CVE-2026-4452 details an integer overflow in ANGLE used by Google Chrome on Windows, allowing remote heap corruption via a crafted HTML page. Connected documents confirm vulnerable ANGLE/Chromium components and reference patches in Chromium-based packages (e.g., Chromium around 146.0.7680.153 and...

CVE-2026-5892

CVE-2026-5892 affects Google Chrome/Chromium PWAs. The root cause is insufficient policy enforcement for PWAs in the renderer, allowing a remote attacker who had compromised the renderer to install a PWA without user consent via a crafted HTML page. Affected versions are prior to 147.0.7727.55 (C...

CVE-2026-6308

CVE-2026-6308 is a Google Chrome/Chromium vulnerability: an out-of-bounds read in the Media component that can be triggered by a user who is persuaded to perform specific UI gestures on a crafted HTML page. The issue affects Chrome/Chromium prior to version 147.0.7727.101; patches are included in...

CVE-2026-5875

CVE-2026-5875 is a policy bypass in Blink used by Google Chrome before version 147.0.7727.55, allowing a remote attacker to spoof UI via a crafted HTML page. The CVSS 3.1 base score is 4.3 (Medium), with network attack vector, no privileges required, user interaction required, and partial integri...